What companies consider \u201cstandard industry practices\u201d for web security never fail to amaze. This time it\u2019s Virgin Mobile US in the firing line, having been outed as having some incredibly poor authentication on their website.<\/p>\n
The main problem here is that the Virgin Mobile US website forces you to use your cell phone number as your username and a 6-digit numerical PIN as your password, with unlimited attempts to guess that password. Having 6 digits as password possibilities means that there are only 1 million combinations. Given that the website gives restrictions for the number of repeated or sequential digits, it\u2019s really a whole lot less than that. I\u2019m sure the intent there was to help you create a more difficult-to-guess PIN, but when there are so few choices and so many attempts, it\u2019s really a wasted effort. And given that Virgin Mobile US has 6 million subscribers, this means that well more than 1 in every 6 customers have the same PIN.<\/p>\n
Virgin Mobile has not yet made any effort to fix this, despite being informed about the issue over a month ago\u00a0by developer Kevin Burke<\/a>. Even more galling is that Virgin reps requested that he include both phone number and PIN in communications with them. So there are the keys to the metaphorical castle, in plain text, for anyone to steal. How convenient!<\/p>\n This vulnerability in the Virgin Mobile website allows the following actions:<\/p>\n At this time, there is no way for Virgin Mobile users to protect against access or change to their accounts. It\u2019s recommended that you remove your credit card information from the website, at least until this issue has been fixed.<\/p>\n Burke provided Virgin Mobile with a list of possible ways to resolve this issue, which are all excellent security recommendations. Hopefully they get on this soon, as this could lead to some serious Honan-style hacking mayhem<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" What companies consider \u201cstandard industry practices\u201d for web security never fail to amaze. This time it\u2019s Virgin Mobile US in the firing line, having been outed as having some incredibly poor authentication on their website. The main problem here is that the Virgin Mobile US website forces you to use your cell phone number as […]<\/p>\n","protected":false},"author":6,"featured_media":6034,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[13],"tags":[],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n\n