[117309] in Cypherpunks
Re: Hotmail Accounts Exposed to All
daemon@ATHENA.MIT.EDU (Adam Shostack)
Tue Aug 31 10:32:55 1999
Date: Tue, 31 Aug 1999 10:31:55 -0400
From: Adam Shostack <adam@homeport.org>
To: David Wagner <daw@cs.berkeley.edu>
Cc: cypherpunks@cyberpass.net
Message-ID: <19990831103154.A426@weathership.homeport.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <7qf0sa$gum$1@blowfish.isaac.cs.berkeley.edu>; from David Wagner on Mon, Aug 30, 1999 at 03:33:46PM -0700
Reply-To: Adam Shostack <adam@homeport.org>
On Mon, Aug 30, 1999 at 03:33:46PM -0700, David Wagner wrote:
| Yes. Two other tidbits that I haven't seen reported yet:
| 1. If Hotmail had used a firewall, this should never have happened.
| The media have been talking about the importance of firewalls
| for years; what went wrong at Hotmail?
| (Any competent security audit should also have picked this up.)
| To me, this says that Hotmail's security policies appear to be
| seriously screwed up, and that we should expect a real risk of
| more holes in the future. Obviously, don't use Hotmail if you
| want to keep your email private from hackers.
"If Johnny had gone straight to the police, this never would
have happened." Sorry, but I disagree with the usefulness of a
firewall here. Code auditing was the missing piece. A good firewall
would have stopped requests that were not valid HTTP requests. These
queries were valid. A very good firewall might have stopped requests
that were too long. These were not. A very good firewall might stop
requests that include "egg" code for a buffer overflow. This did
not. To ask a firewall to stop this particular attack would be
unreasonable.
However, you're right about an audit catching this.
Regardless of if an audit caught the error in code, there are at least
two things it should have brought to light. The first is a failure to
audit the code installed in the firewall for correctness. There may
also be design failures that should have been caught before the CGI
was written. The second failure that should have been caught was that
their logs were apparently not being audited with a screen. I could
write a set of perl regexps in about a day that would cover all
'expected' use of the system. Any web request that doesn't match
those regexps should flow through to an audit system for examination.
| 2. Hotmail was certified by the TRUSTe privacy program. I think
| this really demonstrates the limitations of these privacy certification
| programs -- if they will certify a site that has such obvious
| security holes, if they will certify a site that isn't using a
| firewall, if they will certify a site that exposes all their
| user's email to outsiders, who won't they certify?
Unfortunately, no program I'm aware of requres adherence to
the certifier's privacy statement; all anyone is certifying is the
Fair Information Practices Disclosure, and generally, only as it
applies to the web site. Consumer Reports or the EFF ought to write
policies that anyone can use, and then the certifiers should certify
compliance with those. Generally, when a business writes a privacy
policy, they throw in three words of truth, and a dozen pages of
weasling. The net result of the weasling is that anyone can be a
certified weasel.
Adam
| -- David
|
| In article <199908301920.MAA23042@hardly.hotwired.com>,
| James Glave <james@wired.com> wrote:
| > See Also:
| >
| >
| > http://www.wired.com/news/news/technology/story/21495.html
| >
| > Did MS Dig Its
| > Hotmail Hole?
| > by James Glave
| >
| > 12:05 p.m. 30.Aug.99.PDT
| > The Hotmail
| > security hole may have been an intentional backdoor that Microsoft built
| > into its system for maintenance purposes, security experts said.
| >
| > Monday's exploit, which opened Hotmail accounts to any casual user,
| > apparently took advantage of a hidden login script. The script may have
| > been either old code left on the server by mistake, or long-forgotten
| > script used for production purposes.
| >
| > ...snip
| >
| > At 07:25 PM 8/30/99 +0200, Anonymous wrote:
| > >
| > >Hotmail Accounts Exposed to
| > > All
| > > by Declan McCullagh
| > >
| > > 8:05 a.m. 30.Aug.99.PDT
| > > A catastrophic security flaw in
| > > Microsoft's Hotmail service lets
| > > anyone read the private
| > > correspondence of about 50
| > > million subscribers.
| > >
| > > The bug appears to affect all
| > > customers of what Microsoft says
| > > is "the world's largest provider of
| > > free Web-based email."
| > >
| > >
| > > See also: 'A Flaw Worse Than
| > > Melissa'
| > >
| > >
| > > As of approximately 8:30 a.m.
| > > Monday morning, Microsoft had
| > > shut off its Hotmail service to
| > > legitimate users. However, the
| > > security exploit still worked by
| > > accessing the alternative servers
| > > whose Web address had been
| > > widely posted throughout the
| > > weekend.
| > >
| > > This effectively shut off the site
| > > to all but the hackers. The move
| > > also stopped legitimate users
| > > from changing their passwords.
| > >
| > > A Swedish newspaper, Expressen
| > > , reported the bug in its Monday
| > > editions. The bug lets anyone log
| > > into a Hotmail account without
| > > typing a password.
| > >
| > > The exploit, verified by Wired
| > > News, works this way: A Web
| > > page with nine lines of HTML
| > > code can connect to a Hotmail
| > > server without requiring a user to
| > > enter a password. By early
| > > Monday, copies of those nine
| > > lines of HTML source were
| > > circulating widely around the Net
| > > and mirrored on hacking-related
| > > Web sites.
| > >
| > > "We know nothing about [the
| > > individual who tipped us]. It was
| > > anonymous," said Christian
| > > Carrwik, one of two Expressen
| > > reporters who broke the news. "It
| > > has been circulating for a couple
| > > of days."
| > >
| > > "The most interesting thing is
| > > that Microsoft said it is working
| > > on the problem, but they haven't
| > > closed down Hotmail, or sent any
| > > warning to their users," Carrwik
| > > said. "The backdoor is still open
| > > and more and more people are
| > > discovering it."
| > >
| > > Expressen said Microsoft was
| > > alerted very early Sunday
| > > morning. The company could not
| > > immediately be reached for
| >
| > > comment.
| > >
| > >snip
| > >
| > >http://www.wired.com/news/news/business/story/21490.html
| > >
| > >
| > >
| > >
| > >
| > >
| > >
| > >
| > >
| > >
| > >
| >
| > James Glave, News Editor, Wired News http://www.wired.com +1 (415) 276-8430
| >
|
--
"It is seldom that liberty of any kind is lost all at once."
-Hume
