Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation

suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."

Comments

Ouch

[symbolset]

It's a good thing they've gotten so committed to security, hired so many competent folks. Otherwise stuff like this might happen over and over. I'm glad this one security vulnerability in Hotmail is now completely repaired. I'll sleep better at night.

Re:Ouch

[Sarten-X]

I sleep well enough at night myself... I don't use Hotmail.

Re:Ouch

[bhcompy]

I use Windows Live mail, so I'm completely safe.

Re:Ouch

[Richard_at_work]

Im guessing that, with that attitude, you are posting that comment using nothing but some wires, a battery and a fucking good knowledge of the tcp/ip protocol?

Every system ever built has the potential for issues, and the vast vast majority of systems have actually had issues - whatever you are using right now is not an exception.

Re:Ouch

[Anonymous Coward]

Yeah I prefer hot females instead.

PcPro

[gbjbaanb]

and to think of all the people who claimed that there was nothing wrong with Hotmail security and the PCPro chap who switched to Hotmail over Google must have had his password hacked by an alternative site.....

oh well, I'm sure this is just a coincidence, right.

Re:PcPro

[__aaqvdr516]

Well, since the PCpro guy logged right back in to his email, however it was compromised it wasn't with the password reset token.

If it had been the password reset token, they wouldn't know his original password, they'd have changed it to something that only the hacker would know and he wouldn't have been able to log back in like he did.

So yes, it was a coincidence and/or another unknown hack.

Hotmail Challenge

[Rik Sweeney]

Looks like PC Pro's Barry Collins weak password wasn't ultimately a problem.

Re:Hotmail Challenge

[Anonymous Coward]

Check out comment 143 from Barry's original PCPro article

Barry Collins Says:
April 27th, 2012 at 11:10 am
I consider myself suitably and rightfully admonished, Mr Winder. However, I don’t think I did fall victim to the zero-day exploit, as that would have required the hackers to reset the password. I was still able to access my account after it was hacked.

Barry Collins

Barry believes this was not the cause to his account being breached. Sounds like the fault may still be on his password choice.

Re:Critical Infrastructure

[Sarten-X]

I think your tinfoil hat's on a bit too tight.

Hacking Community

[Vegemeister]

spreading 'like wild fire' in the hacking community

For definitions of 'hacking community' sufficiently close to 4chan, I presume?