Think before answering security questions

The recent hacking on the Republican vice presidential candidate has highlighted the weak security links in Web e-mail security.

Basically, the hacker (or, perhaps, hackers) appears to have exploited a weakness in the Yahoo e-mail service password reset system. Note that these password resetting systems are featured on many Web sites (not only on Yahoo!).

The personal details that made this possible — e.g. the birth date, zip code, school — were all found on online sources freely available to the resourceful Internet user.

Aside from finding a way to defeat the security procedure used in Yahoo’s password resetting system, the other significant aspect of the hacking was the perpetrator’s use of a proxy service (in this case, the CTunnel service) to cover their tracks and hide their real location.

The proxy service site is also used by users in schools and businesses who want to gain access to other sites that network administrators usually block.

The FBI and the Secret Service have already started formal investigations on the matter.

The son of a state legislator from Tennessee is reportedly the target of speculations about the hacker’s identity. A person posted a message on a popular /b/ board on the 4chan.org website, using the handle “rubico.” This handle has been linked to an email-address “rubico10@yahoo.com,” which in turn has been attributed to the state legislator’s son, a student at the University of Tennessee-Knoxville.

According to security experts, this multi-step but ultimately simple hack was made possible by fundamental problems associated with the security procedure in most public e-mail services, which rely largely on passwords. If someone wants to reset the password, the security questions posed by the e-mail service can be answered using data that can be supplied from public records or information available on the Internet. It is relatively easy for people to figure out the required information.

* The experts say security protocol in the public e-mail providers should set up more complicated questions that require not-so-obvious answers before passwords can be reset.

* It is also recommended that providers require and confirm an alternate channel, e.g. a secondary e-mail address, in order to reset passwords. It may also be necessary to authenticate IP addresses, especially in the case of requests to change the password originating from a computer that’s different from the user’s original IP.

* Experts also believe e-mail messages should be encrypted (both in storage as well as when in motion).

Safety Tip:

* Make your security question’s answer something that cannot be found on the Web. This may be one good time to provide a false answer (which only you can think of) to a security question.