Slashdot Mirror
Hotmail Hacked
SyD writes " Apparently there is a major security hole on Hotmail that could allow crackers to read your e-mail. A hacking group known as root core discovered the hole and reported it to Microsoft. " This isn't the first time that the folks who are gonna give us a internet wide universal login system had a hole. The funny part is that I posted a story almost exactly like this like 2 years ago, and about once a week, someone emails me and says "I think my boyfriend/girlfriend is cheating on me and I really need to know the backdoor into hotmail to find out". No I'm not kidding. You can't make that stuff up.
You need to guess the message ID, a longish string based on a timestamp and another number. And once you do that, you still can't read other messages from that account unless you guess them separately. You could try brute-forcing the message IDs, of course, but then you're relying on a fast connection (I believe there are 60 possible message IDs per second, and you rarely know exactly when a message was processed anyway) and fast servers. Besides, after all this, you'll probably find that all the target account's real mail was automatically deleted to make room for WinXP.iso.bat, attached to a message asking for advice.
Gates' Law: Every 18 months, the speed of software halves.
And Yahoo! Messenger kicks AIM's and MSN Messenger's asses.
Why tempt fate?
Send your friends messages of love at fuck-you.org
blah blah, we expect this from MS... blah blah, when will they get their act together...
This was already posted to BugTraq not too long ago. For a more technical breakdown of the details surrounding the Hotmail vulnerability, go here:
http://www.securityfocus.com/archive/1/205785
- tre
http://piclabs.com
My guess is you are a karma whore, nothing more. Now I may be wrong, you might be the actual author. In this case, let us know.
Research by wAwAsAn4
wAwAsAn4@root-core.com
Web: www.root-core.com
Email: [Digital-Vortex]@securityfocus.com
Voila.
Looking for a great online backup: Green Backup
you can download the hobo4 program, written by the folks at Root Core to automate this vulnerability here. Warning about the code however:
a) it's in VB
b) you'll see methods like this:
Public Sub ii(MSG As String)
l_info.Caption = ">" & MSG
End Sub
are there no coding standards even among hacks?
"My mother never saw the irony in calling me a son-of-a-bitch." - Jack Nicholson
What's with the trend of moderators who agree with people who totally miss the point?
Saying something stupid, predicting you'd get modded down has been done since the beginning of moderation.
Not to squash your witty reply or anything - but all cryptography relies on computational infeasibility. Let's say that Microsoft added a truly random 128-bit key to your email number. That would certainly raise the bar high enough, don't you think?
I got my Linux laptop at System76.