Hotmail Hacked

SyD writes " Apparently there is a major security hole on Hotmail that could allow crackers to read your e-mail. A hacking group known as root core discovered the hole and reported it to Microsoft. " This isn't the first time that the folks who are gonna give us a internet wide universal login system had a hole. The funny part is that I posted a story almost exactly like this like 2 years ago, and about once a week, someone emails me and says "I think my boyfriend/girlfriend is cheating on me and I really need to know the backdoor into hotmail to find out". No I'm not kidding. You can't make that stuff up.

You've got mail!

AOL: You've got mail!
Hotmail: You've got someone else's mail!

Again?

Apparently there is a major security hole on Hotmail that could allow crackers to read your e-mail.

Score: -1, Redundant

So we might as well shut down Bugtraq...

This exploit information came straight from Root-Core's site and was also posted to Bugtraq. If pasting it here is potentially 'illegal' than so are 90% of Bugtraq posts.

Yes, perhaps one unfortunate day it will be illegal to explain security vulnerabilities in depth, but until then there's little wrong in supporting open disclosure. Security through obscurity doesn't work.

Accessories to a crime by having this post on Slashdot? Yep, you Must be a lawyer if you can come up with and rationalize arguments like that.

Re:Informative - More like criminal action actuall

"(pretty disclaimers aside you are legally responsible for the content here - its just that no one has decided to pursue it yet)"

This suit [findlaw.com] is the closest I've managed to dig up so far, but between Communications Privacy Decency Act (or somesuch) and DMCA, along with a prevailing broad interpretation of "service provider", most message boards such as AOL, etc., have been found to have no liability for what goes on. If that weren't the case, ezboards would've been toast a long time ago, and AOL would be fighting dozens of lawsuits a month. Do you have any examples of case law to back up your statement?

Here's another way

1. Log into hotmail normally.

2. Type in this link:

http://pv2fd.pav2.hotmail.msn.com/default.ida?XX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858
%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858 %u cbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u53
1b%u53ff%u0078%u0000%u00=a HTTP/1.0

Re:here's the instructions how to do it

I just can't believe you quote an entire email and don't give credit to the author. That's just plain wrong.

My guess is you are a karma whore, nothing more. Now I may be wrong, you might be the actual author. In this case, let us know.

/. sucks. FYI, the original foundings where from

Research by wAwAsAn4
[e-mail]
Web: www.root-core.com [root-core.com]
Email: [Digital-Vortex]@securityfocus.com [mailto]

Voila.

Average person?

• 
  "The average person in the street doesn't need to worry, as they would have to be specifically targeted," said Graham Cluley, an Internet security expert with antivirus firm Sophos.
  

I suppose the quux is whether I'm an "average person" or not. I think I'll go stand in the street to hedge my bets.

It's not quite so bad

You need to guess the message ID, a longish string based on a timestamp and another number. And once you do that, you still can't read other messages from that account unless you guess them separately. You could try brute-forcing the message IDs, of course, but then you're relying on a fast connection (I believe there are 60 possible message IDs per second, and you rarely know exactly when a message was processed anyway) and fast servers. Besides, after all this, you'll probably find that all the target account's real mail was automatically deleted to make room for WinXP.iso.bat, attached to a message asking for advice.

Re:It's not quite so bad

Exactly.

This isn't the "major" security hole that the slashdot submission suggested.

It would take a minor miracle to guess a message number correctly.

And considering what *I* use hotmail for, namely, a spam catcher, any hacker that got lucky enough would probably discover yet another way to get rich quick. If someone really wanted to read my email there, they could keep trying - but their hotmail username (at very least) would be recorded.

I don't mean to pooh-pooh this issue; but I think editorializing this into a *major* security problem (a la Code Red) is a little disingenuous, and misguided.

Re:It's not quite so bad

It would take a minor miracle to guess a message number correctly.

