Paris Hilton may be victim of T-Mobile Web holes

The hacking may have exploited the company's Web site

The hackers who stole information from hotel heiress Paris Hilton's mobile phone account and those of other T-Mobile customers may have taken advantage of a hole in T-Mobile's Web site, according to security experts and those familiar with the incident.

A flaw in a Web site feature to reset T-Mobile account passwords is believed to have played a role in the hack of Hilton's T-Mobile Sidekick account, which resulted in her star-studded address book, photos, e-mail messages and voice mail being posted for public consumption on the Internet (see story). The password-reset hole is just one of hundreds or even thousands of similar flaws in the mobile provider's Web page that could give malicious hackers easy access to customer information, according to an analysis by a security expert.

A spokesman for T-Mobile USA Inc., a division of T-Mobile International AG, declined to comment specifically on the password-reset exploit or on the security of the company's Web site, despite repeated requests. In an e-mail statement attributed to Sue Swenson, chief operating officer of T-Mobile USA, the company said that it cares about protecting the security and privacy of its customers and that the company is "aggressively investigating the illegal dissemination of information over the Internet of T-Mobile customers' personal data."

Rumors about how Hilton's Sidekick was hacked have been in abundance since her account was posted on Web sites Feb. 20. One leading theory suggests that it may have been linked to a 2003 hack by Nicolas Jacobsen, the 22-year-old who pleaded guilty Feb. 15 to compromising the accounts of 400 T-Mobile customers. Another attributes it to an easy-to-guess password on Hilton's account.

But the hack may in fact be fallout from a technical analysis of the company's Web site based on information in an affidavit filed in the Jacobsen case by U.S. Secret Service agent Matthew Ferrante.

In a Feb. 17 blog posting, Jack Koziol, a senior instructor at InfoSec Institute, used information in the affidavit and publicly available information on T-Mobile's site to discuss how Jacobsen compromised T-Mobile's servers in 2003.

Koziol speculated that Jacobsen used a SQL injection attack to compromise T-Mobile's servers and noted that, as of his posting, there were "literally hundreds of injection vulnerabilities littered throughout the T-Mobile website," according to his blog, "Ethical Hacking and Computer Forensics."

In a SQL injection attack, attackers use a SQL database query to send, or "inject," unexpected commands into a SQL database, allowing them to manipulate the database's contents.

Early on Feb. 19, Koziol received an e-mail from a reader complimenting him on his blog. The e-mail contained an exploit for a T-Mobile Web site hole that allowed anyone to gain access to a T-Mobile account from the T-mobile.com Web site, as long as they knew the account holder's T-Mobile phone number. In the e-mail message, the exploit was attributed to a hacking group called "DFNCTSC Team."

"I know you said you cant exploit stuff, cause you are all white hat and work in the industry, but i am not legal age yet to go to jail, so i can," the message reads, in part.

When Hilton's address book first appeared on the Internet, posts about it were accompanied by a message claiming credit for DFNCTSC.

The exploit described in the e-mail takes advantage of a flaw in a password-reset feature in T-Mobile's Web site. Visitors who have a valid T-Mobile phone number can use the feature to receive a unique token to reset their passwords. A flaw in the design of the reset feature allows Internet users who know the URL of the password-reset page to bypass a user authentication page and change an account password without providing information proving they are the account's owner, according to Koziol.

"It's a session management problem. [T-Mobile] fails to properly keep track of where users are," Koziol told the IDG News Service. "It's not an earth-shattering vulnerability that takes a Ph.D. in computer science to figure out. It's something a couple curious kids could do."

Koziol strongly encouraged the e-mail's author, who uses the online name "luckstr4w," not to attempt to hack T-Mobile's site, citing Nicholas Jacobsen's case as an example of serious consequences that could result.

Contacted by e-mail by IDG News Service, luckstr4w took credit for discovering the vulnerability and writing the exploit after reading Koziol's blog. Luckstr4w denied responsibility for the Hilton hack, saying an acquaintance, who knew Hilton's phone number, used it to change her account password and access her account.

However, in the same e-mail message, luckstr4w also claimed to have changed Hilton's account password to his handle, "luckstr4w," when he and his acquaintances took control of her account.

Luckstr4w insisted on communicating solely through an anonymous e-mail account, citing fears that phone conversations or other kinds of communications would be monitored.

However, the exploit luckstr4w takes credit for writing appears to have been around for much longer. In October, an identical version of it was included in a Zip file called "tMobile exploit tools" on the illmob.org Web site, in a section reserved for "zero day," or previously unknown exploits, according to an Illmob member who uses the online name "Pingywon."

Illmob.org was one of the first Web sites to display the Hilton address book information, though the group denies any involvement in the hack or any knowledge of how the address book was stolen, said Pingywon. He described himself as a news poster for Illmob.org, but not the person who posted the Hilton address book.

Sources within the hacking community said that both luckstr4w and the DFNCTSC are unknown. Whether luckstr4w was the author of the password-reset exploit, the hole was big enough that even inexperienced hackers could use it if they knew where to look, experts said.

Hilton's phone number, which is needed to carry out the hack, was also circulated widely within phone hacking (or "phone phreaking") circles prior to the hack, according to lucky225, a self-described phone phreaker, who declined to give his real name.

Phone phreakers took advantage of loose security on T-Mobile's voice mail system and a flaw in Caller ID technology to peruse Hilton's voice mailbox and those of her sister, Nicky, and other celebrities. The Hilton sisters' T-Mobile phone numbers were widely shared on multiuser party lines that are popular meeting places in the phone phreaking community, he said.

The ready availability of Hilton's number and of the exploit that could be used to give Internet users access to her T-Mobile accounts means that the potential list of hacking suspects is very long.

However, if luckstr4w's account is true, it casts doubt on other theories of how Hilton's Sidekick was compromised. Observers have theorized that her address book was taken by Jacobsen over a year ago but only recently surfaced, or that the heiress had an easy-to-guess password.

Regardless of who is responsible, the bigger problem is with T-Mobile and its public-facing Web sites, experts agree. The company's site is a tangle of hundreds or thousands of large and small security holes that would be found by even a routine scan using any vulnerability scanning tool, Koziol said.

He expressed shock that the company had apparently fixed the hole Jacobsen used in 2003 without doing a larger security review that would have turned up other problems.

Koziol said the problems facing T-Mobile's Web site are common to companies that move quickly to open their corporate networks to the Internet through Web-based applications, but he added that T-Mobile's case is extreme.

"They haven't done Web Security 101. I see many mistakes that they make over and over again. They're mostly injection vulnerabilities -- people being able to insert [malicious] code where they shouldn't," he said.

The hack of T-Mobile's Web site may be an inevitable consequence of companies, including mobile phone providers, adding new features that put more power into the hands of their customers, said Justin Bingham, chief technology officer at Intrusic Inc.

"This [Web site] code may or may not have been properly reviewed. This isn't that technically sophisticated of an attack, but it has far-reaching implications," he said.

The incident involving Hilton's account was well publicized, but it may not have been the first such compromise of T-Mobile's customer accounts, said Bingham.

"This is happening much more than we hear about. If it were my account that got hacked, nobody would post my information online, because who cares?" he said. "This underscores the fact that T-Mobile has a huge network and is servicing a huge chunk of customers, and that their network is wide open and could be completely hacked."

Copyright © 2005 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon