Microsoft squashes Hotmail hijack bug

Powered by SC Magazine
 

Accounts cracked in 60 seconds.

Microsoft has crushed a vulnerability in Hotmail that allowed attackers to hijack accounts using a Firefox extension.

The bug was actively exploited on cybercrime forums last month by users who boasted the ability to crack any Hotmail account in less than a minute.

Some charged around $20 for the service, security researcher Naveen Thakur said.

The attack was simplified through the Tamper Data Firefox extension, which helped hijackers exploit a weakness in the way Hotmail issued password resets. The exploit allowed attackers to bypass the recovery feature and issue a password of their choosing.

Researchers at Vulnerability Lab said the token system designed to secure the reset procedure "only checks if a value is empty then blocks or closes the web session".

"Successful exploitation results in unauthorised MSN or Hotmail account access."

Attackers could use positive values in the token system to bypass the security feature, decode the CAPTCHA anti-spam feature and send automated values to the MSN Live Hotmail module.

Vulnerability Labs discovered the flaw and reported it to Microsoft about ten days later.

Redmond's security team took only a day to fix the flaw.

Copyright © SC Magazine, Australia


Microsoft squashes Hotmail hijack bug
 
 
 
Top Stories
Inside the stalemate on Australia's piracy code
Still not registered almost five months on.
 
IT staff outline deep anger in Macquarie Uni survey
‘Morale at lowest point in a decade’.
 
Cost blowout to push NBN past $41bn budget
But government funding cap to remain.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Say goodbye to OneDrive Groups
Aug 28, 2015
If you've a) actually been using OneDrive and b) gone so far as to actually have been using ...
Libreoffice 5 review
Aug 24, 2015
It's free! It's open! But does LibreOffice deliver on its promise of a powerful office suite for ...
How to disable Cortana in Windows 10
Aug 21, 2015
Stop Microsoft's personal assistant snooping around.
Uni is optional: 5 tech leaders without a degree
Aug 17, 2015
Already running a business, but thinking about going back to uni? From Bill Gates to Steve Jobs, ...
New features coming to Xero
Aug 17, 2015
Use Xero? Here are some of the things you can look forward to in the coming months.
Latest Comments
Polls
New Windows 10 users, are you upgrading from...




   |   View results
Windows 8
  48%
 
Windows 7
  44%
 
Windows XP
  4%
 
Another operating system
  2%
 
Windows Vista
  1%
TOTAL VOTES: 679

Vote