Slashdot Mirror
Spammers Exploiting Hotmail Vulnerability
chip rosenthal writes "Notice more Hotmail spam in your inbox recently? There is a good reason for that. In March, spammers discovered a new vulnerability in the Hotmail service that allows them to script their spam sending. So far I've seen a 2200% increase in Hotmail spam as a result. We're now at three months and counting, and the problem only seems to be getting worse."
Is it really possible to get even more spam using hotmail?
I don't buy it. An hour with a Perl for dummies book and the LWP doc's and any spammer can automate thier submissions.
Does the author really believe that these spammers are copy and pasting thier spams? I sure as heck don't.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
Not to totally deride Hotmail, but after having used it for several years, I can honestly say that it's probably the worst out of all free e-mail providers in terms of controlling incoming spam. Yahoo Mail blocks out a good 80-90% of incoming unsolicited mail, and hushmail.com is even better at it - I haven't gotten a single spam during my 6 months with them (so far at least). Add to that the ease with which Hotmail passwords can be hacked (trivial even for script kiddies), and after some consideration you might want to look at another provider.
:)
And hey, it's owned by Microsoft! Grab your pitchforks!
"The power of accurate observation is frequently called cynicism by those who don't have it." - G.B. Shaw
The best use for hotmail always has been: Use the account only for entering onto forms that require a live email address that info will be sent to immediately in response to the form being filled out. Then beyond that, don't even bother checking, just periodically empty the inbox all at once.
You've been able to send email through OE and Outlook for years without utilizing the hotmail web interface. Outlook could easily be automated through COM to be a bulk mailer.
How is this any different than signing up for a standard throw away ISP account with imap or pop/smtp servers and using a bulk mailer in conjunction with it?
and that the vulnerability was created to allow greater integration for Outlook users.
So, Outlook is this huge pipe for virii, worms and spam leading me to wonder.....why is anyone still using Outlook?
I am not trolling here, this is a serious question based on example after example of companies that want to standardize on Outlook. For instance, my wife's company (a large multi-national conglomerate which will go un-named) decided last year that they wanted to standardize on Outlook. Their support costs have supposedly skyrocketed and yet there is no discussion of using something else. What is happening here?
Visit Jonesblog and say hello.
...and they shrugged it off, claiming it wasn't their problem. Hotmail actually pointed the finger at MSN, and MSN wasn't responsive when I included them in the loop.
.
Here's an example of the kind of brush-off I got when reporting this to Hotmail. Note that I've reported the issue several times, tried to have it escalated as I suspected it was a hole in their DAV implementation. Here's what I would get back from them:
Hello warthog,
Thank you for writing to MSN Hotmail.
This is Alvin and I'm writing in response to your complaint.
I have checked the mail including the headers and it appears that the
mail passed through a Hotmail server. However, kindly note that this
does not mean such e-mail originated from our domain.
Sometimes, e-mail delivery between different domains are relayed
through other servers. This is the reason why a Hotmail server appears
in the mail header. It is possible that your ISP or e-mail provider
employs such method.
I understand how it feels when an illegal activity has not been given
proper attention. However, we're only allowed to investigate Hotmail
members. In this case, I strongly suggest that you contact the Help
program or the Abuse section of the domain from which the unwanted
e-mail originated
Sincerely,
Alvin F.
MSN Hotmail Customer Support
for all the people that obviosly didn't RTFA or even the summary, this is not about recieving spam on your hotmail account, but geting spam from hotmail accounts.
basicly, before you spammers had to go through the slow web interface to send spam, now they can automate the process
Hotmail seems to receive more spam than other free email providers. I believe this may be due to how they handle recipient verification in SMTP. When a mail client attempts to send a message to an unknown username, the hotmail mail server will reply with an error message, indicating that the user doesn't exist. As a result, it is possible for a single spammer to spend some time just once to brute-force user names, and then distribute the list of known-good user names.
Yahoo generates the same reply regardless of whether the recipient exists or not. Thus, to guess user names, spammers would have to brute-force every mailing, as opposed to just the initial one like in the hotmail case.
Why hotmail would do something like this is completely beyond me.
Tsunami -- You can't bring a good wave down!
Ugh...
Hotmail supplies me with the following things:
Slashdot Updates
Porn
Oh yeah, and I occasionally get asked if my privates are O.K.
Check.
------
The movie of the summer
***Insert Witty Phrase Here***
On March 6 I created a Hotmail account with a choice of name designed to be "really obscure". I have not had one single piece of spam arrive in that account. In 3 months, no spam. I've only used this account to test whether spammers use email addresses harvested from 551 User not local; please try really-obscure@hotmail.com SMTP responses (conclusion - no they don't)
Having see dictionary attacks on my own domain (and seen the bounces from dictionary attacks when spammers fake my source email address), I can conclude that geeks choice of obscure doesn't range far off science fiction character names.
As for this Hotmail exploit, I had been wondering why these spams were getting through my DNSBL lists - about the only spam that was.
Time to add hotmail.com to the baclklist until Microsoft fix this.
Recycle PCs and build a wireless community network www.hillsborough.org.nz
You know what I have been waiting for? Ximian Evolution for Windows. I don't know what I could personally do to contribute to this endeavor short of purchasing such a product or donating to the port....but that would be a completey sweet alternative...I love running Evolution on Linux machines, and I wish there was a convenient installer for Windows.
* btw - if there is a port and I am just not aware of it, someone please let me know.
So please, I know slashdot will take any opportunity it can get to Microsoft-bash but in this case the blogger is pronouncing the sky to have fallen when it has not. The fact is that this service IS traceable and IS throttled, two aspects which make it relevent only to the newbie spammer that doesn't know what he's doing.
Since US butts are, on the whole, larger than in the rest of the world, I can guess that a metric buttload is larger than a US buttload.
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
0165 Jun xxxxxxx xxxxxxxxxxxxxx
1602 May xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0734 Apr xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0439 Mar xxxxxxxxxxxxxxxxx
0289 Feb xxxxxxxxxxx
0236 Jan xxxxxxxxx
0283 Dec xxxxxxxxxxx
0189 Nov xxxxxxx
0417 Oct xxxxxxxxxxxxxxxx
0349 Sep xxxxxxxxxxxxx
Clearly, I for one have been getting a surge in spam lately, which might possibly be sloping back down after last month's spike, but it's too early to tell yet.
In spite of that, of the nearly 3000 spams I have received since march, only seven match the pattern with DAV in the message headers. That bears repeating: I have received only seven instances of this exploit, vs. 2940 overall spams since March. Further, I only see 72 messages that have a hotmail.com server on their received headers at all -- most of the time I get "from Hotmail users" it's almost always forged.
Anyway, the first message to mention "with DAV" was sent March 25th, which fits the timeline this guy describes. On the other hand, the rest of my data massively disagrees with the 2200% spike that is suggested in the linked blog -- it seems to me that 0.238% of the spam I'm getting is due to this mis-feature, not 2200%.
Now granted, the two of us are the only two data points that I know of so far, but the results that we're seeing are so wildly out of step that I wouldn't think people should draw conclusions from this. Two completely conflicting measurements can't show us any kind of pattern.
The spam sky may be falling, but this isn't one of the falling pieces you need to keep an eye out for as near as I can tell.
DO NOT LEAVE IT IS NOT REAL
I created a hotmail account with an unusual name unlikely to be guessed by any kind of directory attack, and selected every privacy option I could find but within four hours I got spam.
How could that be without Hotmail leaking names?