Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation 88
suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."
Hotmail Challenge (Score:5, Informative)
Looks like PC Pro's Barry Collins weak password [slashdot.org] wasn't ultimately a problem.
Re:Hotmail Challenge (Score:4, Informative)
Check out comment 143 from Barry's original PCPro article [pcpro.co.uk]
Barry Collins Says:
April 27th, 2012 at 11:10 am
I consider myself suitably and rightfully admonished, Mr Winder. However, I don’t think I did fall victim to the zero-day exploit, as that would have required the hackers to reset the password. I was still able to access my account after it was hacked.
Barry Collins
Barry believes this was not the cause to his account being breached. Sounds like the fault may still be on his password choice.