Coinbase design allows for mass, targeted phishing of its users

Re:Coinbase design allows for mass, targeted phishing of its... by infosec-au on Monday March 31, 2014 @10:07PM (#7505714)

The actual bug report is the technical section of my blog post:

http://blog.shubh.am/full-disclosure-coinbase-security/#tech...

You're reading the Proof of Concept, which is meant to be a practical demonstration of how once could use the bug to their advantage. I didn't document the proof of concept in detail, to ensure that others couldn't easily use the blog post as a guide to harvesting Coinbase emails.

If you want the full, technical bug report, please visit: http://shubh.am/bugs/coinbase.htm

[ Parent | on HN ]

Re:Coinbase design allows for mass, targeted phishing of its... by abalone on Monday March 31, 2014 @10:33PM (#7505805)

The "full, technical" report doesn't offer any new information. It just shows how to get the firstname and lastname.

The PoC does not at all demonstrate how the alleged bug could be used by phishers to their advantage.. it doesn't even show usage of the firstname or lastname! That makes it incoherent.

[ Parent | on HN ]

Re:Coinbase design allows for mass, targeted phishing of its... by infosec-au on Monday March 31, 2014 @11:48PM (#7506075)

I don't think you understand, the PoC is not supposed to be a PoC for phishing but rather a PoC for their lack of rate limiting [1] , and user enumeration. I have showed the first name and last name [2], but have accordingly blurred them out [3] as I felt it was only appropriate.

In the technical section, I demonstrate where the first and last name would show up in the response from Coinbase. If you still think it's unclear, let me know, as reporting is something I wish to improve critically.

I appreciate the response from the Bitcoin community and the semi-fix from Coinbase they wish to implement in the future (optional masking of names on coinbase). However, I do also hope that rate limiting is implemented in the future, as I still personally consider this insecure by design.

[1] : http://i.imgur.com/nauHivq.png

[2] : http://blog.shubh.am/full-disclosure-coinbase-security/#tech...

[3] : http://i.imgur.com/l84eOi6.png and http://i.imgur.com/SDlbtty.png

[ Parent | on HN ]

Re:Coinbase design allows for mass, targeted phishing of its... by gaadd33 on Tuesday April 01, 2014 @01:04AM (#7506264)

How would rate limiting really solve this though? Wouldn't it just result in needing to use a botnet/spend more time harvesting?

Assuming that this is still the easiest way to harvest email/name pairs for phishing, then it seems like the time it takes isn't really a factor in the outcome since it can be parallelized and is still easier than phishing alternatives. It seems like the real answer is just to have it return the same response no matter if there is an account or not.

[ Parent | on HN ]