Tactic used to access VP candidate's e-mail works on the top three services
September 19, 2008 (Computerworld)
Yahoo
Mail isn't the only Web-based mail service that could be duped into
giving up someone else's account password, the tactic that some have
argued was used to break into Gov. Sarah Palin's e-mail earlier this week.
Google Inc.'s Gmail, Microsoft Corp.'s Windows Live Hotmail and Yahoo Inc.'s Mail
all rely on automated password-reset mechanisms that can be abused by
anyone who knows the username associated with an account and an answer
to a single security question, according to quick tests run by Computerworld.
Computerworld
reporters and editors were able to "break" into their own and
colleagues' accounts on all three services, then reset passwords armed
only with the account's username and the correct response to one of a
limited number of common security questions, such as mother's maiden
name, the name of a favorite pet or the make of a first car.
Some
of the personal information that would provide answers to the security
questions may be easily found by searching social networking sites or
the Internet, the approach a hacker labeled as "rubico" claimed to have used to dig up the responses necessary to access Palin's account.
Hackers
who know the username of an account -- which is often identical to the
part of the e-mail address that precedes the "@" symbol -- and
correctly type the distorted "CAPTCHA" characters are faced with only a
security question before being allowed to change the account password.
(CAPTCHA, or "Completely Automated Public Turing Test to Tell Computers
and Humans Apart," is the name for the security tool that uses
distorted, scrambled characters to stymie automated bots.)
None
of the services required that the new password be sent to an alternate
e-mail address -- although that was an option for all three -- and
instead offered an all-online process.
Adam O'Donnell, director
of emerging technologies at message security vendor Cloudmark Inc.,
said that automated password-reset is the rule in Web-based mail,
whether the service is free, like Yahoo, Hotmail and Gmail, or offered
as part of the monthly fee by one's Internet service provider.
"ISPs
have razor-thin margins, and one call to the help desk to reset a
password would wipe out the month's profit on that user," said
O'Donnell in an interview yesterday.
At the time, although other security experts were skeptical
of the hacker's claim to have accessed Palin's account through a
password-reset, O'Donnell had said it sounded "very plausible."
According to rubico, who some have speculated is the 20-year-old son of a Tennessee state legislator, the online research needed to reset Palin's password took just 45 minutes.
Yahoo, Hotmail, Gmail all vulnerable to Palin-style password-reset hack
|
