Slashdot Log In
Passport's Pocket Picked
Posted by
michael
on Fri Nov 02, 2001 05:38 PM
from the department-of-insecurity dept.
from the department-of-insecurity dept.
emmons writes: "It looks like there's another hole in MS Passport according to Wired. This one allowing a user to steal another user's Passport Wallet, credit cards and all, by getting them to open a hotmail message. Nice." What happens when someone steals the basket with all your eggs?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
pre-paid Spam (Score:5, Funny)
"You've already paid the fee to get in on our bogus pyramid scheme, so now it's YOUR turn to go steal from someone else!"
In 6 months .... (Score:4, Funny)
will be
> In addition, the company has modified a software timer so that Passport users must re-enter all the information associated with their passport account (including their Wallet account) anytime they attempt to access the wallet service.
Which might be shortly followed by the first time MS has ever been able to claim their technologies are relatively secure. (Yes, I'll avoid being a jerk and suggesting anyone can ever be 100% secure.
Burning Reichstag (Score:3, Troll)
Is it concievable that M$FT is deliberately designing holes, staging exploits and publicizing them in order to get popular support for federally controlled security systems and universal elimination of anonymity?
The anthrax could be the same thing.. government allowing it to spread, or spreading it themselves, to pressure Congress to pass the USA PATRIOT act, which they did, and to pressure us to accept strictures on our behavior?
In both cases, ask: Quo bono? In the current climate, who benefits from these activities?
Terrorists don't benefit from the anthrax, and OSS doesn't benefit from these Passport exploits. In both cases, the government benefits.
Re:Burning Reichstag (Score:5, Insightful)
What they always have done. Rush a half-finished product out the door, and use whatever leverage they have to force it on whoever they can, while keeping the engineers busy in the back room with the bubblegum and duct-tape. Eventually, they'll get around to releasing a decent product.
Course, I won't be buying it then either. 8*)
Parent
Re:Burning Reichstag (Score:2)
And I'm sure there's a legal arm of its marketing department. The whole company reeks of marketing. There are way too many security fiascos from this company as they agressively push their touted inexpensive technologies onto the masses.
Re:Burning Reichstag (Score:2, Funny)
2. Saying OSS doesn't benefit from passport exploits implies that the Open Source Software movement is responsible for the exploits. They're not. Microsoft is. And through some twisted, delusional logic you assert that Microsoft benefits from building in exploits.
It's a well-known fact that CmdrTaco is trying to make it as easy as possible for trolls to post to slashdot, because he could use them as an excuse to further crack down on Joe Poster.
Also, hospitals won't treat you if they find you have an organ donor card -- they'll let you die because other people need your organs.
Furthermore, the entire world is an intricate conspiracy designed to repress you.
LOOK OUT! THEY'RE COMING NOW!
Re:Burning Reichstag (Score:3, Insightful)
Did anyone not see this coming? (Score:4, Insightful)
With passport, microsoft wishes to be the customs agent of the internet. However, with flaws like this they really are not going to turn many people over to their side.
I'm sure more exploits will pop up in the future. Most of them will likely use hotmail in someway or another to enter.
Re:Did anyone not see this coming? (Score:5, Insightful)
Hotmail is also the source of all of the passport accounts. Microsoft knows that Windows XP is not going to generate enough Passport accounts to entice web sites to start including Passport hooks. Hotmail, on the other hand, is very popular, and already has millions of users. Besides, if Microsoft can't design a secure Passport site, what is the chance that the bozos at your bank are going to be able to design a secure Passport site?
In other words Hotmail is both the primary draw for Passport, and an important proof of concept. Unfortunately for Microsoft it is also a huge gaping pile of security holes.
Parent
No one knows, or cares (Score:5, Insightful)
They are happily using their Hotmail accounts and have NO clue that these things exist. Sure, they might have it in PC World, or maybe the Technology section of the Times, but my MOTHER does not read these things. Only us geeks in the industry know ( we are a small percentage of the population).
Microsoft will fix this to appease the security experts, but that's about it.
