Slashdot Mirror
Passport's Pocket Picked
emmons writes: "It looks like there's another hole in MS Passport according to Wired. This one allowing a user to steal another user's Passport Wallet, credit cards and all, by getting them to open a hotmail message. Nice." What happens when someone steals the basket with all your eggs?
great... the single greatest magnet for spam is also an open book to your credit cards. I can see it now: "Hot dirty sex... you've paid for it already, so you might as well cum see!"
"You've already paid the fee to get in on our bogus pyramid scheme, so now it's YOUR turn to go steal from someone else!"
Inconceivable!
> In addition, the company has modified a software timer so that Passport users must re-enter their password anytime they attempt to access the wallet service.
:)
will be
> In addition, the company has modified a software timer so that Passport users must re-enter all the information associated with their passport account (including their Wallet account) anytime they attempt to access the wallet service.
Which might be shortly followed by the first time MS has ever been able to claim their technologies are relatively secure. (Yes, I'll avoid being a jerk and suggesting anyone can ever be 100% secure.
"Old man yells at systemd"
If this is Microsoft's unviersal security solution, I can';t believe they'd put out something that can be so easily cracked without knowing it.
Is it concievable that M$FT is deliberately designing holes, staging exploits and publicizing them in order to get popular support for federally controlled security systems and universal elimination of anonymity?
The anthrax could be the same thing.. government allowing it to spread, or spreading it themselves, to pressure Congress to pass the USA PATRIOT act, which they did, and to pressure us to accept strictures on our behavior?
In both cases, ask: Quo bono? In the current climate, who benefits from these activities?
Terrorists don't benefit from the anthrax, and OSS doesn't benefit from these Passport exploits. In both cases, the government benefits.
Goat sex free since 2001
I remember a year or two ago a person could send you an email and obtain your hotmail account. Hotmail is a gaping hole in the passport service.
With passport, microsoft wishes to be the customs agent of the internet. However, with flaws like this they really are not going to turn many people over to their side.
I'm sure more exploits will pop up in the future. Most of them will likely use hotmail in someway or another to enter.
ok, obviously my post will be rejected as this one already made it through (they rejected Marc's initial story which I guess shouldn't surprise me), but here's more linkage about where you can read about the technical details:
Marc's Passport Advisory
What happens when someone steals the basket with all your eggs?
Send special forces to kill the bunny. And cluster bombs, lots of fucking cluster bombs
Hammer of Truth
You sue them under the DMCA, future SSSCA, Anti-Terrorism Act, or the like.
A testimony to the proposition that security CAN be legislated.
(Yeah, right.)
The living have better things to do than to continue hating the dead.
Anyone remember the story with MS whining about how security people should just shut their cake-hole and not "reveal" exploits? I wonder if they'll take the same stance on this one.
"Well, it wouldn't have been too much of a problem until those meddling kids at Apache showed up..."
If you were me, you'd be good lookin'. - six string samurai
I really like this part:
In addition, the company has modified a software timer so that Passport users must re-enter their password anytime they attempt to access the wallet service.
While Slemko's exploit, which relied on stealing browser cookies used by Passport, has been rendered inoperable by Microsoft's fixes, the programmer said "deeper issues" remain with the service.
"Passport's greatest marketing strength -- the single sign-on -- is also its chief technical weakness. It will be fairly trivial for attackers to dream up new ways of exploiting this," he said.
Why? I installed XP for my dad, everything works perfectly. The OS is great. I got tired of passport starting up, so I clicked on it, cancled a few prompts, went to settings, check 'do not start up on boot', and closed the program. IT STILL STARTS UP ON BOOT. My point is that MSFT has made it very difficult to stop the damn thing from starting. Screw Passport.
Life is like pants... fit in or you don't fit in.
Where did your wallet go today?
-Zane
This sig is worse than my last.
MS seems to have Single Point of Failure problems in a lot of things: the Registry, any one?
It doesn't mean much now, it's built for the future.
Quoting a gem from the article:
"More than 70 sites are in the process of deploying Passport's authentication technology, according to Microsoft. Among them is Prudential Banking's Egg.com online bank, which is switching to Passport..."
Egg.com sounds kind of ironic. Must be quite a marketing effort on Microsoft's behalf getting banks to deploy not tested technology on a mass scale.
Who'd like to file suit with the FTC against Microsoft for false advertising? I think we all know that there is no such thing as absolute sceiruty, or that security is a process, not a result, etc etc. But does the average non-geek American know that? For that matter, does the marketing deparment at Microsoft know that?
