Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation 88
suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."
Ouch (Score:5, Funny)
Re:Ouch (Score:5, Funny)
I sleep well enough at night myself... I don't use Hotmail.
Re:Ouch (Score:5, Funny)
Re:Ouch (Score:5, Funny)
Re: (Score:1)
Would you rather MS not even have a security team, and ignore issues like this till it started getting widespread attention and calling into question their marketing efforts?
Re:Ouch (Score:4, Insightful)
you mean pull an apple
Re:Ouch (Score:5, Insightful)
Im guessing that, with that attitude, you are posting that comment using nothing but some wires, a battery and a fucking good knowledge of the tcp/ip protocol?
Every system ever built has the potential for issues, and the vast vast majority of systems have actually had issues - whatever you are using right now is not an exception.
Re: (Score:2)
Batteries are vulnerable to buffer overflows, you know.
(For certain definitions of "buffer" and "overflow")
Re: (Score:3)
What's that burning smell?
OH GOD PUT IT OUT!
Re: (Score:2)
Every system potentially has flaws but some vendors historically have had more exploits over time than others. Just because every system has flaws doesn't mean that the severity of the flaws can't be mitigated. Some vendors are in fact better at it than others.
Stop throwing your hands in the air as if to say that there's nothing anyone can do.
Example and history lesson: Windows 7 is more secure than XP even though all the while XP was popular everyon
Re: (Score:1)
Do you not remember Microsoft Windows XP Service Pack 2? The one which caused huge outcries of "my thing just stopped working?!" and caused a lot of software vendors to have to fix their broken applications, because Microsoft fixed a whole ream of issues with the Windows code base?
That was caused by the original outcries over continuous exploits and issues.
Microsoft did something. And I don't recall there ever being a large contingent of people claiming "theres nothing they can do".
Re: (Score:2)
What's the point in bringing up that all software has flaws if not to imply that there's nothing that can be done? What's the point in saying that MS has the biggest market share (and therefore the most targeted) if not to imply that there's nothing that can be done?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
PcPro (Score:5, Insightful)
and to think of all the people who claimed that there was nothing wrong with Hotmail security and the PCPro chap who switched to Hotmail over Google must have had his password hacked by an alternative site.....
oh well, I'm sure this is just a coincidence, right.
Re: (Score:2, Funny)
Where's TechOK/TechFL/Bonch/etc when you need him, eh?
Re: (Score:1)
The PCPro guy's password was not changed, correct? My understanding from the story was that someone somehow got his password; this exploit should allow someone to change it.
Re: (Score:2)
Re: (Score:2)
Re:PcPro (Score:5, Insightful)
Well, since the PCpro guy logged right back in to his email, however it was compromised it wasn't with the password reset token.
If it had been the password reset token, they wouldn't know his original password, they'd have changed it to something that only the hacker would know and he wouldn't have been able to log back in like he did.
So yes, it was a coincidence and/or another unknown hack.
Re: (Score:3)
So yes, it was a coincidence and/or another unknown hack.
Not necessarily so... The following scenario could have happened:
Re: (Score:3)
Even more likely the PCpro guy reset his password and simply didn't mention that step.
Hotmail Challenge (Score:5, Informative)
Looks like PC Pro's Barry Collins weak password [slashdot.org] wasn't ultimately a problem.
Re: (Score:2)
You're one of those people that thinks cars should all be limited to 65mph and ISPs should block all websites they find distasteful, aren't you?
Re: (Score:2)
He is right though. 7 words, all lowercase is to be frowned upon when you're allegedly knowledgeable about technology.
Re: (Score:1)
7 letters, 7 words would have been a fairly strong password, even if it was all lowercase.
Re: (Score:3)
7 letters, 7 words would have been a fairly strong password, even if it was all lowercase.
Assuming that a hacker knew it was 7 lowercase letters, and they were random, that's 26^7
That's more secure than 5 random characters from the about 72 upper/lower/numeric/symbols
Now I believe his password was actualy xxx, giving about 2000*26*26*26 combinations, only as secure as a 4 random character password, however unless someone had access to hotmail's hashes, it doesn't matter.
Most backs have a password of 4 numbers. That's 10,000 combinations, it's barely more secure than a 2 symbol password! However
Re: (Score:2)
you're right. I mixed that up.
Re: (Score:2)
How do you run through 26^7 possible password combinations on an online service?
Unless Microsoft lost the password hash database, it should be impossible to brute force a 7 letter password.
Re: (Score:2)
I'm from the place where people are responsible for locking their own doors, not relying on a building inspector coming around to make sure all of the locks are working properly.
Re:Hotmail Challenge (Score:4, Informative)
Check out comment 143 from Barry's original PCPro article [pcpro.co.uk]
Barry Collins Says:
April 27th, 2012 at 11:10 am
I consider myself suitably and rightfully admonished, Mr Winder. However, I don’t think I did fall victim to the zero-day exploit, as that would have required the hackers to reset the password. I was still able to access my account after it was hacked.
Barry Collins
Barry believes this was not the cause to his account being breached. Sounds like the fault may still be on his password choice.
Re: (Score:2)
Re: (Score:2)
There has to be another zero day hack out there because I know several people who had their Hotmail account hacked last year and in some cases they hadn't even logged in to Hotmail in months when they were hacked. They could have had weak passwords, but still. How do you manage to run thousands of password attempts against an online service like Hotmail without having some other hack (i.e. password Hotmail's hash file or such).
There has to be another zero day hack out there for sure or else M$ has the sam
Re: (Score:2)
Which part of 'hadn't logged in for months' didn't you understand?
