Feeds

10,000 Hotmail passwords mysteriously leaked to web

Phishing booty free for taking

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Updated Login credentials for more than 10,000 Microsoft Live accounts have been posted to the internet, most likely by miscreants who found them or harvested them in a phishing attack.

In all, there were 10,028 pairs of user names and passwords posted to multiple pages of public upload website Pastebin.com, some of which remained live at time of writing. The stash is likely only a small sample of a much larger haul, since the alphabetical list begins with the user name ararat973@hoymail.com and concludes with blando2713@hotmail.com.

The discovery coincided with unsubstantiated posts that claimed passwords for all Windows Live accounts had been leaked. That seemed highly unlikely. If one assumed there were 5,500 accounts beginning with each letter of the alphabet - a crude estimate based on the sample - that would come to just 143,000 compromised accounts total. That's a tiny fraction of the 450 million or so total Windows Live accounts out there.

The leak is most likely the result of miscreants who harvested the passwords using keystroke-logging trojans or phishing scams. A Microsoft spokeswoman confirmed that the company doesn't store passwords in the clear and said its security team has been investigating the leak since this weekend.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers," she wrote in an email. "As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts."

A quick web search reveals a wide variety of active campaigns to steal hotmail login credentials. One of them, documented here on the NirSoft.net blog, is dubbed the msn-blocked.com scam and is named after one of the early domain names used to hoodwink users into revealing their hotmail password. Over the past few months, the people behind it have repeatedly changed the domain names used in the scam and have also added support for multiple languages. The sites promise to send invitations to all a victims' contacts.

No doubt, other password-stealing scams abound. The question is how the details, which normally are kept under wraps by the people who worked so hard to filch them, managed to go public. One theory is they were inadvertently published when they were stored on a server that was visible to search engine spiders and then republished on Pastebin. Or the miscreants may have decided to share them with world + dog out of twisted sense of altruism.

While one of the pages containing the credentials was published on October 1, Google caches show the same details published almost a week earlier. The list has been the topic of conversation on several online forums, with some participants making the unconfirmed claim that all accounts were breached.

The appropriation of a web-based email account can often lead to much bigger compromises because many people tie online accounts for banks and e-commerce sites to their addresses. Those who have any doubt about the security of their Windows Live addresses ought to change their passwords immediately out of an abundance of caution. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.