You can't market a product as having qualities it doesn't have without getting into trouble with the FTC. Granted, MS will try to spin this as "Those bad Linux hackers will steal your data!" The fact remains that they've lied to the American consumer. I think they need to be forced to amend their advertising.
Sad isn't it, here is the VERY thing all those "privacy people" keep screaming about. The thing that MS says won't happen. The idea should chill us all to the core, after all with XP released it's just a matter of time before a magority of american's will have a "passport". Will it be reported by any big news organizations? Will it make front page (it should).
In the end I guess I best move to the bahamas and start ordering lots of neat things with all these new credit card numbers that magically appeared in my hotmail account.
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
Interestingly, this is exactly what will happen.
Only the discoverer of the hole will be forced to announce it anonymously, and publish it only in dark little places where the lawyerly eyes of Microsoft won't find it. And unscrupulous eyes will.
I can see it happening already. And Microsoft would not even hear of the hole until it's far, far too late. It will be a very, very dark day if information is compromised on this scale.
The DMCA in this case would directly contribute to the destruction of the integrity of the Passport system.
Simply put - if only outlaws find security holes, then only (genuine) outlaws will have access to them.
Maybe I'm being stupid here, but what's the diff between Passport and PayPal, and why hasn't PayPal been a crack target?
Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...
"Look, Smithers! I'm Davy Crockett!"
I haven't read the pasport user's agreement, but would I be incorrect in guessing that Microsoft takes no responsibility for the safety of one's personal data? We're sorry we ruined your life, but if you read the fine print you will see that we are not responsible for anything. When will Microsoft be held responsible for it's actions?
"To those who are overly cautious, everything is impossible. "
This shows that your private information may not be in the best hands when entrusted to a company
like Microsoft. But there are other 'takers'. Some even with the best of intentions.
If any of them ever gets to be the one and only 'central repository', they will be subject to just this kind of attack as well. If you can't compromise the service, then hack into the user's desktop. As soon as enough people use it, it becomes a very attractive target. In a similar vein, there have been viruses that target the client end of home-banking software.
Security is enhanced by redundancy, by having several distinct systems in place, preferably as dissimilar as possible. Monoculture and monopolies always form a fertile environment for viruses and other pests.
I feel this makes the whole idea of a centralized service like Passport or any of it's competitors an extremely dangerous development.
I never (knowingly) allow any site to keep my CCnumber and why I always use a "temporary" CC number (for example Amex Private Payments).
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
While I make this point in my paper, I just wanted to make sure people understood:
The real risk here isn't to hotmail or passport wallet (passport wallet isn't really an integral part of passport, just another service using it for authentication). It is to all things using passport. That isn't so much right now. But if Microsoft has their way, it will be. The sample exploit used Hotmail and Passport Wallet simply because they are commonly used services.
I would also like to note that Microsoft has been quite forthcoming with details and admitting the problems and fixing them. They are very good at being reactive. We will have to see how well this works going forward.
I'm gonna go for all of the above
Bobuhabu
eXport Privacy
Comment from Passport's program manager:
the wallet service will remain offline until the company can add additional security features "to ensure that similar exploits cannot be used to compromise our user's credit card information."
What's the standard for this? Based on Microsoft's track record, a new exploit will come up regardless of how many patches are issued. No way I'm going to let them keep my personal data. Too bad the average consumer may not realize this.
While we espouse our need to breakup Microsoft we have overlooked our great need to sue for negligence and false advertising. Their products do not perform safely nor with the diligence we as consumers need. This is another case of a lack of thought and concern put into a consumer product. If Passport were a vehicle or food product, the manufacturer would have been sued for negligence.
Of course we torture people, we need the information --Gen. Pinochet
People seem to be blowing this out of proportion, IMHO.
How often do you hand your credit card to a server at a restauraunt? A store? Over the phone to pay for something? Are you forgetting that your credit card number can easily be stolen that way? Most receipts from purchases have your credit card number on them. Do you shred / burn them to stop someone from getting your CC #?
I can't beleive this actually happened. I mean, their entire .NET initiative is riding on this passport business and showing they can secure your information.
What folks need to do is hold off on publishing these exploits (as Microsoft requests) until they've got a lot more riding on it. When a couple of banks lose a couple of million bucks on this, not to mention the confidence of their customers, well, then you might get some real coverage.