Keyloggers are unlikely since none of their other, more lucrative accounts were hacked or invaded.
And since their passwds weren't changed, I dont think it was this 0 day exploit.
M$ security sux.
Critical Infrastructure (Score:2, Insightful)
The federal government wants to require actual critical infrastructure to be security vigilant and is getting pushb
Re:Critical Infrastructure (Score:5, Insightful)
I think your tinfoil hat's on a bit too tight.
Re: (Score:2)
For one, the tenuous attachment of this post to the topic is the assumption that Microsoft only fixed this when they were facing a profit disaster... except they were only aware of the problem a few hours before the fix was released, per the summary.
The rant against corporations assumes that corporations are those big evil faceless things that are just money-making machines. That's an incredibly simplistic and naive approach. Corporations exist to accomplish whatever goals their directors want, and that's n
Re: (Score:2)
There is a profit motive associated with securing electronic systems for the purveyors of those systems. It is simply not profitable to be seen as having shoddy security. This is a rookie mistake any decent security audit would have caught - and that implies that responsible audits are not being done. It follows straight on the heels of another one involving allowing users to have inadequate passwords. That means it's open season on Hotmail still and there's a heck of a lot of money to be made compromis
Re: (Score:3)
I think your tinfoil hat's on a bit too tight.
Not to mention inside out. I mean, the federal government is the good guy here? WTF?
Re: (Score:2)
How is an environment that fosters and encourages the bare minimum effort for the maximum return a conspiracy? From what little I know of corporate law, the OP's comment is spot on. My father, his neighbor and a third associate all called me in the last month to help fix the worm-like behavior associated with their hotmail accounts. Of the very small sample of hotmail users I know, at least three of them fell victim to these account exploits. I can only guess how many more there are in the world and none of
Re: (Score:2)
Re: (Score:3)
This is often repeated on Slashdot, and yet, it still isn't true. Corporations are most certainly interested in the interests of the public, insofar as the public ultimately represents their biggest customer. Not all corporation sell directly to the public, of course, and therefore they don't act in the public interest (oil companies, government contractors, etc.) but by and large, it is in Microsoft's and many corporations interest to work in the interest of consumers and the public because they are a larg
Re: (Score:2)
Re: (Score:2)
I stopped using Hotmail long before Gmail ever came out, but from what I hear they largely fixed their spam problems so it's on par with Gmail now.
Re: (Score:2)
I've tried Hotmail recently, and so far so good for spam. Of course it doesn't get near the use of my gmail, but even light use would have gotten me spam-swamped in the "good old days".
Re: (Score:2)
Re: (Score:1)
I've begun using my hotmail account recently as the "giveaway" address.
It was unusable not too long ago. Now, I really never get any spam in it.
How to change email account? (Score:2)
Alright. I read about the hotmail security breach the other day and now this. I had my own account accessed twice before, but I thought it was just due to a weak password on my part each time. Now I'm thinking it wasn't just me. I want to switch now.
So for people in the know on email accounts, I have two questions:
1) What is the best choice of service for a lazy person? (Gmail? Seems like that one should be a target itself just from popularity.)
2) What sorts of obstacles will I face when switching?
Re: (Score:2)
And yes, Gmail is pretty good. The only gripe I have is that I can't set up mail encryption (GPG for message header/body) in Gmail's webmail interface, but this is mainly interesting if your tin
Re: (Score:3)
Re: (Score:2)
My Gmail account got hacked into. It was a big hassle. The password wasn't weak, but I might have given it away to somebody by providing it to an "open id" login, or something like that.
I still have that Gmail account but with two step authorization (they send me an SMS with a code whenever I change IPs) but I am moving away from it.
Instead, I purchased a Linode server and deployed email solution there for primary email. It took me maybe a couple of hours to configure, but I am very happy with it, and I al
Re: (Score:2)
I've been running my own mail server for a decade now. Right now it's on Scientific Linux running on a Atom based machine. I love it because there is no latency for inbound mail, and it isn't dependent on ISP servers for inbound processing.
For outbound I still use my ISP mostly because I don't have a static IP and lots of services reject mail from dynamic IPs.
Re: (Score:2)
Re: (Score:1)
Did it get hacked into before or after you added the two step auth?
Also, are you using Google Account Reports? It now tells you exactly where and how you've logged into your Google Accounts; I think the SMS that you get are actually from this, not the two-step auth.
I feel much safer with the application one-time passwords and two-step hardware keycodes than any other service.
Does your Linode Server have two step auth to access email? And can you do that on your phone?
Hacking Community (Score:5, Funny)
spreading 'like wild fire' in the hacking community
For definitions of 'hacking community' sufficiently close to 4chan, I presume?
Re: (Score:1)
Total coincidence, but I saw this ancient B&W episode of Robin Hood [tvmoviesforfree.com] yesterday where he did hack a carrier pigeon. The sheriff was going to use pigeons to carry some pearls to his place, but Robin switch birds with Maid Marion's and took them elsewhere!
Dear Microsoft (Score:1)
I own 100'000 hotmail accounts (now), but I don't consider them save anymore. Can I please return them? Would you mind exchanging them for a GMail account?
Thanks
Wide-spread (Score:2)
0-day - MSoft .... giggle
Re: (Score:1)
Re: (Score:1)
Solution to email phishing .. (Score:1)
Just Solve It (Score:2)
65.52.0.0/14 451 "Due to overwhelming security issues with hotmail, your e-mail provider has been blocked. Please switch e-mail providers, your e-mail is not safe at hotmail."
# grep hotmail.com /var/log/maillog | wc
20935 419204 4814336
If everyone did this, we wouldn't have an issue any more.