Forgot your password?
typodupeerror
Bug Microsoft Security The Internet News Your Rights Online

Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation 88

Posted by Soulskill
from the barn-doors-and-horses dept.
suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."
This discussion has been archived. No new comments can be posted.

Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation

Comments Filter:
  • Ouch (Score:5, Funny)

    by symbolset (646467) * on Friday April 27, 2012 @10:10AM (#39820489) Journal
    It's a good thing they've gotten so committed to security, hired so many competent folks. Otherwise stuff like this might happen over and over. I'm glad this one security vulnerability in Hotmail is now completely repaired. I'll sleep better at night.
    • Re:Ouch (Score:5, Funny)

      by Sarten-X (1102295) on Friday April 27, 2012 @10:13AM (#39820511) Homepage

      I sleep well enough at night myself... I don't use Hotmail.

    • Re:Ouch (Score:5, Funny)

      by bhcompy (1877290) on Friday April 27, 2012 @10:19AM (#39820599)
      I use Windows Live mail, so I'm completely safe.
    • by firex726 (1188453)

      Would you rather MS not even have a security team, and ignore issues like this till it started getting widespread attention and calling into question their marketing efforts?

    • Re:Ouch (Score:5, Insightful)

      by Richard_at_work (517087) <richardpriceNO@SPAMgmail.com> on Friday April 27, 2012 @10:44AM (#39820931)

      Im guessing that, with that attitude, you are posting that comment using nothing but some wires, a battery and a fucking good knowledge of the tcp/ip protocol?

      Every system ever built has the potential for issues, and the vast vast majority of systems have actually had issues - whatever you are using right now is not an exception.

      • Batteries are vulnerable to buffer overflows, you know.

        (For certain definitions of "buffer" and "overflow")

      • by NotBorg (829820)

        Every system ever built has the potential for issues

        Every system potentially has flaws but some vendors historically have had more exploits over time than others. Just because every system has flaws doesn't mean that the severity of the flaws can't be mitigated. Some vendors are in fact better at it than others.

        Stop throwing your hands in the air as if to say that there's nothing anyone can do.

        Example and history lesson: Windows 7 is more secure than XP even though all the while XP was popular everyon

        • Do you not remember Microsoft Windows XP Service Pack 2? The one which caused huge outcries of "my thing just stopped working?!" and caused a lot of software vendors to have to fix their broken applications, because Microsoft fixed a whole ream of issues with the Windows code base?

          That was caused by the original outcries over continuous exploits and issues.

          Microsoft did something. And I don't recall there ever being a large contingent of people claiming "theres nothing they can do".

          • by NotBorg (829820)

            I don't recall there ever being a large contingent of people claiming "theres nothing they can do".

            What's the point in bringing up that all software has flaws if not to imply that there's nothing that can be done? What's the point in saying that MS has the biggest market share (and therefore the most targeted) if not to imply that there's nothing that can be done?

            • by symbolset (646467) *
              I'm going to leave this one alone from now on. Coming from this viewpoint Richard's probably heard enough about Microsoft's security problems to last a lifetime.
      • by symbolset (646467) *
        I probably could pull that off sometime before Microsoft manages to make Hotmail secure enough to be useful.
      • by symbolset (646467) *
        This is your way of saying there is no hope for a thorough Hotmail security audit, even in the light of two rookie flaws making the news in a few days. Because we should just expect Hotmail to be insecure even at this level of unprofessionalism. Thanks for that. I'm really looking forward to the festival of fun that Live integration with W8 will bring.
  • PcPro (Score:5, Insightful)

    by gbjbaanb (229885) on Friday April 27, 2012 @10:15AM (#39820547)

    and to think of all the people who claimed that there was nothing wrong with Hotmail security and the PCPro chap who switched to Hotmail over Google must have had his password hacked by an alternative site.....

    oh well, I'm sure this is just a coincidence, right.

    • Re: (Score:2, Funny)

      by binarylarry (1338699)

      Where's TechOK/TechFL/Bonch/etc when you need him, eh?