Remember, Microsoft wants to build houses of straw, and likes to call anyone who points out they are made of straw terrorists. Of course, as soon as I see that attitude from someone I'm supposed to trust I run as far and as fast as I can just as I'd run from a used car salesmen who wouldn't let my mechanic check out the car.
And what a little amount of time it was!!
You will be assimilated. Resistance is fut- HEY! Who took my wallet?
What happens when someone steals the basket with all your eggs?
Eggs? What you talkin' all about eggs for? Don't give me none of that Gibber-Jabber, or you best be tossed!
You took a wallet? I don't see no crazy wallet! You're talking like Face, crazy fool!
Besides, you don't need no wallet! Just dial
1-800-COLLECT and save a buck or two.
XP? That better mean Xtra Punishment, cause that's what I'm gonna do to that Gates fool! He can't escape me, cause my van's hella fast!
Don't do drugs! Drink milk!
Come here, sucka. I'll toss you!
In fact, Microsoft was actively contacting reporters to let them know about the issue and try to put their spin on it even before I released my exploit.
A number of Microsoft employees also leaked it to their friends after I reported it to Microsoft, and it started spreading from there.
And even Microsoft's lawyers were in on the gig of making sure everyone knew about it.
But seriously... Microsoft has been, and almost always is, very good about timely responses to security reports. Their problem is in dealing with them without having to be told by some Joe User that they have problems.
Is a single .sig service... No matter which service I am logged into (web, e-mail etc.) I get the same lists of .sigs
- Nothing but a 32 bit operating system, running on a 16 bit core, based on an older 8 bit operating system, run by a 4 bit company that can't stand 2 bits of competition
Do you shred / burn them to stop someone from getting your CC #?
Actually, many people do just that.
That's not the major point, though. This "crack" will allow someone to, perhaps, manipulate your financial portfolio if it's set up through Passport. "What do you mean, I just bought 10,000 shares in Hot Girl Condos on margin?" Millions and billions of dollars there, at risk, if MS gets their way and that sort of thing is hooked through your Passport account.
If you're a zombie and you know it, bite your friend!
My username has no numbers on the end (it's just my first two initals and my last name), and NOBODY has my Hotmail address, and I don't use it-- I only have one because I was forced to take one to be able to use MSN Messenger.
Yet every time I peek in there, even with the Junk Mail filters on, there's tons of spam in my In Box.
~Philly
It won't be Visa that eats the chargeback. If there is a chargeback, Visa passes it on to the merchant, and may also levy a fine against the merchant. All online purchases are treated as "no signature present" transactions, which means that the merchant is responsible for detecting fraudulent use.
Dell Computer: $1099 .NET services: $19.95/mo
:p
Microsoft Windows XP: $219
Compaq IPaq with Windows CE: $499
Subscription to
Microsoft Passport: Free*
Having your MasterCard(TM) info on the net for anyone to see:
Priceless.
(*note: This is a parody of the successful "Priceless" MasterCard(TM) advertising venture. As a parody it is protected under the 1st amendment established by MasterCard(TM) v. Nader)
People shape laws. Not the other way around.
May I be mod'd as redundant....
If you are stupid enought to trust ANYTHING vital to Microsoft in the first place then you deserve to have it stolen.
I want to see the press release they put out on this, i can see it now
"Here at Microsoft we are devoted to security, those evil hackers have again stolen your information, we must pass more laws punishing the offenders and in the future we will assure that nothing like this will happen again"
What he is saying is (we want to throw the smart people in jail so only idiots are left to use our software)
It's not the OS it's the user that sucks. If it's user friendly, you get stupider people. - clinko
The Right to Read
How long until it becomes true, instead of being a whacked-out conspiracy theory fantasy?
--jeffipv6 is my vpn
The typical user does NOT get this information.
They are happily using their Hotmail accounts and have NO clue that these things exist. Sure, they might have it in PC World, or maybe the Technology section of the Times, but my MOTHER does not read these things. Only us geeks in the industry know ( we are a small percentage of the population).
Microsoft will fix this to appease the security experts, but that's about it.
As long as Joe Sixpack can stay happily ignorant, MS is happy. For example, one of my friends, a very intelligent Nuclear Physicist, just got suckered in to a CompUSA MegaPC w/ 1.2 GHZ, 1 GB RAM , DVD RAM and Windows XP for anout 5 Grand. He browses the web PERFECTLY fine on his 988 MHZ PC. He said the "pretty colors" of XP sold him. I told him of the security flaws and reasons for not going with XP (never mind the absolute non-necessity of the PC), and his response was "How come I haven't heard about these things you talk about?" I had no answer. That's how Microsoft stays in power. If we step outside the industry for a minute, we can see that Linux means nothing to most people, AOL IS the internet, and Windows IS a computer. How do we fix this? I don't know, but someone must.
