Passport's Pocket Picked

emmons writes: "It looks like there's another hole in MS Passport according to Wired. This one allowing a user to steal another user's Passport Wallet, credit cards and all, by getting them to open a hotmail message. Nice." What happens when someone steals the basket with all your eggs?

Did anyone not see this coming?

[chronos2266]

I remember a year or two ago a person could send you an email and obtain your hotmail account. Hotmail is a gaping hole in the passport service.

With passport, microsoft wishes to be the customs agent of the internet. However, with flaws like this they really are not going to turn many people over to their side.

I'm sure more exploits will pop up in the future. Most of them will likely use hotmail in someway or another to enter.

Public knowledge

[lexcyber]

I sure hope this don't stay on slashdot. It should really be public knowledge that this sort of thing can happen in the passport service that MS provide. - ASAP

single point of failure

[Pope]

MS seems to have Single Point of Failure problems in a lot of things: the Registry, any one?

Re:What happens when someone steals the basket wit

[MaxwellStreet]

Interestingly, this is exactly what will happen.

Only the discoverer of the hole will be forced to announce it anonymously, and publish it only in dark little places where the lawyerly eyes of Microsoft won't find it. And unscrupulous eyes will.

I can see it happening already. And Microsoft would not even hear of the hole until it's far, far too late. It will be a very, very dark day if information is compromised on this scale.

The DMCA in this case would directly contribute to the destruction of the integrity of the Passport system.

Simply put - if only outlaws find security holes, then only (genuine) outlaws will have access to them.

What about PayPal etc.?

[byronne]

Maybe I'm being stupid here, but what's the diff between Passport and PayPal, and why hasn't PayPal been a crack target?

Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...

Passport liability

[stox]

I haven't read the pasport user's agreement, but would I be incorrect in guessing that Microsoft takes no responsibility for the safety of one's personal data? We're sorry we ruined your life, but if you read the fine print you will see that we are not responsible for anything. When will Microsoft be held responsible for it's actions?

Re:Burning Reichstag

[Shotgun]

Good conspiracy theory, but I would have to say look at history in this case. MS is threatened. Sales revenue is in the toilet and the outlook for future sales is even bleaker. They have to come up with a strategy and implement it fast. What do they do?

What they always have done. Rush a half-finished product out the door, and use whatever leverage they have to force it on whoever they can, while keeping the engineers busy in the back room with the bubblegum and duct-tape. Eventually, they'll get around to releasing a decent product.

Course, I won't be buying it then either. 8*)

Another lesson to be learned from this

[Paul Boven]

This shows that your private information may not be in the best hands when entrusted to a company
like Microsoft. But there are other 'takers'. Some even with the best of intentions.

If any of them ever gets to be the one and only 'central repository', they will be subject to just this kind of attack as well. If you can't compromise the service, then hack into the user's desktop. As soon as enough people use it, it becomes a very attractive target. In a similar vein, there have been viruses that target the client end of home-banking software.

Security is enhanced by redundancy, by having several distinct systems in place, preferably as dissimilar as possible. Monoculture and monopolies always form a fertile environment for viruses and other pests.

I feel this makes the whole idea of a centralized service like Passport or any of it's competitors an extremely dangerous development.

What about the other ways your CC # can be stolen?

[nvrrobx]

People seem to be blowing this out of proportion, IMHO.

How often do you hand your credit card to a server at a restauraunt? A store? Over the phone to pay for something? Are you forgetting that your credit card number can easily be stolen that way? Most receipts from purchases have your credit card number on them. Do you shred / burn them to stop someone from getting your CC #?

Re:it isn't just about hotmail and passport wallet

[FrankHaynes]

I would also like to note that Microsoft has been quite forthcoming with details and admitting the problems and fixing them. They are very good at being reactive. We will have to see how well this works going forward.

As good as MS has been at reacting to problems, I think the fear here is that MS has not shown much interest in being PROactive in preventing such problems, particularly problems with such potential for ruining people's credit histories or bank accounts. If that is a legitimate fear, then it's a whopper!

As you imply, this is the tip of the iceberg, if Passport is intended to be the be-all, end-all for .Net access to those services offered by MS and its agents.

---

Re:Did anyone not see this coming?

[Jason Earl]

Hotmail is also the source of all of the passport accounts. Microsoft knows that Windows XP is not going to generate enough Passport accounts to entice web sites to start including Passport hooks. Hotmail, on the other hand, is very popular, and already has millions of users. Besides, if Microsoft can't design a secure Passport site, what is the chance that the bozos at your bank are going to be able to design a secure Passport site?

In other words Hotmail is both the primary draw for Passport, and an important proof of concept. Unfortunately for Microsoft it is also a huge gaping pile of security holes.

Re:And think...

[El_Nofx]

May I be mod'd as redundant....
If you are stupid enought to trust ANYTHING vital to Microsoft in the first place then you deserve to have it stolen.
I want to see the press release they put out on this, i can see it now

"Here at Microsoft we are devoted to security, those evil hackers have again stolen your information, we must pass more laws punishing the offenders and in the future we will assure that nothing like this will happen again"

What he is saying is (we want to throw the smart people in jail so only idiots are left to use our software)

Re:Wow

[Anonymous Coward]

When a couple of banks lose a couple of million bucks on this, not to mention the confidence of their customers, well, then you might get some real coverage.