Actually... not... there is only 86400 seconds in a day and you need to worry about aprox first 100 messege numbers which makes it under ten million hits required to read your whole day correspondence. And the effectivity can be increased with clever algorithm so I will have most of them after first million.

In other words, a nice perl script that will take me about 1-2 hours to write will every day fetch all your mail without even making my computer sweat. :)

What kind of miracle is that? And shall I be proclaimed saint for performing such miracles?

The details of the hole...

% telnet www.hotmail.com 80
Trying 64.4.43.7...
Connected to 64.4.43.7.
Escape character is '^]'.
GET /root.exe
What is thy bidding, my master?

Guess they haven't gotten rid of Code Red yet! :-)

(For the humor impaired: no, I did not actually do the telnet session.)

Oh no

Now anyone can get in and read all the porn ads I get in my hotmail inbox.

Why is MS reaping the benifits of OSS security?

A monopoly is a scary thing.

Despite the fact that MS beleives very firmly in a security through obscurity model of business, they have both benevolent and malcious hackers and crackers world wide working to expose as many of their security holes as possible, thereby forcing MS to patch those holes. Code Red would still be unpatched if eEye hadn't released it's exploit POC. This exploit would still be out in the open and freely abuseable if it hadn't been released.

Since MS is the 'standard' for most internet users, it's also the recipient of all the world's security unsolicited security advice.

Big Surprise - More info...

blah blah, we expect this from MS... blah blah, when will they get their act together...

This was already posted to BugTraq [securityfocus.com] not too long ago. For a more technical breakdown of the details surrounding the Hotmail vulnerability, go here:

http://www.securityfocus.com/archive/1/205785 [securityfocus.com]

Microsoft's response...

...is priceless:

"However," Microsoft said, "we recognize the concerns raised in the computational infeasibility of this mechanism and are investigating ways that we can raise this bar even higher."

Like Taco said...you just can't make this stuff up. That response is just too funny.

Re:Microsoft's response...

That's it. We can quit MS bashing, people. They do a better job of it on their own anyway. ;)

Re:'Found it' ?

If you don't tell anyone, the flaw is still there. Only, if you don't tell anyone about the flaw, only the bad guys know about it. The piece below written in 1853 by Charles Tomlinson, and is only an excerpt of the the treatise, but it shows that people recognized that 'security' through thwarting the exchange of knowledge of flaws was not really security at all, waaaay before the digital age.

Rudimentary Treatise on the Construction of Locks

A commercial, and in some respects a social, doubt has been started within the last year or two, whether or not it is right to discuss so openly the security or insecurity of locks. Many well-meaning persons suppose that the discussion respecting the means for baffling the supposed safety of locks offers a premium for dishonesty, by showing others how to be dishonest. This is a fallacy. Rogues are very keen in their profession, and already know much more than we can teach them respecting their several kinds of roguery. Rogues knew a good deal about lockpicking long before locksmiths discussed it among themselves, as they have lately done. If a lock -- let it have been made in whatever country, or by whatever maker -- is not so inviolable as it has hitherto been deemed to be, surely it is in the interest of honest persons to know this fact, because the dishonest are tolerably certain to be the first to apply the knowledge practically; and the spread of knowledge is necessary to give fair play to those who might suffer by ignorance. It cannot be too earnestly urged, that an acquintance with real facts will, in the end, be better for all parties.

Some time ago, when the reading public was alarmed at being told how London milk is adulterated, timid persons deprecated the exposure, on the plea that it would give instructions in the art of adulterating milk; a vain fear -- milkmen knew all about it before, whether they practiced it or not; and the exposure only taught purchasers the necessity of a little scrutiny and caution, leaving them to obey this necessity or not, as they pleased.

