Feeds

MS Passport cracked with Hotmail

One-stop hacking

  • alert
  • submit to reddit

Intelligent flash storage arrays

Passport and Wallet users are going to be disappointed to learn that these feature-rich tools can't be used until MS fixes a little bug which makes sport of taking over someone else's account.

Passport authenticates a user for access to his credit cards and Web site accounts and passwords, to make life easy for on-line merchants and shoppers, and hackers and identity thieves.

The flaw was discovered by Seattle researcher Marc Slemko, who devised a Hotmail exploit which enables an attacker to use a malicious e-mail to obtain the victim's entire on-line shopping kit, and take any action the owner can take.

Briefly, the exploit involves stealing session cookies used to authenticate users to the Passport server and other sites which support Passport, and impersonating the victim.

"If, for example, a user enters their password to sign in to Hotmail, they are then allowed access to their Passport Wallet without further authentication for the next 15 minutes! So if someone logs into Hotmail then reads an e-mail sent to them that uses one of a variety of attacks to steal their Passport cookies, that attacker has then effectively stolen that user's Passport Wallet, without the user ever knowing," Slemko explains.

Step-by-step instructions for doing just that are laid out on Slemko's Web site here. It is definitely not as difficult as it should be. ®

Beginner's guide to SSL certificates

More from The Register

next story
Nexus 7 fandroids tell of salty taste after sucking on Google's Lollipop
Web giant looking into why version 5.0 of Android is crippling older slabs
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
SLURP! Flick your TONGUE around our LOLLIPOP – Google
Android 5 is coming – IF you're lucky enough to have the right gadget
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.