I spent some time setting up Cox's "Secure" Backup service.. While monitoring the traffic the client sends over during the backup process I noticed it was sending everything in plain text over port 80.. This wouldn't really matter to me except they tout the "security" of this backup service, they suggest you install their client on your laptop, phone, etc..
The client sends your username and password in CLEAR TEXT via port 80/http... The client sends your file names and file content in an un-encrypted manner. If one were to use this "Secure" backup service from a laptop on an public wifi access point you would be broadcasting all of your sensitive bits to whomever cared to listen. Sure one should never use an open wifi access point, but most people don't care.
POST /2_4/transfer.asmx HTTP/1.1MIME-Version: 1.0Content-Type: multipart/related; type="application/xop+xml";start="<http://tempuri.org/0>";boundary="uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789";start-info="text/xml"SOAPAction: "http://developer.digidata.com/schemas/2_4/Write"Host: services.backup.cox.comTransfer-Encoding: chunkedExpect: 100-continueAccept-Encoding: gzip, deflate--uuid:1a6aedea-a4d1-4743-8555-594c4b8fead4+id=2789Content-ID: <http://tempuri.org/0>Content-Transfer-Encoding: 8bitContent-Type: application/xop+xml;charset=utf-8;type="text/xml" <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Header><h:SHCredentials xmlns:h="http://developer.digidata.com/schemas/2_4" xmlns="http://developer.digidata.com/schemas/2_4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><Username>MYUSERNAME</Username><Password>MYCOX.NET_PASSWORD!!!</Password><SessionId>
Seriously.. W T F. How is this "Secure"? ?!?!?
<Request><Data><xop:Include href="cid:http%3A%2F%2Ftempuri.org%2F1%2F635008006741992807" xmlns:xop="http://www.w3.org/2004/08/xop/include"/></Data><Offset>0</Offset><Path>/*My Backup/NICK-PC/C:/Users/nick/Documents/2012 Taxes/Wellsfargo_1-1-12.csv</Path><ClientCreateDate>2012-07-13T10:44:03.9116939-07:00</ClientCreateDate></Request></Write> 16
Thanks cox, you're a real friend.
↧