If you're not a Liberal in your 20's, then you have no heart.If you're still a Liberal in your 30's you have no brain.
The odd thing, however, is that these cookies that are set as a result of Passport authentication are, at times, unique to the browser window they were set in. If I open a new browser window, the cookies are not sent and I am not authenticated.
Think DRM tokens, e.g. pay per viewing instance.help me i've cloned myself and can't remember which one I am
I have been ranting to all of my clients and friends about this sort of problem ever since MS came up with the idea of passport.
Scenario:
2 years from now 150 million people actually have their personal details and credit card numbers stored with MS (this isn't so now, people have passport accounts by default due to hotmails reliance)
Another hack comes out and it is proven that the vast majority of credit card numbers for people were compromised.
Visa, Amex, Mastercard et al are forced to re-issue credit cards to all people using passport
The global economy is severely disrupted due to the downturn in online spending, the overall costs incurred by the replacement and the lack of consumer confidence in online shopping, banking etc
Microsoft point to the famous "we're not liable for jack shit" clause in the agreement
So what happens? Does MS still get sued? Do the credit card companies just sit back, hemorrhage and go "Oh well, shit happens."?
Most importantly, do consumers finally realise that they have been taken for a ride for the last 7 years and boycott?
This really scares me. Giving personal details to any company is bad. Giving them to a company with a severely impaired security record is just plain stupid.
"Up to" is vague- It is true that "up to 7 billion people have as much money as Bill Gates", but it might be good to have a better estimate...
If you are counting hotmail accounts, many people have multiple accounts, which could get things up towards 200 million just in the US, so I am curious how many distinct users there really are. In particular, how many people have more than the default setup from having a hotmail account and actually have info in a Passport wallet? For people with multiple hotmail accounts (for different purposes, expired purposes or just forgot about it) presumably they would have one or only a few accounts with the credit card info and so on.
It's psychosomatic. You need a lobotomy. I'll get a saw.
statusbar (jeff at statusbar dot com) wrote:
;)
> How long until it becomes true, instead of being a
> whacked-out conspiracy theory fantasy?
Oh, I don't know. I think certain companies and groups in certain industries (Microsoft, RIAA, MPAA) are nearly there now. I'm half expecting someone to get arrested soon for possessing a pencil or a scanner (both highly illegal in a warped view of the already warped DMCA).
It seems that every few years/decades, some greedy moron(s) get some brilliant idea that will allow them to turn all their customers into cash cows, round them up, and milk them dry. Sooner or later, the usually placid customers start to resent such treatment and move on to the next, much greener, pasture (if the moron was lucky enough to have found some cows willing to be rounded up in the first place). This of course puts the idiots out of business. I'm sure the nice folks at Digital Convergence can explain that process to you in detail (assuming they have any staff left).
What we are seeing now is the usual greedy idiocy stuff, plus companies and whole industries that are feeling really threatened. Microsoft has pretty much reached the end of its Windows/Office gravy train and is thrashing around trying to figure out how to keep the cash coming in. The recording industry is facing the double threat of file sharing and basement recording studios. Hollywood is also troubled by Internet copying of movies, and has some reason to worry about digital video and the success of a film like Blair Witch (not to mention competition from the Internet itself as a form of entertainment).
Add to all that the uncertainty of the times, and you've got a bunch of scared, greedy folks who are grasping at anything to defend and expand their precious bottom line. Right now, they are all jumping on the intellectual property bandwagon. Sooner or later, John and Jane Q. Public are going to get fed up with their antics (probably when they try to tape the Super Bowl and find HDTV won't let them), and it will all stop.
For now, we need to work to keep said groups and companies from introducing idiotic laws. It also helps speed things along if you stop doing business with the idiots in question, and keep your family, friends, neighbors, and coworkers informed of what is going on. Aunt Judy may not be a loyal Slashdot reader, but she would really care about being hauled off to jail for possessing a VCR. Better get her to write her congresspeople before that happens. Just be sure to tell her not to send snail mail (Anthrax scare), email (not taken seriously), call by phone (busy signals last I heard), or send a fax (probably out of paper due to it being stored in infected office buildings). Hm, maybe our (USA) lawmakers employ a psychic?
