Slashdot Mirror
Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation
suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."
It's a good thing they've gotten so committed to security, hired so many competent folks. Otherwise stuff like this might happen over and over. I'm glad this one security vulnerability in Hotmail is now completely repaired. I'll sleep better at night.
Help stamp out iliturcy.
and to think of all the people who claimed that there was nothing wrong with Hotmail security and the PCPro chap who switched to Hotmail over Google must have had his password hacked by an alternative site.....
oh well, I'm sure this is just a coincidence, right.
Looks like PC Pro's Barry Collins weak password wasn't ultimately a problem.
Summation 2
Consider this- Hotmail is a very high profile and widely used e-mail system that theoretically is profitable in its advertising for its owner, and has a lot to lose immediately by being thoroughly exploited in the potential for a rapid loss of users to other non-fee email systems like Google and Yahoo, and they still didn't take any action to resolve this until disaster was literally looming
The federal government wants to require actual critical infrastructure to be security vigilant and is getting pushback from industry, again critical infrastructure, not even some silly free-ish service, to try to avoid the expense.
Corporations, by and large, do not share interests with the public. Corporations are there for profit for shareholders and management first and foremost, and due to extreme myopia in those sectors, where the quarterly profit rules supreme, spending money on things like security are not considered necessary because they don't make profit, rather they cost money. Worse, utility companies and other infrastructure companies aren't high profile; most people don't give any thought to their electric supply beyond paying the bill unless it ceases.
Corporations are not looking out for your interest, unless you happen to be one of the very few people who has any real amount of money tied up in them.
Do not look into laser with remaining eye.
Was overrun by spam years ago - have not used an account there since the rise of the G-mail.
Alright. I read about the hotmail security breach the other day and now this. I had my own account accessed twice before, but I thought it was just due to a weak password on my part each time. Now I'm thinking it wasn't just me. I want to switch now.
So for people in the know on email accounts, I have two questions:
1) What is the best choice of service for a lazy person? (Gmail? Seems like that one should be a target itself just from popularity.)
2) What sorts of obstacles will I face when switching? I have my current hotmail addy associated with every service I subscribe to, and I don't think I can change it with many of them. Am I supposed to empty out all the messages and contacts in it, then have it transfer all messages immediately to my new account?
spreading 'like wild fire' in the hacking community
For definitions of 'hacking community' sufficiently close to 4chan, I presume?
... pigeon style (0-day hackable by stones but it takes a whole lot more than youtube videos to grow the slingshot skills).
Dear Microsoft Support,
I own 100'000 hotmail accounts (now), but I don't consider them save anymore. Can I please return them? Would you mind exchanging them for a GMail account?
Thanks
0-day - MSoft .... giggle
Was there not a post earlier this week about the online journalist that got his hotmail hacked? Not the most secure password in the world, but there was no way it could have been brute/dictionaries. A tarpit or lockout would have made that impractical given the time frame.
I've got a feeling this has been going on for years. Nearly everyone I know who's ever had a hotmail acct has had it compromised.
I hope Microsoft has the decency of rolling back the affected accounts upon request. I mean, damage is done if the hacker got their contacts list, but no one should have to lose his or her account.
Hotmail should be doing more to protect users' accounts.
How about a master password in which someone can log in and reverse the damage done? It'd make it safer to log in with a regular password, and it could help reverse damage done by exploits, to a certain extent.
At one point the recovery system was pathetic. Forgot your password? No problem, send it to an alternative e-mail address. Oh, don't have access to your alternative e-mail address anymore? Well, no problem! Just answers these questions (answers readily available on the user's personal website or blog) and we'll change your alternative e-mail address to your choice. And I think this has to do with actual Hotmail employees regarding the alternative e-mail address situation.
Oh, and to make matters worse, the ones without an alternative e-mail addess could be recovered by answering such simple questions that after a few guesses, well, enough said.
Hence my suggestion. IMPLEMENT A MASTER PASSWORD OPTION!
http://www.rqsulfates.com/ZincSulfate_4_12_0_0.html Malwarebytes - a top-of-the-line Windows security app. - thinks that the rqsulfates link above has malicious links and or links to mailicious sites. (117.21.224.235). Be wary of clicking anything on this page - or even going there... unless you're testing your security apps of course!
God dammit, my WoW character is naked.
I had a hotmail account from 1998 with a cool ID that did not have an alternate email address because they didn't have the feature when I set it up. I was screwed out of my account in 2007 when someone reset it.
Hotmail staff were not helpful. Since they had previously purged my account of all data, I was unable to identify any mail that might link it to me. They were unwilling to reset the password to the previous version, despite my contacting them from the IP that had previously used the account, in the city where it was originally setup, etc. Tough nuts, they said.
The problem with email security is that once the attacker knows your email address, he can then go onto acquire the password through either phishing or guessing your password reset information. A simple solution that would mitigate against that is to provide the email identity in two parts, a private identity and a public email aliase. People send email to the public email address but only you can login with the private ID. The private ID is never transfered to any third party.
AccountKiller
"spreading 'like wild fire' in the hacking community"
well, it is hotmail afterall.
65.52.0.0/14 451 "Due to overwhelming security issues with hotmail, your e-mail provider has been blocked. Please switch e-mail providers, your e-mail is not safe at hotmail."
# grep hotmail.com /var/log/maillog | wc
20935 419204 4814336
If everyone did this, we wouldn't have an issue any more.