Microsoft squashes Hotmail hijack bug

By Darren Pauli on May 1, 2012 7:55 AM
Filed under Security

Accounts cracked in 60 seconds.

Microsoft has crushed a vulnerability in Hotmail that allowed attackers to hijack accounts using a Firefox extension.

The bug was actively exploited on cybercrime forums last month by users who boasted the ability to crack any Hotmail account in less than a minute.

Some charged around $20 for the service, security researcher Naveen Thakur said.

The attack was simplified through the Tamper Data Firefox extension, which helped hijackers exploit a weakness in the way Hotmail issued password resets. The exploit allowed attackers to bypass the recovery feature and issue a password of their choosing.

Researchers at Vulnerability Lab said the token system designed to secure the reset procedure "only checks if a value is empty then blocks or closes the web session".

"Successful exploitation results in unauthorised MSN or Hotmail account access."

Attackers could use positive values in the token system to bypass the security feature, decode the CAPTCHA anti-spam feature and send automated values to the MSN Live Hotmail module.

Vulnerability Labs discovered the flaw and reported it to Microsoft about ten days later.

Redmond's security team took only a day to fix the flaw.

 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

Microsoft squashes Hotmail hijack bug
 
 
 
 
 
Top Stories
Who wins in the cloud price wars?
AWS, Google and Microsoft are slashing prices in a race to the bottom.
 
WhiteGold bought by billion-dollar French distributor
New regional powerhouse in security and networking.
 
HubOne kills the IT guy with $200 Office 365, Xero bundle
All-in-one cloud package for accounting firms.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Polls
Which mobile device couldn't you live without?


Latest Comments
CRN Magazine

Issue: 329 | July 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.