I don't think I'd bet on people or the media being able to make the distinction between "Microsoft's network products aren't safe" and "The Internet isn't safe". It's very possible that a crappy and widely exploited implementation of Passport (wallet) would be more threatening to e-commerce in general than to Microsoft in particular.

Re:Passport liability

[cant_get_a_good_nick]

The other interesting thing about this, is that one of the arguments against open source software is that "who are you going to blame". Sure, with commercial software, there is an entity you can holler at, but the Licencing Agreements give you about the same redress in case of bugs in software.

Re:What about PayPal etc.?

[cant_get_a_good_nick]

Also, I had no idea 165 MILLION people were already using Passport - I suppose my OS hasn't asked me enough times to sign up for it until I break under the strain...

Hotmail accounts are Passport accounts. This probably accounts for the bulk of them. A non-zero number of Hotmail accounts are inactive, or are just used as throwaway accounts. Interesting to see figures on this.

Microsoft just changed their Hotmail policy to require a login every 30 days or they'd disable your Hotmail. If you pay them money, you can get an upgraded account that includes never being disabled (while yu pay) and more storage. Still has a paltry attachment limit though.

Re:Burning Reichstag

[GunFodder]

Never attribute to malice what could be explained by ignorance or stupidity. And Microsoft and the government have plenty of that to go around.

No one knows, or cares

[xtremex]

The typical user does NOT get this information.
They are happily using their Hotmail accounts and have NO clue that these things exist. Sure, they might have it in PC World, or maybe the Technology section of the Times, but my MOTHER does not read these things. Only us geeks in the industry know ( we are a small percentage of the population).
Microsoft will fix this to appease the security experts, but that's about it.
As long as Joe Sixpack can stay happily ignorant, MS is happy. For example, one of my friends, a very intelligent Nuclear Physicist, just got suckered in to a CompUSA MegaPC w/ 1.2 GHZ, 1 GB RAM , DVD RAM and Windows XP for anout 5 Grand. He browses the web PERFECTLY fine on his 988 MHZ PC. He said the "pretty colors" of XP sold him. I told him of the security flaws and reasons for not going with XP (never mind the absolute non-necessity of the PC), and his response was "How come I haven't heard about these things you talk about?" I had no answer. That's how Microsoft stays in power. If we step outside the industry for a minute, we can see that Linux means nothing to most people, AOL IS the internet, and Windows IS a computer. How do we fix this? I don't know, but someone must.

Re:Anyone ready for that negligence suit?

[per unit analyzer]

...But people have been conditioned to accept software bugs and security holes as the norm. People's expectations of software (whether on their own PC or on an Internet server somewhere) is so low that MS can get away with crap like this. What low expectations don't cover, the EULA will. If a negligence suit ever saw trial, I bet the jury would be hit over the head with the "IN NO EVENT SHALL MICROSOFT AND/OR ITS SUPPLIERS BE LIABLE FOR...ANY DAMAGES WHATSOEVER..." language from the EULA. After all, the users agreed to live with this level of service. If Ford and Firestone only had a EULA to cover their problem...

-z

Re:Microsoft leaked it anyway

[smittyoneeach]

Really, now.
If you were a serious thief, you'd be no more apt to reveal the exploit than a magician to reveal the trick.
Visa... MasterCard... the banks... they all lose piles of money annually, yet say nothing, due to the negative marketing impact.
The DOJ's "Stop, or I'll say 'Stop' again" deal with Mr. Softy amounts to a fart in a thunderstorm. The only real judge, jury, and executioner is the market. When people tell Billy G. to talk to the hand, we're not swallowing your latest lock-in scheme, regardless of the good aspects of the engineering and convenience offered, then we can see about real competition.
Only the market, by refusing to buy flawed products, can improve the QA of anyone.

Re:Just when I was about to give in...

[Sj0]

From what I've heard of XP, Microsoft is trying a new technique: The peer pressure technique.

Installing XP: Do you want to sign up for a passport account?

booting up for the first time: Cmon, sign up for a passport account.

starting up internet explorer: Sign up for a passport account. I'll be your freind!

entering hotmail: Oh yeah? well I'm not going to let you go here unless you sign up for passport!

this is a dramatization. I haven't used XP, and I don't want to(I have enough waiting in my life, thank you very much :))

Re:What about the other ways your CC # can be stol

[Znork]

Yes, at the very least I tear out the code, rip it in half and throw away the pieces separately. Nor do I ever let my credit card out of my sight at a resturant. If I make purchases online or over the phone I have a separate minimum-limit ($500 limit) card that I charge to. And if Im really suspicious I create a one-time cc number with not more than the amount due available on it.

You do realize that you can be held liable for whatever charges your card incurs if you do not follow this kind of practice, dont you? And you do realize what happens if you are held liable for a $10K shopping spree that someone went on with your credit card? You pay it, you pay it at once, or your credit rating is slashed, you default on your house mortgage as your bank suddenly wants their money back and their money back _now_, you wont be able to get a new loan and you'll have to sell pretty much everything you own.

Im not kidding, I've seen that happen. I have a coworker who makes as much as I do, who can barely afford to eat lunch in the company resturant. Your life suddenly becomes a helluvalot more expensive once you're put on rapid payback on all your loans and the interest rates you're paying are doubled.