March 01, 2005, 11:47 AM — Hotel heiress Paris Hilton's mobile phone account and those of other T-Mobile customers may have fallen victim to hackers who took advantage of a gaping hole in the company's Web site to steal information, according to security experts and those familiar with the incident.
A flaw in a Web site feature to reset T-Mobile account passwords is believed have played a role in hacking Hilton's T-Mobile Sidekick account, which resulted in her star-studded address book, photos, e-mail messages and voice mail being posted for public consumption on the Internet. The password reset hole is just one of hundreds, or even thousands of similar flaws in the mobile provider's Web page that could provide easy access to malicious hackers, according to an analysis by one security expert.
A spokesman for T-Mobile USA Inc., a division of T-Mobile International AG & Co. K.G., declined to comment specifically on the password reset exploit or on the security of the company's Web site despite repeated requests. In an e-mail statement attributed to Sue Swenson, Chief Operating Officer of T-Mobile USA Inc., the company said that it cares about protecting the security and privacy of its customers, and that the company is "aggressively investigating the illegal dissemination of information over the Internet of T-Mobile customers' personal data."
Rumors about what was responsible for the hack on Hilton's Sidekick have been in abundance since her account was posted for public review on Web sites around the world on Feb. 20. Leading theories on the hack's source suggest that it may have been linked to a 2003 hack by Nicolas Jacobsen, the 22-year-old who pleaded guilty on Feb. 15 to compromising the accounts of 400 T-Mobile customers, or the result of an easy-to-guess password on Hilton's account.
But the hack on Hilton's account and those of other T-Mobile account holders may in fact be fallout from a technical analysis of the company's Web site based on information in an affidavit filed in the Jacobsen case by U.S. Secret Service agent Matthew Ferrante.
In a Feb. 17 blog posting, Jack Koziol, a senior instructor at InfoSec Institute, used information in the affidavit and publicly available information on T-Mobile's site to discuss the strategy that Jacobsen used to compromise T-Mobile's servers in 2003, including a hack of Hilton's account.
Koziol speculated that Jacobsen used a SQL (Structured Query Language) injection attack to compromise T-Mobile's servers and noted that, as of his posting, there were "literally hundreds of injection vulnerabilities littered throughout the T-Mobile website," according to his blog, "Ethical Hacking and Computer Forensics." (See: http://www.infosecinstitute.com/)
In a SQL injection attack, attackers use a SQL database query to send, or "inject," unexpected commands into a SQL database, allowing them to manipulate the database's contents.
In the early morning of Feb. 19, Koziol received an e-mail from a reader complimenting him on his blog. The e-mail contained an exploit for a T-Mobile Web site hole that allowed anyone to gain access to a T-Mobile account from the T-mobile.com Web site, as long as they knew the account holder's T-Mobile phone number. In the e-mail message, the exploit was attributed to a hacking group called "DFNCTSC Team."
"I know you said you cant exploit stuff, cause you are all white hat and work in the industry, but i am not legal age yet to go to jail, so i can," the message reads, in part.
Hilton's address book first appeared on the Internet on Feb. 20. Posts of the information were accompanied by a message that claimed credit for the hack for DFNCTSC.
The exploit described in the e-mail to Koziol takes advantage of a flaw in a password reset feature in T-Mobile's Web site. Visitors who have a valid T-Mobile phone number can use the feature to receive a unique token to reset their passwords. A flaw in the design of the reset feature allows Internet users who know the URL (Uniform Resource Locator) of the password reset page to bypass a user authentication page and change an account's password without having to provide information that proves they are the account's owner, according to Koziol.
"It's a session management problem. (T-Mobile) fails to properly keep track of where users are," Koziol told IDG News Service. "It's not an earth-shattering vulnerability that takes a Ph.D in computer science to figure out. It's something a couple curious kids could do."
Koziol strongly encouraged the e-mail's author, who uses the online name "luckstr4w," not to attempt to hack T-Mobile's site, citing Nicholas Jacobsen's case as an example of serious consequences that could result.
