Account Hijacking

May 15, 2008

Recently, a Nigerian scammer gained access to my mother’s free email account. Perhaps he guessed her password, or easier still, her secret question. Masquerading as my mother (identity theft!), he then tried to get money from people in her address book (see email transcript below). Seems like an effective scam, judging by the number of people who were ready to wire the money to Nigeria! 

In any case, the scammer had completely taken over her account, and all our attempts to regain access were fruitless. Of course, the scammer had already changed the security question, so we were unable to complete the automated procedure to regain access. And what are the admins to do anyway? How does one prove rightful ownership of a hijacked account when the hijacker has gone ahead and changed all the profile information?

Long story short, you might wake up one morning, only to find that you’ve lost access to all your stored messages and online address book. I suspect that many folks don’t make local backups of their email folders because they trust the (free) online services to have reliable storage, and believe that their passwords are safe. But even the smartest of folks can have their passwords phished. A colleague of mine, a security researcher, was tricked into revealing his password by way of a link that was injected into his ongoing instant-messaging chat window! He too lost access to his email account. You can never be too safe. (Update: I too got phished in a moment of weakness. Sigh. Luckily I realized this immediately, and changed my password before I lost all access to my account).

I think we should all give this scenario a moment’s thought. What would you do if one of your online accounts was hijacked? Is there a fail-safe procedure to regain access? Personally, I’d rather stick to my university email account, because my trusty sysadmin can restore access if needed. But what if your online bank account was hijacked? Will your bank refund any money siphoned out of your account? What’s the fine print on their “money back guarantee”?

Links

Here’s a resource by Carnegie Mellon University to get you started:

http://www.mysecurecyberspace.com/encyclopedia/index/account-hijacking.html

Here’s an interesting podcast about identity theft in general (The featured guest is Frank Abagnale, for those of you familiar with the film Catch Me If You Can.): 

http://www.wnyc.org/shows/bl/episodes/2008/04/24#segment97397

Email transcript

Please i am in a hurry writing this mail, I’m presently in  Nigeria for an Educational program and i have gotten myself stranded here please could you help me with $3,500 and i will return it as soon as i return.Please i wait to hear from you soon as to send you the information on how to send the money through Western Union or Money Gram,Please keep this between us until i return. i will like you to reply in English Because i am sending this mail from a near by city library here and it only shows mail written in English..

I wait to hear from you soon.

Regards,

Leave a Comment » | Identity Theft | Tagged: , , , | Permalink
Posted by Apu Kapadia

Secret Questions

May 12, 2008

 

Online services ask us to pick hard-to-guess passwords, and in the same breath ask us to answer “secret questions” just in case we forget our passwords. Some of these questions are “What was your first pet’s name?” or “What street did you grow up on?” 

The attack is obvious: why bother trying to guess someone’s password if you can focus on the easier task of guessing that person’s first pet’s name? As Brainard et al. [1] point out on the same issue, the question “What was the make of your first car?” is weak because “General Motors, for example, had about a 43% market share in the United States in 1983.” In short, secret questions have lower entropy (they are less random) than passwords, are easier to guess, and are thus the weakest link.

Now, this topic is not new. Bruce Schneier wrote about it a few years ago [2]. Schneier says that he “type[s] a completely random answer,” but consider this anecdote: a colleague of mine uses the same technique. He called up customer service once, who then asked him, “what’s the answer to your security question?” He said, “some random numbers.” The response was “okay.” So picking random numbers might be less secure than picking a realistic answer? :-)

Anyway, what surprises me is that secret questions are still prevalent today. Why aren’t more people up in arms about this issue? There needs to be an uprising. Go!

 

References

[1] J. Brainard, A. Juels, R. Rivest, M. Szydlo, and M. Yung. “Fourth Factor Authentication: Somebody You Know,” ACM CCS ’06.

[2] Bruce Schneier, “The curse of the secret question,” Computerworld, February 09, 2005

Leave a Comment » | Authentication | Tagged: , , | Permalink
Posted by Apu Kapadia

Hello World

May 11, 2008

This is my first blog entry ever. Run!

Leave a Comment » | Uncategorized | Permalink
Posted by Apu Kapadia