735 VIEWS
Pinterest LinkedIn LINE

The sp-mode mail problem—the one in which email addresses were switched—has become a hot topic. I could not fully understand it just by reading the articles, so I drew a diagram while referring to sources including NTT DOCOMO Technical Journal Vol. 18 No. 3, Technology Report [1]. Incidentally, “network” here refers to the sp-mode network.

Obtaining an email account using a proprietary authentication method apparently means:

(1) authenticating through a proprietary method that the email application is an official one; and
(2) obtaining user information through an sp-mode connection.

However, I do not know the details. I have a feeling that the key to this incident lies somewhere around here, but I wonder if that is right. In the diagram above, I have shown user authentication over the sp-mode connection as being performed using the IP address. This is an inference based on what I have read in articles and elsewhere. If that is how it works, the present incident can occur: if the registration and disconnection processes do not complete properly, the email address of the person who previously used that IP address gets configured on the device.

If so, that is quite bad. Some have pointed out that the problem was a failure to handle errors properly, but even before that, the authentication design is fundamentally flawed.

Why It Is Flawed

  1. A reused identifier—an IP address—is used to identify the user.
  2. Moreover, it is used not only as a user identifier but also as an access token.

First, using an identifier that is not reused as the user identifier is one of the most basic principles. This is why even protocols with a relatively low security level, such as OpenID 2.0, distinguish between the identifier entered by the user and the identifier the system uses for authentication.

But even if we concede 100 steps and say that this is acceptable, the second point remains.

Point 2 is far too problematic by any standard. An access token must always be unique. If you make it reusable, a later user can impersonate the previous user[2]. (Oh—that is what happened this time.)

I assume that something this foolish did not actually happen, so I would very much like the details to be disclosed. Security becomes dangerous when it is not handled openly.

[1] Naofumi Yoshinaga et al., “Smartphone New Services and Features in 2010 — sp-mode Mail Service”

[2] At the registration stage, the system should instead create a token signed over the user identifier, the party authorized to exercise it (audience), its validity period, a nonce, and other data, and give that token to the client. It should then use the token for authentication. That way, a change in the IP address would cause no problem.

Reference Articles

 

Related posts