...The unscrupulous have the command of much of this kind of knowledge without our aid; and there is moral and commercial justice in placing on their guard those who might possibly suffer therefrom. We employ these stray expressions concerning adulteration, debasement, roguery, and so forth, simply as a mode of illustrating a principle -- the advantage of publicity. In respect to lock-making, there can scarcely be such a thing as dishonesty of intention: the inventor produces a lock which he honestly thinks will posess such and such qualities; and he declares his belief to the world. If others differ from him in opinion concerning those qualities, it is open to them to say so; and the discussion, truthfully conducted, must lead to public advantage: the discussion stimulates curiosity, and curiosity stimulates invention. Nothing but a partial and limited view of the question could lead to the opinion that harm can result: if there be harm, it will be much more than counterbalanced by good.

"Limited Scope"

Why does the media try to convince people that a "fast internet connection" is a limiting factor? It seems to me that many of the people who are script kiddies, or l33 d00z, or whatever, are people have some form of broadband. That's like saying "well cars are only dangerous if you drive a Porsche."

Oh crap!

Thanks to Hotmail there are going to be a number of people out there now using my name to get valuable college degrees over the `net.

Hopefully they'll be good sports and also get me a lower interest rate on my home.

Very secret information....

I know that /. will probably get a nasty email asking them to remove this post, but I just feel the need to post this bit of information:

NOTE: By following these directions you will be breaking the law.


while (in_car(use *right_foot))\
push(($pedal) to go [@REALLY_FAST]);

I have had this information in my head for years, but felt it was time to inform the rest of you how to do it. Now I know I will be pursued by lawyers attempting to utilize the DMCA against me for revealing this information that the vehicle manufacturers did not want you to know... such is the life of a hacker...

Let me get this straight...

I've authenticated with a username and password, yet the username is also being passed in the GET string? And no check is being done to compare the username in the GET string is the same as the username associated with my session ID? Why is doing that simple comparison so hard? It would certainly "raise the bar" even higher on the "infeasible computational" chances of this happening.

This is similar to the Ameritech ebill security hole: no checking of user authentication - just GET any billing information with a *SEQUENTIAL* session ID in the GET string.

If this is an example of the authentication they've planned for Hailstorm services, I think many more people may have second thoughts about quick adoption.

Is it still open?

I'm not one of those people who starts gloating every time a Windows vulnerability appears, claiming it proves how awful Microsoft development is and how clearly inferior their products are to free alternatives. (How many holes in wu-ftpd do you need before that rings empty?)

But to me, the most astounding betrayal of computer security ever was Microsoft's conduct during the last Hotmail breach. Not that it happened (could happen to anyone) or even that they didn't pull the plug days until days after the exploit was made public but that they kept going for hours after everyone had the URL for the backdoor.

There was a great Salon article [salon.com] by a woman who heard about the breach on CNN, found the URL here and read her ex's new girlfriend's mail. I love the conclusion:

Late Monday, Microsoft continued to downplay the Hotmail hack in a statement published by Reuters: "We're hoping that because we jumped on it so quickly no one was affected."

Fat chance.

I wonder if this time will be different...

Ugly VB Code... yeechhh

you can download the hobo4 program, written by the folks at Root Core to automate this vulnerability here [64.23.55.50]. Warning about the code however:

a) it's in VB

b) you'll see methods like this:

Public Sub ii(MSG As String)

l_info.Caption = ">" & MSG

End Sub

are there no coding standards even among hacks?

"hacker" vs. "cracker": something to consider.

Does anyone else think that "crackers can read your email" is something Chef from South Park would say?

CHEF: Now, children, don't leave your computer on when you're not around! Crazy crackers can read your email!

STAN: Holy crap!

CARTMAN: You guys are so lame.

- A.P.

Now you can be a hacker too

Just read this l33t article [tuxedo.org] on "How To Become a Hacker", and you'll be hacking into people's mail before you know it!

Step-by-step hacking tutorial

The Register [theregister.co.uk] has a nice guide that explains exactly how you can exploit the hack. [theregister.co.uk]

For script kiddies who don't want to be bothered with the detailes, there's even a Windows program [can-host.com] that automates the process.