[ARTICLE] Virgin Mobile accounts are easy to hack

[ktb83]

Wired.com - Virgin Mobile Shrugs as Coder Warns Accounts Are Easily Hijacked
Virgin Mobile Shrugs as Coder Warns Accounts Are Easily Hijacked | Threat Level | Wired.com

More details:
http://kev.inburke.com/kevin/open-season-on-virgin-mobile-customer-data/

 

[Petrah]

We already knew VM USA's security was terrible. Where's that other thread...

 

[ktb83]

We already knew VM USA's security was terrible. Where's that other thread...

It is clearly bad. I wouldn't have guessed it was this bad!

Rate-limiting relying only on cookies? WTF?

 

[rcsrich]

We already knew VM USA's security was terrible. Where's that other thread...

Yeah- and now every idiot in the world knows just how poor their security is.

Yay.

 

[Petrah]

It is clearly bad. I wouldn't have guessed it was this bad!

Rate-limiting relying only on cookies? WTF?

Any company that asks for your pin number in emails, on Facebook, or on Twitter is bad. We tried to warn everyone before (in another thread) but no one would listen.

 

[mogelijk]

I find it interesting I've been unable to get to the "My Account" page on the VM website since yesterday.

 

[hchen42]

I find it interesting I've been unable to get to the "My Account" page on the VM website since yesterday.

I still can. I did get a "service overload, try again" page. Try refresh the page.


I wouldn't be surprised if the hacking has begun.

 

[rcsrich]

I still can. I did get a "service overload, try again" page. Try refresh the page.


I wouldn't be surprised if the hacking has begun.

Excellent! Uh, I mean bogus...

 

[rcsrich]

...and still no reply from VM as to if they will fix the issue. Classy.

 

[MacFett]

Where's that other thread...

Ta-dah! http://androidforums.com/virgin-mobile/554961-do-you-divulge-your-pin-vm-customer-care.html

I specifically do not keep a card on file with VMU because of this.

 

[aurora40]

Someone in the comments noted that they disallow PINs with the same digit repeated 3 times. For anyone else similarly pedantic, that reduces the combinations by 35,919.

 

[Petrah]

Someone in the comments noted that they disallow PINs with the same digit repeated 3 times. For anyone else similarly pedantic, that reduces the combinations by 35,919.

Doesn't matter. A piece of software can sit there and guess numbers at lightening speed. Only someone who didn't know what they're doing is going to sit there and manually try to guess a 6 digit pin number.


Try any 6 digit number combination here: How Secure Is My Password?

 

[aurora40]

Doesn't matter. A piece of software can sit there and guess numbers at lightening speed. Only someone who didn't know what they're doing is going to sit there and manually try to guess a 6 digit pin number.

I didn't suggest a 6 digit PIN was secure. I was simply curious how many of the 1,000,000 combos were excluded by the restriction that you not have 3 of the same digit in a row.

I'm aware of how quickly a computer can programatically walk through 1,000,000 numbers, as I wrote a quick one-liner to come up with the 35,919 number vs try to recall my days in Discrete Mathematics as an undergrad.

With the article from the OP using a 1-sec per try, that would save about 9 1/2 hours.

 

[Petrah]

My boyfriend is a programmer by trade (works his business from our home)... I honestly dunno how you guys do that math. Just looking at it makes my head implode.