[117273] in Cypherpunks
Re: Hotmail Accounts Exposed to All
daemon@ATHENA.MIT.EDU (David Wagner)
Mon Aug 30 19:21:31 1999
To: cypherpunks@cyberpass.net
From: daw@cs.berkeley.edu (David Wagner)
Date: 30 Aug 1999 15:33:46 -0700
Message-ID: <7qf0sa$gum$1@blowfish.isaac.cs.berkeley.edu>
Reply-To: daw@cs.berkeley.edu (David Wagner)
Yes. Two other tidbits that I haven't seen reported yet:
1. If Hotmail had used a firewall, this should never have happened.
The media have been talking about the importance of firewalls
for years; what went wrong at Hotmail?
(Any competent security audit should also have picked this up.)
To me, this says that Hotmail's security policies appear to be
seriously screwed up, and that we should expect a real risk of
more holes in the future. Obviously, don't use Hotmail if you
want to keep your email private from hackers.
2. Hotmail was certified by the TRUSTe privacy program. I think
this really demonstrates the limitations of these privacy certification
programs -- if they will certify a site that has such obvious
security holes, if they will certify a site that isn't using a
firewall, if they will certify a site that exposes all their
user's email to outsiders, who won't they certify?
-- David
In article <199908301920.MAA23042@hardly.hotwired.com>,
James Glave <james@wired.com> wrote:
> See Also:
>
>
> http://www.wired.com/news/news/technology/story/21495.html
>
> Did MS Dig Its
> Hotmail Hole?
> by James Glave
>
> 12:05 p.m. 30.Aug.99.PDT
> The Hotmail
> security hole may have been an intentional backdoor that Microsoft built
> into its system for maintenance purposes, security experts said.
>
> Monday's exploit, which opened Hotmail accounts to any casual user,
> apparently took advantage of a hidden login script. The script may have
> been either old code left on the server by mistake, or long-forgotten
> script used for production purposes.
>
> ...snip
>
> At 07:25 PM 8/30/99 +0200, Anonymous wrote:
> >
> >Hotmail Accounts Exposed to
> > All
> > by Declan McCullagh
> >
> > 8:05 a.m. 30.Aug.99.PDT
> > A catastrophic security flaw in
> > Microsoft's Hotmail service lets
> > anyone read the private
> > correspondence of about 50
> > million subscribers.
> >
> > The bug appears to affect all
> > customers of what Microsoft says
> > is "the world's largest provider of
> > free Web-based email."
> >
> >
> > See also: 'A Flaw Worse Than
> > Melissa'
> >
> >
> > As of approximately 8:30 a.m.
> > Monday morning, Microsoft had
> > shut off its Hotmail service to
> > legitimate users. However, the
> > security exploit still worked by
> > accessing the alternative servers
> > whose Web address had been
> > widely posted throughout the
> > weekend.
> >
> > This effectively shut off the site
> > to all but the hackers. The move
> > also stopped legitimate users
> > from changing their passwords.
> >
> > A Swedish newspaper, Expressen
> > , reported the bug in its Monday
> > editions. The bug lets anyone log
> > into a Hotmail account without
> > typing a password.
> >
> > The exploit, verified by Wired
> > News, works this way: A Web
> > page with nine lines of HTML
> > code can connect to a Hotmail
> > server without requiring a user to
> > enter a password. By early
> > Monday, copies of those nine
> > lines of HTML source were
> > circulating widely around the Net
> > and mirrored on hacking-related
> > Web sites.
> >
> > "We know nothing about [the
> > individual who tipped us]. It was
> > anonymous," said Christian
> > Carrwik, one of two Expressen
> > reporters who broke the news. "It
> > has been circulating for a couple
> > of days."
> >
> > "The most interesting thing is
> > that Microsoft said it is working
> > on the problem, but they haven't
> > closed down Hotmail, or sent any
> > warning to their users," Carrwik
> > said. "The backdoor is still open
> > and more and more people are
> > discovering it."
> >
> > Expressen said Microsoft was
> > alerted very early Sunday
> > morning. The company could not
> > immediately be reached for
>
> > comment.
> >
> >snip
> >
> >http://www.wired.com/news/news/business/story/21490.html
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
> James Glave, News Editor, Wired News http://www.wired.com +1 (415) 276-8430
>