    • by Anonymous Coward

      The PCPro guy's password was not changed, correct? My understanding from the story was that someone somehow got his password; this exploit should allow someone to change it.

    • Re:PcPro (Score:5, Insightful)

      by Jaktar (975138) on Friday April 27, 2012 @11:32AM (#39821609)

      Well, since the PCpro guy logged right back in to his email, however it was compromised it wasn't with the password reset token.

      If it had been the password reset token, they wouldn't know his original password, they'd have changed it to something that only the hacker would know and he wouldn't have been able to log back in like he did.

      So yes, it was a coincidence and/or another unknown hack.

      • So yes, it was a coincidence and/or another unknown hack.

        Not necessarily so... The following scenario could have happened:

        1. Attacker resets PCpro guy's password using this vulnerability
        2. Attacker rifles through PCpro guy's mails...
        3. ... and find a confirmation mail from another site, containing the password to that site (yes, some sites unfortunately do this...)
        4. On a hunch, and in order to stay discrete, attackers sets hotmail password "back" to the password found in that confirmation mail
        • by tbannist (230135)

          Even more likely the PCpro guy reset his password and simply didn't mention that step.

  • Hotmail Challenge (Score:5, Informative)

    by Rik Sweeney (471717) on Friday April 27, 2012 @10:17AM (#39820561) Homepage

    Looks like PC Pro's Barry Collins weak password [slashdot.org] wasn't ultimately a problem.

    • Re:Hotmail Challenge (Score:4, Informative)

      by Anonymous Coward on Friday April 27, 2012 @10:41AM (#39820891)

      Check out comment 143 from Barry's original PCPro article [pcpro.co.uk]

      Barry Collins Says:
      April 27th, 2012 at 11:10 am
      I consider myself suitably and rightfully admonished, Mr Winder. However, I don’t think I did fall victim to the zero-day exploit, as that would have required the hackers to reset the password. I was still able to access my account after it was hacked.

      Barry Collins

      Barry believes this was not the cause to his account being breached. Sounds like the fault may still be on his password choice.

      • by fxbar (2627205)
        I think this once more shows how amateurish software is developed at microsoft**. So I would bet some money that there is a second 0-day flaw that is used which does not require to change the password of the user. I don't believe that this password was brute forced, because even microsoft should (now) be able to prevent brute forcing. Or are they not even able to achieve that? Because his account was new it means that many attempts to brute force would have been done in a short period of time, any reasonabl
    • by cc_pirate (82470)

      There has to be another zero day hack out there because I know several people who had their Hotmail account hacked last year and in some cases they hadn't even logged in to Hotmail in months when they were hacked. They could have had weak passwords, but still. How do you manage to run thousands of password attempts against an online service like Hotmail without having some other hack (i.e. password Hotmail's hash file or such).

      There has to be another zero day hack out there for sure or else M$ has the sam

  • by TWX (665546)
    Consider this- Hotmail is a very high profile and widely used e-mail system that theoretically is profitable in its advertising for its owner, and has a lot to lose immediately by being thoroughly exploited in the potential for a rapid loss of users to other non-fee email systems like Google and Yahoo, and they still didn't take any action to resolve this until disaster was literally looming

    The federal government wants to require actual critical infrastructure to be security vigilant and is getting pushb
    • by Sarten-X (1102295) on Friday April 27, 2012 @10:27AM (#39820709) Homepage

      I think your tinfoil hat's on a bit too tight.

      • by srussia (884021)

        I think your tinfoil hat's on a bit too tight.

        Not to mention inside out. I mean, the federal government is the good guy here? WTF?

