First, let me define what “trolling” is in the context of Twitter. From Wikipedia:
In Internet slang, a troll (/ˈtroʊl/, /ˈtrɒl/) is a person who sows discord on the Internet by starting arguments or upsetting people, by posting inflammatory,[1] extraneous, or off-topic messages in an online community (such as a newsgroup, forum, chat room, or blog) with the intent of provoking readers into an emotional response[2] or of otherwise disrupting normal, on-topic discussion,[3] often for the troll’s amusement.
Now, something that I have been tracking for the last little while is a trolling battle between Canadian cellular carriers Public Mobile and Freedom Mobile on Twitter. Here’s a couple of examples from today that I have captured:
As you can see, Freedom Mobile is at present taking shots at Public Mobile when the latter Tweets something. But last week, things were much different. Here’s an example:
As you can see in this one, Freedom Mobile is being trolled by Public Mobile. It clearly annoyed the former enough for them to try and bring Public Mobile’s corporate parent Telus into the discussion. Though clearly that didn’t seem to calm things down. In case you’re wondering what they are talking about, Freedom Mobile recently had issues with US roaming that Public Mobile was all too happy to point out.
I question the wisdom of these two parties getting into a trolling battle as both parties might come off looking like they have a couple of teenagers living in mommy’s basement running their respective Twitter accounts not very professional in the process. While this is fun to watch, Public Mobile and Freedom Mobile may wish to simply cut it out and get back to running their respective operations. After all, I don’t choose my cell phone carrier based on their ability to troll their competition. I choose my cell phone carrier based on coverage, pricing, and customer service. On those fronts, I am not sure that any of that comes across in this exchange of insults and barbs on Twitter.
Hacker Demonstrates Weak Security In Freedom Mobile’s Customer Login System
Posted in Commentary with tags Freedom Mobile on February 13, 2018 by itnerdMobileSyrup is reporting that goes by the moniker NullHumanity has uncovered a vulnerability in Freedom Mobile’s customer login system. Meaning that Freedom Mobile customers could be at risk of hackers gaining access to some of their personal information.:
It’s CAPTCHA after 3, which is not unbreakable. Also there exists a method to forcibly reset the counter after one hour. This was a trivial discovery during my initial research period.
A skilled attacker would find this, and would be almost guaranteed to have a CAPTCHA bypass method at their disposal. 5 requests per hour is still going to result in a lot of account details being found.
I added very large delays in my script so as not to stress the login server and I was still seeing a new success every 30 or so seconds.
I would say a skilled attacker could breach an account and extract data 200 times per minute on a mid level machine.
In other words, it’s possible to brute force your way into the system. And once you’re in, you could have access to all that personal information.
Freedom Mobile said this:
For its part, Freedom Mobile’s vice-president of external affairs, Chethan Lakshman, stated over email: “The security measures we have in place cannot protect against guessing common passwords. We continue to strongly encourage our customers to use unique PIN numbers that are not easy to guess, and to change their PINs frequently to best protect their personal account information.”
Lakshman also said that Freedom continuously reviews its security practices and is “committed to making improvements and changes as appropriate to continue keeping our customers’ information secure.” Freedom’s security measures, said Lakshman, are designed to protect Freedom Mobile customers’ information from malicious activity while “meeting customer demands for a resonable login process.”
I guess that translates to “if you get pwned, it’s not our fault.” In terms of their advice of changing your PIN. That’s not going to make you any safer. What will make users safer is for Freedom Mobile to give their security a rethink. Because you’d think that Freedom Mobile would take the security of their user base seriously. But clearly they don’t based on the statement above.
#Fail
Leave a comment »