As long as Joe Sixpack can stay happily ignorant, MS is happy. For example, one of my friends, a very intelligent Nuclear Physicist, just got suckered in to a CompUSA MegaPC w/ 1.2 GHZ, 1 GB RAM , DVD RAM and Windows XP for anout 5 Grand. He browses the web PERFECTLY fine on his 988 MHZ PC. He said the "pretty colors" of XP sold him. I told him of the security flaws and reasons for not going with XP (never mind the absolute non-necessity of the PC), and his response was "How come I haven't heard about these things you talk about?" I had no answer. That's how Microsoft stays in power. If we step outside the industry for a minute, we can see that Linux means nothing to most people, AOL IS the internet, and Windows IS a computer. How do we fix this? I don't know, but someone must.
Parent
more info (Score:5, Informative)
Marc's Passport Advisory [znep.com]
i want to go home and play civ3 (Score:4, Troll)
Send special forces to kill the bunny. And cluster bombs, lots of fucking cluster bombs
What happens when someone steals the basket with a (Score:2)
A testimony to the proposition that security CAN be legislated.
(Yeah, right.)
Re:What happens when someone steals the basket wit (Score:5, Insightful)
Only the discoverer of the hole will be forced to announce it anonymously, and publish it only in dark little places where the lawyerly eyes of Microsoft won't find it. And unscrupulous eyes will.
I can see it happening already. And Microsoft would not even hear of the hole until it's far, far too late. It will be a very, very dark day if information is compromised on this scale.
The DMCA in this case would directly contribute to the destruction of the integrity of the Passport system.
Simply put - if only outlaws find security holes, then only (genuine) outlaws will have access to them.
Parent
Killing the messenger? (Score:4, Interesting)
"Well, it wouldn't have been too much of a problem until those meddling kids at Apache showed up..."
Re:Killing the messenger? (Score:5, Interesting)
Imagine this scenario...
1) You discover a flaw that allows you to get a hold of everyones on the Internet credit card
2) You tell the vendor and wait.
3) The vendor acknoledges the flaw and posts a patch
4) In between 2 & 3 "nasty evil little hacker" discovers the same flaw and exploits it to his economic advantage (but not enough to get himself caught)
5) Vendor discovers that "your" hack has been used againt them for a period of time...
Who would you send the cops after ???
How would you go about proving your innocense, Don't get me started on Innocent until proven guilty -- I don't buy it for a second...
6) spend 20-life in jail ???
Parent
Microsoft leaked it anyway (Score:5, Funny)
A number of Microsoft employees also leaked it to their friends after I reported it to Microsoft, and it started spreading from there.
And even Microsoft's lawyers were in on the gig of making sure everyone knew about it.
But seriously... Microsoft has been, and almost always is, very good about timely responses to security reports. Their problem is in dealing with them without having to be told by some Joe User that they have problems.
Parent
Well so much for single sign-on (Score:5, Informative)
In addition, the company has modified a software timer so that Passport users must re-enter their password anytime they attempt to access the wallet service.
While Slemko's exploit, which relied on stealing browser cookies used by Passport, has been rendered inoperable by Microsoft's fixes, the programmer said "deeper issues" remain with the service.
"Passport's greatest marketing strength -- the single sign-on -- is also its chief technical weakness. It will be fairly trivial for attackers to dream up new ways of exploiting this," he said.
XP Integration is evil (Score:5, Informative)
Re:XP Integration is evil (Score:5, Informative)
You can, however, uninstall it!
Have a look at the file c:\windows\inf\sysoc.inf
Then change the line that reads:
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7
to
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,,7
Then go to the Control Panel, choose Add/Remove Programs, then select the "Windows components" tag. You'll note that "Windows Messenger" now appears at the bottom of the list; just remove it, and Windows/MSN Messenger will bother you no more.
Parent
New Passport Slogan... (Score:5, Funny)
-Zane
Re:New Passport Slogan... (Score:5, Funny)
AOL Account: $20 a month
Contribution to OSS fund: $1000
Charging it to Bill Gates Credit Card: Priceless
There are some rights money can't buy.
For everything else, there's Microsoft Passport.
Parent
Re:New Passport Slogan... (Score:3, Funny)
-Capitol One Credit Card
Who's in *your* wallet?