      • by tunapez (1161697)

        How is an environment that fosters and encourages the bare minimum effort for the maximum return a conspiracy? From what little I know of corporate law, the OP's comment is spot on. My father, his neighbor and a third associate all called me in the last month to help fix the worm-like behavior associated with their hotmail accounts. Of the very small sample of hotmail users I know, at least three of them fell victim to these account exploits. I can only guess how many more there are in the world and none of

      • by NotBorg (829820)
        In GP's defense, you actually want it some what tight. If it's loose and sagging it can potentially block your view of the real world.
    • by Baloroth (2370816)

      This is often repeated on Slashdot, and yet, it still isn't true. Corporations are most certainly interested in the interests of the public, insofar as the public ultimately represents their biggest customer. Not all corporation sell directly to the public, of course, and therefore they don't act in the public interest (oil companies, government contractors, etc.) but by and large, it is in Microsoft's and many corporations interest to work in the interest of consumers and the public because they are a larg

  • Alright. I read about the hotmail security breach the other day and now this. I had my own account accessed twice before, but I thought it was just due to a weak password on my part each time. Now I'm thinking it wasn't just me. I want to switch now.

    So for people in the know on email accounts, I have two questions:
    1) What is the best choice of service for a lazy person? (Gmail? Seems like that one should be a target itself just from popularity.)

    2) What sorts of obstacles will I face when switching?

    • When I migrated from university webmail to Gmail last year, I used Thunderbird to transfer the gigabytes of sent/received email I had there. First download from "YourOldMail", then upload to "YourNewMail". Painless experience, and I recommend this approach if "YourNewMail" can't import directly from "YourOldMail".

      And yes, Gmail is pretty good. The only gripe I have is that I can't set up mail encryption (GPG for message header/body) in Gmail's webmail interface, but this is mainly interesting if your tin
    • by dejanc (1528235)

      My Gmail account got hacked into. It was a big hassle. The password wasn't weak, but I might have given it away to somebody by providing it to an "open id" login, or something like that.

      I still have that Gmail account but with two step authorization (they send me an SMS with a code whenever I change IPs) but I am moving away from it.

      Instead, I purchased a Linode server and deployed email solution there for primary email. It took me maybe a couple of hours to configure, but I am very happy with it, and I al

      • I've been running my own mail server for a decade now. Right now it's on Scientific Linux running on a Atom based machine. I love it because there is no latency for inbound mail, and it isn't dependent on ISP servers for inbound processing.

        For outbound I still use my ISP mostly because I don't have a static IP and lots of services reject mail from dynamic IPs.

        • I have my own mail server, on a commercial internet account... I find that I use my gmail account far more than my vanity domain. I have been using SmarterMail for a number of years now, with pretty good settings for spam prevention... just the same, gmail's web interface and integration (with android) has worked out better for me.
      • by tmarthal (998456)

        Did it get hacked into before or after you added the two step auth?

        Also, are you using Google Account Reports? It now tells you exactly where and how you've logged into your Google Accounts; I think the SMS that you get are actually from this, not the two-step auth.

        I feel much safer with the application one-time passwords and two-step hardware keycodes than any other service.

        Does your Linode Server have two step auth to access email? And can you do that on your phone?

  • by Vegemeister (1259976) on Friday April 27, 2012 @10:41AM (#39820895)

    spreading 'like wild fire' in the hacking community

    For definitions of 'hacking community' sufficiently close to 4chan, I presume?

  • Dear Microsoft Support,
    I own 100'000 hotmail accounts (now), but I don't consider them save anymore. Can I please return them? Would you mind exchanging them for a GMail account?
    Thanks
  • 0-day - MSoft .... giggle

  • The problem with email security is that once the attacker knows your email address, he can then go onto acquire the password through either phishing or guessing your password reset information. A simple solution that would mitigate against that is to provide the email identity in two parts, a private identity and a public email aliase. People send email to the public email address but only you can login with the private ID. The private ID is never transfered to any third party.
  • 65.52.0.0/14 451 "Due to overwhelming security issues with hotmail, your e-mail provider has been blocked. Please switch e-mail providers, your e-mail is not safe at hotmail."

    # grep hotmail.com /var/log/maillog | wc
        20935 419204 4814336

    If everyone did this, we wouldn't have an issue any more.

1 Dog Pound = 16 oz. of Alpo

Working...