Hughes Direcway Customers - HEADS UP!

[thehorse13]

While investigating an unrelated security event, I stumbled upon an issue with Direcway webmail. Seems that the geniuses over there decided to auth the URL only so if you copy the URL of someone who logged in to their webmail account, you can take that link and then have full access to the user's webmail account.

This has been reported to Hughes already (before I popped this warning up) but none the less, the reception from the tech support group left me less than impressed so anyone here who has Huges as an ISP, I'd be pretty pissed. Oh yeah, this is all done in the clear too.

I'm not sure if the link has a TTL because I frankly don't care enough to sit here and wait to see if it expires.

Proof of Concept: (don't click the link and expect to end up in someone's webmail account)
============================
http://change.mydirecway.com/en/mail...=en&cert=false

Copy this from any browser history and then go home to your den of evil and throw it in a browser. PRESTO, instant full & unencrypted access to a direcway webmail account.

Now, back to the real issue I was researching....



--TH13

[DjM]

Hi Horse, I got the attached when I tried to work with the link you posted.

Cheers:

[thehorse13]

Yes, that is intentional. I removed the actual account SID because it would allow you into some poor slob's e-mail account. The proof of concept is intended for Hughes users to pop in the SID handed to them from the mail server, then take that URL to any machine they want and throw it in to see the magic. If I left in the real SID that I found, I would be allowing the whole world to fux0r the poor bastard's account that I stumbled upon.

[jbclarkman]

Sessions do time out. Just an FYI

[D0pp139an93r]

Wow, I was actually going to use them for an ISP.

I might still, and just use a 3rd party mail server. The sad thing is that the average user has no idea of the dangers that this kind of thing presents. What happens to all the people who use public terminals to access their email?

I would be allowing the whole world to fux0r the poor bastard's account

No, it would actually be Hughes Directway that allowed the fux0ring.

[thehorse13]

What happens to all the people who use public terminals to access their email?

Well, they would hand out access to their e-mail account to anyone who simply clicked on the URL (before it times out).

[RoadClosed]

I have delt with direcway numerous times. They totally and absolutely suck as an ISP. And to top it off the technology sucks as well. Your better off with dial up considering the price.
Slightly biased point of view.

[D0pp139an93r]

I guess I'll stick with DSL. Thanx for the info.

[RoadClosed]

With DirecWay your pings would go from the 80s or less to 1000.