-Billy Gates
File suit with the FTC (Score:5, Interesting)
You can't market a product as having qualities it doesn't have without getting into trouble with the FTC. Granted, MS will try to spin this as "Those bad Linux hackers will steal your data!" The fact remains that they've lied to the American consumer. I think they need to be forced to amend their advertising.
Re:File suit with the FTC (Score:5, Funny)
A few weeks ago, I happened to see their advertisement promising "99.999% uptime". The subsequent expulsion of my carbonated beverage through my nose injured my delicate nasal passages and frightened my cat.
When I become Emperor of the Universe, Microsoft's advertisements will have to bear a Surgeon General's Warning.
k.
Parent
And this will be reported by who? (Score:5, Interesting)
In the end I guess I best move to the bahamas and start ordering lots of neat things with all these new credit card numbers that magically appeared in my hotmail account.
What about PayPal etc.? (Score:4, Insightful)
Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...
Re:What about PayPal etc.? (Score:4, Interesting)
Parent
Re:What about PayPal etc.? (Score:2, Informative)
99% of statistics are wrong or misleading
Just like all those people who have installed windows media player, it is added to an IE upgrade by default.....
Yawn
RickB
Passport liability (Score:4, Insightful)
Another lesson to be learned from this (Score:4, Insightful)
like Microsoft. But there are other 'takers'. Some even with the best of intentions.
If any of them ever gets to be the one and only 'central repository', they will be subject to just this kind of attack as well. If you can't compromise the service, then hack into the user's desktop. As soon as enough people use it, it becomes a very attractive target. In a similar vein, there have been viruses that target the client end of home-banking software.
Security is enhanced by redundancy, by having several distinct systems in place, preferably as dissimilar as possible. Monoculture and monopolies always form a fertile environment for viruses and other pests.
I feel this makes the whole idea of a centralized service like Passport or any of it's competitors an extremely dangerous development.
This is why... (Score:4, Informative)
it isn't just about hotmail and passport wallet (Score:5, Interesting)
The real risk here isn't to hotmail or passport wallet (passport wallet isn't really an integral part of passport, just another service using it for authentication). It is to all things using passport. That isn't so much right now. But if Microsoft has their way, it will be. The sample exploit used Hotmail and Passport Wallet simply because they are commonly used services.
I would also like to note that Microsoft has been quite forthcoming with details and admitting the problems and fixing them. They are very good at being reactive. We will have to see how well this works going forward.
Re:it isn't just about hotmail and passport wallet (Score:3, Insightful)
As good as MS has been at reacting to problems, I think the fear here is that MS has not shown much interest in being PROactive in preventing such problems, particularly problems with such potential for ruining people's credit histories or bank accounts. If that is a legitimate fear, then it's a whopper!
As you imply, this is the tip of the iceberg, if Passport is intended to be the be-all, end-all for
---
A flawed MS product (OMFG) (Score:2)
I'm gonna go for all of the above
XP == (Score:4, Funny)
Offline Forever (Score:3, Interesting)
the wallet service will remain offline until the company can add additional security features "to ensure that similar exploits cannot be used to compromise our user's credit card information."
What's the standard for this? Based on Microsoft's track record, a new exploit will come up regardless of how many patches are issued. No way I'm going to let them keep my personal data. Too bad the average consumer may not realize this.
Anyone ready for that negligence suit? (Score:3, Interesting)
What about the other ways your CC # can be stolen? (Score:3, Insightful)
How often do you hand your credit card to a server at a restauraunt? A store? Over the phone to pay for something? Are you forgetting that your credit card number can easily be stolen that way? Most receipts from purchases have your credit card number on them. Do you shred / burn them to stop someone from getting your CC #?
Re:What about the other ways your CC # can be stol (Score:3, Insightful)
You do realize that you can be held liable for whatever charges your card incurs if you do not follow this kind of practice, dont you? And you do realize what happens if you are held liable for a $10K shopping spree that someone went on with your credit card? You pay it, you pay it at once, or your credit rating is slashed, you default on your house mortgage as your bank suddenly wants their money back and their money back _now_, you wont be able to get a new loan and you'll have to sell pretty much everything you own.
