Microsoft squashes Hotmail hijack bug

By on
Microsoft squashes Hotmail hijack bug

Accounts cracked in 60 seconds.

Microsoft has crushed a vulnerability in Hotmail that allowed attackers to hijack accounts using a Firefox extension.

The bug was actively exploited on cybercrime forums last month by users who boasted the ability to crack any Hotmail account in less than a minute.

Some charged around $20 for the service, security researcher Naveen Thakur said.

The attack was simplified through the Tamper Data Firefox extension, which helped hijackers exploit a weakness in the way Hotmail issued password resets. The exploit allowed attackers to bypass the recovery feature and issue a password of their choosing.

Researchers at Vulnerability Lab said the token system designed to secure the reset procedure "only checks if a value is empty then blocks or closes the web session".

"Successful exploitation results in unauthorised MSN or Hotmail account access."

Attackers could use positive values in the token system to bypass the security feature, decode the CAPTCHA anti-spam feature and send automated values to the MSN Live Hotmail module.

Vulnerability Labs discovered the flaw and reported it to Microsoft about ten days later.

Redmond's security team took only a day to fix the flaw.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?