A Missed Connection Found Online >>
<< Jury Invalidates Patent On Bond Trading Tech
 tdicon 
Mobile Service Costs Not All That Different... >>
<< Lose A Phone, Lose A Friend
 | 

Stupidity

by Mike Masnick

Tue, Feb 22nd 2005 8:26pm





How Paris Hilton Got Hacked? Bad Password Protection

from the tinkerbell dept

This morning, in Good Morning Silicon Valley, John Paczkowski joked (I think) that he'd bet "$5 and a Swarovski-encrusted dunce cap says her password was Tinkerbell." He might be right. While T-Mobile still says they're trying to figure out how Paris Hilton's T-Mobile account got hacked, Brian McWilliams has it all figured out. Her password might not have been Tinkerbell (the well known name of her dog), but the secret question to get her password reset was: "What is your favorite pet's name?" Yup. It wasn't necessarily social engineering or a security hole or even real hacking (though, in some sense, it was a combination of all three). It was good, old fashioned, stupidity -- leaving the keys under the front door matt with a big sign that says "keys under the matt" next to it.

9 Comments | Leave a Comment

If you liked this post, you may also be interested in...

Reader Comments (rss)

(Flattened / Threaded)

  1.  
    identicon
    nonuser, Feb 22nd, 2005 @ 8:51pm

    the joke may be on Hilton

    but the real culprit are service providers who rely on such an insecure backdoor that gets hacked when customers use it the way they suggest.

     

    [ reply to this | link to this | view in thread ]

  2.  
    identicon
    Precision Blogger, Feb 23rd, 2005 @ 6:59am

    Bruce Schneier wrote just recently about this secu

    Bingo! Bruce Schneier wrote just recently about how the backup question weakens password protection. He says when forced to supply a Q&A, he hitsrandom keys that he won't remember for the answer. See:
    http://www.schneier.com/blog/archives/2005/02/the_curse_of_th.html


    - The Precision Blogger
    http://precision-blogging.blogspot.com

     

    [ reply to this | link to this | view in thread ]

  3.  
    identicon
    Anonymous Coward, Feb 23rd, 2005 @ 7:38am

    Use " other " ? & make one up


    Use the " oter " question catagory.
    Ask yourself a question that NOONE would understand BUT you.
    Works for me & even if the system were hacked, my question wouldn't even make sense to the hacker.

    Problem solved.

     

    [ reply to this | link to this | view in thread ]

  4.  
    identicon
    Tim, Feb 23rd, 2005 @ 8:16am

    Re: Bruce Schneier wrote just recently about this

    Do it jeopardy-style:

    secret reminder question: meow
    reminder answer: What do dogs say?

    That's one heck of a long passphrase for no extra work ;)

     

    [ reply to this | link to this | view in thread ]

  5.  
    identicon
    seth, Feb 23rd, 2005 @ 8:31am

    Re: Use

    I always just enter a lot of gibberish whenever I am required to have a reminder question. Then I just don't forget my password or I have it emailed to me if I do forget. I always distrusted the back-up password.

     

    [ reply to this | link to this | view in thread ]

  6.  
    identicon
    Ranger, Feb 24th, 2005 @ 10:26am

    Re: Use

    Am I the only one suspicious of her getting hacked in the first place? I mean, isn't she due for some scandalous web-activity about now?

    I mean, who keeps perfect naked pictures of themselves on their mobile camera? For what possible reason? "Hey, I want to see if I've gained any extra weight from eating that ice cream sundae?"


     

    [ reply to this | link to this | view in thread ]

  7.  
    identicon
    Nick, Feb 25th, 2005 @ 8:19am

    T-Mobile Password Hacking

    ... another likely theory was given in this post over at Kevin Rose's site.
    The hack is a simple one that I duplicated easily. If you have Sprint or T-Mobile and have auto voicemail login enabled, you are vulnerable to this type of attack. I have auto voicemail login enabled because I hate entering my voicemail PIN number each time I want to check my messages. The voicemail authentication system is simple. It uses caller ID to validate the originating number – if the caller ID matches your cell phone number (ie. your cell phone calling in to check your voicemail messages), it will log you in automatically. This system has worked great for the last few years. Well, that is until the advent of commercial caller ID spoofing systems such as CovertCall and Telespoof. For those not in-the-know, caller ID spoofing allows you to change your caller ID number to anything you like. To hack myself, I simply logged into CovertCall and placed a spoofed call to my cell phone. The spoofed call was to my cell phone, from my cell phone, forwarded to a pay phone. Sprint (my provider) thought I was calling from my cell, and automatically logged me in (even though I was performing this from a pay phone down the street).

     

    [ reply to this | link to this | view in thread ]

  8.  
    identicon
    Katie, Oct 30th, 2006 @ 6:50am

    Paris Hilton

    Finally her stupidity is realized!!!

     

    [ reply to this | link to this | view in thread ]

  9.  
    identicon
    chester.., May 23rd, 2008 @ 9:23am

    paris hiltoon

    There is NOTHING iconic about Paris Hilton..

     

    [ reply to this | link to this | view in thread ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
A Missed Connection Found Online >>
<< Jury Invalidates Patent On Bond Trading Tech
 tdicon 
Mobile Service Costs Not All That Different... >>
<< Lose A Phone, Lose A Friend
 | 
Follow Techdirt
Flattr rss rss
A word from our Sponsors...
Sponsored Resource
Essential Reading
Techdirt Reading List
Techdirt Insider Chat

A word from our Sponsors...
Recent Stories

Thursday

11:20pm: Yet Another Anti-Patent Troll Bill Introduced In Congress (1)
8:19pm: District Attorney And Major TV Network Sued Over Stupid Reality Show (5)
5:00pm: DailyDirt: Tuition Debt Is For Chumps? (15)
4:01pm: Adam Savage On Why Copyright And Trademark Holders Need To Get Over Their Obsession With 'Control' (17)
3:01pm: Partisanship Over Spying On Journalists Is Stupid: Spying On Journalists Is Bad, Period (20)
2:00pm: Magic Hat Brewery Sues West Sixth Brewing, Claiming 6 Looks Too Much Like 9 (37)
1:01pm: Filmmaker Behind The Pirate Bay Documentary Says Bogus DMCA Takedowns Take Away His Free Speech (82)
12:04pm: Vermont Declares War On Patent Trolls; Passes New Law And Sues Notorious Patent Troll (7)
11:05am: Prenda Lawyer Says Georgia Court Should Ignore Judge Wright's Order Because... Look! Hackers! (39)
10:01am: Chicago School System On FOIA Requests: Stonewalling, Obfuscation, & Paper-Shredding (22)
More arrow
A word from our Sponsors...

Close

Email This