How Paris Got Hacked?
by Brian McWilliams02/22/2005
Paris Hilton's Chihuahua couldn't protect her Hollywood home from a burglary last summer. So why was Hilton counting on her dog to protect her T-Mobile account from intruders?
Despite repeated attacks on her T-Mobile email and telephone records in recent months, the actress and heiress has persisted in using the little dog's name to secure her password at the T-Mobile site.
Like many online service providers, T-Mobile.com requires users to answer a "secret question" if they forget their passwords. For Hilton's account, the secret question was "What is your favorite pet's name?" By correctly providing the answer, any internet user could change Hilton's password and freely access her account.
Hilton makes no secret of her affection for her Chihuahua. Last August, Hilton offered a reward of $5,000 when her beloved pet disappeared after the house she shared with sister Nicole was burglarized.
An anonymous source provided O'Reilly Network with a screen grab, proving he was able to access the contents of Hilton's T-Mobile inbox as of Tuesday morning. Another image confirmed that Hilton's "secret answer" was her dog's name.
Upon being notified Tuesday, T-Mobile corrected the potential security vulnerability in Hilton's account.
|
Related Reading 
Spam Kings |
Last weekend, Hilton's T-Mobile online account was accessed by intruders calling themselves "The Niggas at DFNCTSC." The trespassers posted the contents of her address book, notes, and photo folder on the internet.
In January, Hilton reportedly suspected that a "hacker" had access to her email account and was reading messages there.
It's unclear how those intruders gained access to Hilton's account. A T-Mobile spokesperson said the company is "actively investigating" the situation.
Weak passwords are cited as one of the top twenty internet security vulnerabilities by the SANS Institute.
Account information belonging to Hilton and other T-Mobile users has been circulating in the computer underground since at least late March of 2004. A California man named Nicholas Jacobsen has admitted to hacking into T-Mobile's servers and accessing records on at least 400 customers. (Last week, security professionals openly speculated about how Jacobsen gained access to the wireless provider's internal systems.)
According to court papers, Jacobsen, who used the online alias Ethics, offered to sell the stolen information on an online message board on March 15, 2004. Jacobsen also apparently provided excerpts of the data to friends and colleagues.
A log file of a March 2004 instant-message conversation apparently between Ethics and an associate includes a section containing Hilton's T-Mobile phone number, password, social security number, and other confidential information.
Password hint systems like the one used by T-Mobile are common on the internet. Online service providers including the MSN Hotmail service have encountered security breaches involving attackers correctly answering "secret questions" and then locking victims out of their accounts.
T-Mobile representatives said Hilton uses a Sidekick II, a communication device that offers wireless telephone and internet access as well as a built-in flash camera.
Brian McWilliams is the author of Spam Kings and is an investigative journalist who has covered business and technology for web magazines including Wired News and Salon, as well as the Washington Post and PC World, Computerworld, and Inc. magazines.
Return to the O'Reilly Network.
Showing messages 1 through 9 of 9.
-
Paris
2008-03-27 09:13:01 Free stuff [View]
her t-mobile, along with vin diesel's was hacked becuase t-mobiles have this option that allows it's users to sidestep the 'enter yout password' section of the voice mail if they are calling from the phone that voice mail is set up on.
-
Security, Security
2005-09-10 02:57:26 IWSEC [View]
Just goes to show how important security is!
iwsec.co.uk
-
Working mirror
2005-02-25 09:14:13 BryanSmith [View]
All the stuff pulled from her phone is here, check it out.
-
Sounds like T-Mobile's fault to me
2005-02-23 14:30:43 tychay [View]
Seems like the media and Bruce Scheier (who may know everything there is to know about encryption but needs to use the web a little more often) are confusing PASSWORDS with SECURITY ANSWERS.
The former should be hard to guess, the latter should be easy to remember (thus easy to guess).
On nearly every other website out there, answering your security answer DOES NOT allow you to change your password. Instead, it send your password or a link to change your password to your primary e-mail address. The first secures your account, the second secures the sending of access control over an unencrypted communication.
I did something similar to this when I had my notebook stolen and couldn't access my O'Reilly Account.
T-Mobile account system should be requesting a primary e-mail on registration. When I signed up for mine a year ago, I assumed it would send the password via SMS--they use your mobile phone number to secure your login name. Instead answering the security answer allows you to reset your T-Mobile password.
That's plain and simple stupidity on the part of T-Mobile's internet. Paris Hilton's intelligence notwithstanding.
tressermckay: You are probably confusing the MSN report a couple months ago when Paris Hilton's voice mail was hacked with the recent hack of her T-Mobile phone book. These are two different incidents.
-
wrong, but cute story
2005-02-23 08:54:26 tressermckay [View]
not that people actually care about the truth anymore...
her t-mobile, along with vin diesel's was hacked becuase t-mobiles have this option that allows it's users to sidestep the 'enter yout password' section of the voice mail if they are calling from the phone that voice mail is set up on.
All that was done was that the phone number was spoofed and the voicemail was called. the voicemail believed it was getting the call from the proper phone, and allowed access to the system, per the settings.
nothing as silly as knowing the dog's name
-
wrong, but cute story
2010-02-10 14:44:16 valmortiz [View]
I work in a mobile phone company, in the IT security area. You'll be amazed to know that 80% of the users chose between a set of 20 passwords, such as address number, dogs/mather/father name, year of birth, etc.
Systems are, most of the time, very secures. Interacting with humans make them to fail....
Regards,
----------------------
Vivi - vuelos (http://www.despegar.com.co/)
