Feeds

Hacking Hotmail made easy

Hurry, before they close the hole

  • alert
  • submit to reddit

Remote control for virtualized desktops

Some bright empiricist from Root-Core has discovered that anyone can log into their Hotmail account and then call messages from any other Hotmail account by crafting a URL with the second account's username and a valid message number.

Finding a valid message number is of course total guesswork, but they all follow a consistent format and always have the same number of digits (i.e., a time stamp), so with the help of a little brute-force progie one can try numerous combinations in the background rather than type them in.

The basic URL for an attack looks like this:

http://pv2fd.pav2.hotmail.msn.com/cgi-bin/saferd? _lang=EN&hm___tg=http%3a%2f%2f64%2e4%2e36%2e250%2fcgi%2dbin%2fgetmsg&hm___qs=%26msg%3dMSGXXXXXXXXX% 2e(X)X%26start%3d1%26len%3d99999999999%26login% 3dUSERNAME%26domain%3dhotmail%2ecom

where USERNAME is the account name, XXXXXXXXX is a nine-digit message number, and (X)X is a second number between zero and (I think) fifty-nine.

(I've inserted spaces in the URL so the page here doesn't grow a mile wide, so be sure to remove them before you play with it.)

Now, let's say you have a Hotmail account called r00tarded@hotmail.com. Just log in, click on any message in your inbox, and then look at the URL. You'll see something like this:

http://lw2fd.hotmail.msn.com/cgi-bin/getmsg? curmbox=F000000001&a=5691b2b44e104176111971aa0fbb1274&m sg=MSG998000947.3&start=197078&len=1060&msgread=1&mfs=182

Copy the URL and log out. Now, log into another of your Hotmail accounts, and commence to play.

The message number for the item you viewed in your r00tarded account is MSG998000947.3 and it needs to be inserted in the attack URL along with the username thus:

http://pv2fd.pav2.hotmail.msn.com/cgi-bin/saferd? _lang=EN&hm___tg=http%3a%2f%2f64%2e4%2e36%2e250%2fcgi% 2dbin%2fgetmsg&hm___qs=%26msg%3dMSG998000947% 2e3%26start%3d1%26len%3d99999999999%26login% 3dr00tarded%26domain%3dhotmail%2ecom

It's necessary that you be logged into another (any other) Hotmail account. Now copy in the attack URL, click 'go' and voila.

You can only read messages; the button links on the page don't work; they'll bounce you back to the account you're working from. But it is a nifty trick, and it is proof of a major hole in Hotmail security.

The hacking danger here is very much limited by the need to guess message numbers, which is slow going. And while there is a handy program for bruting the numbers it's quite slow, trying only about one message page per second in 'fast' mode.

It has a GUI but remains a bit clunky, and also needs to be paused after it brings up the Hotmail login page so you can enter a valid username and password. After two unsuccessful attempts, I got it to work as advertised. It's more a proof-of-concept exercise than a cracking tool -- so enjoy it as such.

And please, I beg you, don't contact me for tech support. I've nothing to do with it. It works; it does take a bit of tweaking; so just give it a whirl and be playful. ®

Internet Security Threat Report 2014

More from The Register

next story
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.