[117262] in Cypherpunks
Re: Hotmail Accounts Exposed to All
daemon@ATHENA.MIT.EDU (James Glave)
Mon Aug 30 15:45:14 1999
Message-Id: <199908301920.MAA23042@hardly.hotwired.com>
Date: Mon, 30 Aug 1999 12:20:38 -0700
To: Anonymous <nobody@replay.com>
From: James Glave <james@wired.com>
Cc: cypherpunks@toad.com
In-Reply-To: <199908301725.TAA12227@mail.replay.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Reply-To: James Glave <james@wired.com>
See Also:
http://www.wired.com/news/news/technology/story/21495.html
Did MS Dig Its
Hotmail Hole?
by James Glave
12:05 p.m. 30.Aug.99.PDT
The Hotmail
security hole may have been an intentional backdoor that Microsoft built
into its system for maintenance purposes, security experts said.
Monday's exploit, which opened Hotmail accounts to any casual user,
apparently took advantage of a hidden login script. The script may have
been either old code left on the server by mistake, or long-forgotten
script used for production purposes.
...snip
At 07:25 PM 8/30/99 +0200, Anonymous wrote:
>
>Hotmail Accounts Exposed to
> All
> by Declan McCullagh
>
> 8:05 a.m. 30.Aug.99.PDT
> A catastrophic security flaw in
> Microsoft's Hotmail service lets
> anyone read the private
> correspondence of about 50
> million subscribers.
>
> The bug appears to affect all
> customers of what Microsoft says
> is "the world's largest provider of
> free Web-based email."
>
>
> See also: 'A Flaw Worse Than
> Melissa'
>
>
> As of approximately 8:30 a.m.
> Monday morning, Microsoft had
> shut off its Hotmail service to
> legitimate users. However, the
> security exploit still worked by
> accessing the alternative servers
> whose Web address had been
> widely posted throughout the
> weekend.
>
> This effectively shut off the site
> to all but the hackers. The move
> also stopped legitimate users
> from changing their passwords.
>
> A Swedish newspaper, Expressen
> , reported the bug in its Monday
> editions. The bug lets anyone log
> into a Hotmail account without
> typing a password.
>
> The exploit, verified by Wired
> News, works this way: A Web
> page with nine lines of HTML
> code can connect to a Hotmail
> server without requiring a user to
> enter a password. By early
> Monday, copies of those nine
> lines of HTML source were
> circulating widely around the Net
> and mirrored on hacking-related
> Web sites.
>
> "We know nothing about [the
> individual who tipped us]. It was
> anonymous," said Christian
> Carrwik, one of two Expressen
> reporters who broke the news. "It
> has been circulating for a couple
> of days."
>
> "The most interesting thing is
> that Microsoft said it is working
> on the problem, but they haven't
> closed down Hotmail, or sent any
> warning to their users," Carrwik
> said. "The backdoor is still open
> and more and more people are
> discovering it."
>
> Expressen said Microsoft was
> alerted very early Sunday
> morning. The company could not
> immediately be reached for
> comment.
>
>snip
>
>http://www.wired.com/news/news/business/story/21490.html
>
>
>
>
>
>
>
>
>
>
>
James Glave, News Editor, Wired News http://www.wired.com +1 (415) 276-8430
