Spammers Exploiting Hotmail Vulnerability

chip rosenthal writes "Notice more Hotmail spam in your inbox recently? There is a good reason for that. In March, spammers discovered a new vulnerability in the Hotmail service that allows them to script their spam sending. So far I've seen a 2200% increase in Hotmail spam as a result. We're now at three months and counting, and the problem only seems to be getting worse."

Comments

I reported this problem to them some time ago...

[Yonder Way]

...and they shrugged it off, claiming it wasn't their problem. Hotmail actually pointed the finger at MSN, and MSN wasn't responsive when I included them in the loop.

Here's an example of the kind of brush-off I got when reporting this to Hotmail. Note that I've reported the issue several times, tried to have it escalated as I suspected it was a hole in their DAV implementation. Here's what I would get back from them:

Hello warthog,

Thank you for writing to MSN Hotmail.

This is Alvin and I'm writing in response to your complaint.

I have checked the mail including the headers and it appears that the
mail passed through a Hotmail server. However, kindly note that this
does not mean such e-mail originated from our domain.

Sometimes, e-mail delivery between different domains are relayed
through other servers. This is the reason why a Hotmail server appears
in the mail header. It is possible that your ISP or e-mail provider
employs such method.

I understand how it feels when an illegal activity has not been given
proper attention. However, we're only allowed to investigate Hotmail
members. In this case, I strongly suggest that you contact the Help
program or the Abuse section of the domain from which the unwanted
e-mail originated .

Sincerely,

Alvin F.

MSN Hotmail Customer Support

Re:Hotmail useless

[illuvata]

for all the people that obviosly didn't RTFA or even the summary, this is not about recieving spam on your hotmail account, but geting spam from hotmail accounts.
basicly, before you spammers had to go through the slow web interface to send spam, now they can automate the process

Re:DAV as an integration method for outlook?

[bigberk]

So, Outlook is this huge pipe for virii, worms and spam leading me to wonder.....why is anyone still using Outlook?

Excellent point. Especially amazing when so many free Windows alternatives exist:

• Pegasus Mail does much more than Outlook...
• PocoMail does everything you need, and is secure
• The Bat is used by many, as a secure alternative
• Personally, I use only JBMail, which strips out HTML and has no scripting

This article is flamebait-ish

[skookum]

There are several things that it appears most people do not understand about hotmail or email in general:

• You cannot trust the From: line! A whole lot of spam looks like it's from a Hotmail account based on the email address in the header. But this is almost always forged, and it says nothing about the actual service used to send the email. Most times, the mail is sent via an open proxy, usually in an uncontrolled network. Korea, China, Argentina, Nigeria, Brazil are all very good sources of open proxies. In other words: Do not think for a single moment that because the spam says it's from abcd123@hotmail.com that it had anything whatsoever to do with Hotmail!
  
  
• Mail sent using HTTPMail, the proprietary WebDAV interface that this article referrs to, will always have an easy to spot Received line that contains "with DAV;". It will also have an X-Originating-IP: [a.b.c.d] header that can be trusted. Note that sometimes the spammer will try to forge a fake X-Originating-IP, but it will usually either have the wrong capitalization (Ip vs. IP) or it won't have viable IP address numbers, usually with dotted quads greater than 255. It will also usually have an X-Originating-Email header that identifies the actual account name. Because of this, anyone dumb enough to spam with this method gets the account they used shut down almost immediately. In contrast, open proxies leave no evidence whatsoever of the actual originating party of the message.
  
  
• It is hardly a secret. For example, there's an open-source Mail plug in for OSX that lets one send/receive mail with HTTPMail. Additionally, there are Windows utilities that create a pop3-HTTPMail gateway, allowing you to read hotmail that way.
  
  
• As of March of this year, you can only send 100 emails per day per account using this method. Slashdot covered the story when the change was made. Here's a link to one version of the announcement.
  
  
• For the above reasons, you won't get a lot of spam from this service. I just grepped my known-spam folder with about 2000 messages for the last 6 months or so, and found FOUR such HTTPMail-delivered spam -- and they were all from msn.com addresses/accounts, not hotmail.
  

So please, I know slashdot will take any opportunity it can get to Microsoft-bash but in this case the blogger is pronouncing the sky to have fallen when it has not. The fact is that this service IS traceable and IS throttled, two aspects which make it relevent only to the newbie spammer that doesn't know what he's doing.

Re:can this be?

[sleeper0]

This exploit appears to allow you to obscure your ip address as well. I didn't see any mention of this in the linked article so i figured it was worth mentioning. About a month ago i recieved a spam complaint from our ISP about mail sent from a machine in our IP block:

Received: from 64.84.xxx.xxx by bay3-dav112.bay3.hotmail.com with DAV;

After investigation it didnt seem like the spam had come from there, there was no evidence of a break in or that anyone had used it to send spam. While we were investigating we changed it's IP adress and never bothered to change it back, but we've still been given 3 more copies of current spam showing this IP address thats not even in use anymore.

By the way, I thought the article was pretty retarded standing on it's soap box about horrible microsoft security blah blah blah. The entire industry has problems with security, singling one company out is just petty. I've certainly had a lot of linux security updates I've needed to install over the past year, its nothing exclusive to one camp.

Also i think he was exagerating the effect of this bug.

I checked my spam that i've gotten since 5/1/03:
3467 pieces of spam
5 pieces of DAV spam

hardly a substantial amount.

This doesn't match my experience

[babbage]

I've just grepped my spamtrap directory for 'with DAV', as the linked article suggests should be seen in messages delivered using this exploit. For background, here's a little ascii chart of my month over month spam trends (line length is divided by 25):

0165 Jun xxxxxx
1602 May xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxx
0734 Apr xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0439 Mar xxxxxxxxxxxxxxxxx
0289 Feb xxxxxxxxxxx
0236 Jan xxxxxxxxx
0283 Dec xxxxxxxxxxx
0189 Nov xxxxxxx
0417 Oct xxxxxxxxxxxxxxxx
0349 Sep xxxxxxxxxxxxx

Clearly, I for one have been getting a surge in spam lately, which might possibly be sloping back down after last month's spike, but it's too early to tell yet.

In spite of that, of the nearly 3000 spams I have received since march, only seven match the pattern with DAV in the message headers. That bears repeating: I have received only seven instances of this exploit, vs. 2940 overall spams since March. Further, I only see 72 messages that have a hotmail.com server on their received headers at all -- most of the time I get "from Hotmail users" it's almost always forged.

Anyway, the first message to mention "with DAV" was sent March 25th, which fits the timeline this guy describes. On the other hand, the rest of my data massively disagrees with the 2200% spike that is suggested in the linked blog -- it seems to me that 0.238% of the spam I'm getting is due to this mis-feature, not 2200%.

Now granted, the two of us are the only two data points that I know of so far, but the results that we're seeing are so wildly out of step that I wouldn't think people should draw conclusions from this. Two completely conflicting measurements can't show us any kind of pattern.

The spam sky may be falling, but this isn't one of the falling pieces you need to keep an eye out for as near as I can tell.