Im not kidding, I've seen that happen. I have a coworker who makes as much as I do, who can barely afford to eat lunch in the company resturant. Your life suddenly becomes a helluvalot more expensive once you're put on rapid payback on all your loans and the interest rates you're paying are doubled.
Wow (Score:5, Interesting)
What folks need to do is hold off on publishing these exploits (as Microsoft requests) until they've got a lot more riding on it. When a couple of banks lose a couple of million bucks on this, not to mention the confidence of their customers, well, then you might get some real coverage.
Remember, Microsoft wants to build houses of straw, and likes to call anyone who points out they are made of straw terrorists. Of course, as soon as I see that attitude from someone I'm supposed to trust I run as far and as fast as I can just as I'd run from a used car salesmen who wouldn't let my mechanic check out the car.
Where do you want to go with my money today? (Score:4, Funny)
WWMRTD? (what would mr t do?) (Score:4, Funny)
Eggs? What you talkin' all about eggs for? Don't give me none of that Gibber-Jabber, or you best be tossed!
You took a wallet? I don't see no crazy wallet! You're talking like Face, crazy fool!
Besides, you don't need no wallet! Just dial
1-800-COLLECT and save a buck or two.
XP? That better mean Xtra Punishment, cause that's what I'm gonna do to that Gates fool! He can't escape me, cause my van's hella fast!
Don't do drugs! Drink milk!
Come here, sucka. I'll toss you!
What I want ... (Score:2)
- Nothing but a 32 bit operating system, running on a 16 bit core, based on an older 8 bit operating system, run by a 4 bit company that can't stand 2 bits of competition
Priceless (Score:3, Funny)
Microsoft Windows XP: $219
Compaq IPaq with Windows CE: $499
Subscription to
Microsoft Passport: Free*
Having your MasterCard(TM) info on the net for anyone to see:
Priceless.
(*note: This is a parody of the successful "Priceless" MasterCard(TM) advertising venture. As a parody it is protected under the 1st amendment established by MasterCard(TM) v. Nader)
Economic Issues (Score:3, Interesting)
I have been ranting to all of my clients and friends about this sort of problem ever since MS came up with the idea of passport.
Scenario:
2 years from now 150 million people actually have their personal details and credit card numbers stored with MS (this isn't so now, people have passport accounts by default due to hotmails reliance)
Another hack comes out and it is proven that the vast majority of credit card numbers for people were compromised.
Visa, Amex, Mastercard et al are forced to re-issue credit cards to all people using passport
The global economy is severely disrupted due to the downturn in online spending, the overall costs incurred by the replacement and the lack of consumer confidence in online shopping, banking etc
Microsoft point to the famous "we're not liable for jack shit" clause in the agreement
So what happens? Does MS still get sued? Do the credit card companies just sit back, hemorrhage and go "Oh well, shit happens."?
Most importantly, do consumers finally realise that they have been taken for a ride for the last 7 years and boycott?
This really scares me. Giving personal details to any company is bad. Giving them to a company with a severely impaired security record is just plain stupid.
estimates of the number of Passport users? (Score:3, Interesting)
"Up to" is vague- It is true that "up to 7 billion people have as much money as Bill Gates", but it might be good to have a better estimate...
If you are counting hotmail accounts, many people have multiple accounts, which could get things up towards 200 million just in the US, so I am curious how many distinct users there really are. In particular, how many people have more than the default setup from having a hotmail account and actually have info in a Passport wallet? For people with multiple hotmail accounts (for different purposes, expired purposes or just forgot about it) presumably they would have one or only a few accounts with the credit card info and so on.
single point of failure (Score:4, Insightful)
Parent
Do'nt put all your eggs in one basket (Score:4, Interesting)
"More than 70 sites are in the process of deploying Passport's authentication technology, according to Microsoft. Among them is Prudential Banking's Egg.com online bank, which is switching to Passport..."
Egg.com sounds kind of ironic. Must be quite a marketing effort on Microsoft's behalf getting banks to deploy not tested technology on a mass scale.
Parent
Re:spin control (Score:2)
And what a little amount of time it was!!