Re: Re: [Full-disclosure] [ISecAuditors Security Advisories] Gmail vulnerable to automated password cracking

[admin () geekycode net]

I understand what you're saying, but you're not so good at explaining things like this in a clear manner. What I 
understand from reading your studies, is that gmail implements one of two (or possibly both) systems where 
authentication is forcefully denied (to either the IP or the account):
i. If 100 unsuccessful attempts to a given (or any?) email address during any 2 hour period are made, from a given IP.
ii. If 100 unsuccessful attempts to a given email address during any 2 hour period are made, regardless of IP.

Once the given IP successfully accesses any gmail account that it hasn't accessed in the last 2 hours, the blockade is 
apparently removed (for all given IPs/accounts). If this is correct, then there is a problem because the unsuccessful 
attempt count can be reset automatically.

This has been done incorrectly time and time again. Take MSN Messenger for example: a denial of service attack is (or 
once was) present because access to the given account was blocked for all IPs.

On the other hand, if the restriction only results in access to IP addresses being denied, then you better watch out 
for those people with 50,000 drone botnets because they can make 200 * 50k attempts per hour (under ideal conditions).

In your opinion, Vicente, this is an exploit because it allows the attacker to bypass security features. I'm inclined 
to agree. In fact, I believe it fits pretty smugly into the "horizontal privilege escalation" category. Chris, if this 
is indeed the behaviour of gmail's implementation, and you decide to come out of denial:
i. I would appreciate if you could take issues like this seriously in the future.
ii. Here's a solution: block POP access to a given account after 100 unsuccessful attempts in 2 hours, regardless of IP 
address (or unrelated successful authentications) and force image verification for that account for the next 2 hours. 
Give a meaningful error like "Too many unsuccessful attempts have been made to this account. Please use webmail to 
login."

You must admit, it doesn't look good when two people are pointing fingers at each other saying "he/she's wrong", and it 
does sound like Vicente has done some research. It'd pay to revise the algorithm(s) involved, in greater depth. That 
way, you either clear yourself or you don't look so arrogant if/when you're wrong.

Kind regards, Sebastian.