Microsoft, in particular, needs to just throw in the towel. They don't have the security to begin to attempt something like Passport. You can't just slap a EULA on someone's wallet, and say "Sorry, we aren't responsible". No amount of silencing security researchers or screaming "industrial terrorism" is going to cut it. Heck, Gates was on CNN this evening (talking about the stupid consent decree). He couldn't even face the camera and talk out of the front of his mouth like a real, honest, person! Sheesh!
Happy Birthday, Godzilla! (The movie "Gojira" first aired in Japan on November 3rd, 1954.)
They probably cant be sued for it, not in most jurisdictions at least. I havent heard of any online shops or otherwise being sued over stolen CC numbers, and there have been a load of those.
And how much are you willing to bet that the credit card companies are going to consider registering your CC number in Passport being irresponsible behaviour and insufficient care taken in safeguarding it?
In which case you are the one taking the hit.
I hope you dont have a high limit on any card you use on the net. Preferably you should be using one time CC's valid only for the amount you owe.
However, your parents have a duty to keep their credit card numbers and credit cards stored in safe places, and have to report it stolen ASAP if they consider it likely that someone has obtained access to those numbers.
If they put their CC numbers on a note on the noticeboard in a public place they arent going to get a cent from either the CC company or anyone else. Pay up or play the debt collection and credit slashing game.
Storing your CC number in Passport is pretty close to that.
From what I've heard of XP, Microsoft is trying a new technique: The peer pressure technique.
:))
Installing XP: Do you want to sign up for a passport account?
booting up for the first time: Cmon, sign up for a passport account.
starting up internet explorer: Sign up for a passport account. I'll be your freind!
entering hotmail: Oh yeah? well I'm not going to let you go here unless you sign up for passport!
this is a dramatization. I haven't used XP, and I don't want to(I have enough waiting in my life, thank you very much
It's been a long time.
Yes, at the very least I tear out the code, rip it in half and throw away the pieces separately. Nor do I ever let my credit card out of my sight at a resturant. If I make purchases online or over the phone I have a separate minimum-limit ($500 limit) card that I charge to. And if Im really suspicious I create a one-time cc number with not more than the amount due available on it.
You do realize that you can be held liable for whatever charges your card incurs if you do not follow this kind of practice, dont you? And you do realize what happens if you are held liable for a $10K shopping spree that someone went on with your credit card? You pay it, you pay it at once, or your credit rating is slashed, you default on your house mortgage as your bank suddenly wants their money back and their money back _now_, you wont be able to get a new loan and you'll have to sell pretty much everything you own.
Im not kidding, I've seen that happen. I have a coworker who makes as much as I do, who can barely afford to eat lunch in the company resturant. Your life suddenly becomes a helluvalot more expensive once you're put on rapid payback on all your loans and the interest rates you're paying are doubled.
But why is Hotmail special? (OK, aside from the fact that most of the 200m Passport users MS claims probably got hooked in via that route.)
Passport is supposed to be an independent data store, right? A Passport-enabled client needs to know something about you and you've signed in, so they can go ask MS for that specific information. They aren't supposed to get anything else back. So, given that Hotmail is just another client (it is just another client, right?) then surely if you can break it using Hotmail, someone else could expose the same vulnerabilities via any other Passport-enabled client using similar Passport features.
So, what am I missing? What's so special about Hotmail? Why is Hotmail the gaping security hole?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Or you could just post it in any country in the free world that doesn't have the absurdities DMCA and such. You might try pretty much anywhere in Europe, for a start. :-)
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
You were going well up until this point:
Eventually, they'll get around to releasing a decent product
but that part didn't make sense to me, after all, this is MS we're talking about.
I can remember since the days of Windows 3 (about eight or nine years ago) that people have been hoping for Microsoft to eventually "release a decent product". We're still waiting for it. With every new release, people seem to forgive MS immediately and brush it off with "oh well, maybe the next version will be good, we'll endure the suffering in the meantime". (Perhaps XP is "it", but then is it really acceptable to wait close to *ten years*, and pay several times over during the wait, to get a half-decent product which is anyway several years behind what OSs should be by now, technologically? I can't think of a feature in any Microsoft Windows version that hadn't already been around for several years in some other system, and that includes XP)
I too have an Hotmail account!!!
Come to think of it, i have at least 5 of them, all with funny names.
Judging from the options Hotmail returns to me when i try to register a funny name and it's already take (it sugests things like funnyname54@hotmail.com), i would say i'm note the only one...