Feeds

10,000 Hotmail passwords mysteriously leaked to web

Phishing booty free for taking

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Updated Login credentials for more than 10,000 Microsoft Live accounts have been posted to the internet, most likely by miscreants who found them or harvested them in a phishing attack.

In all, there were 10,028 pairs of user names and passwords posted to multiple pages of public upload website Pastebin.com, some of which remained live at time of writing. The stash is likely only a small sample of a much larger haul, since the alphabetical list begins with the user name ararat973@hoymail.com and concludes with blando2713@hotmail.com.

The discovery coincided with unsubstantiated posts that claimed passwords for all Windows Live accounts had been leaked. That seemed highly unlikely. If one assumed there were 5,500 accounts beginning with each letter of the alphabet - a crude estimate based on the sample - that would come to just 143,000 compromised accounts total. That's a tiny fraction of the 450 million or so total Windows Live accounts out there.

The leak is most likely the result of miscreants who harvested the passwords using keystroke-logging trojans or phishing scams. A Microsoft spokeswoman confirmed that the company doesn't store passwords in the clear and said its security team has been investigating the leak since this weekend.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers," she wrote in an email. "As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts."

A quick web search reveals a wide variety of active campaigns to steal hotmail login credentials. One of them, documented here on the NirSoft.net blog, is dubbed the msn-blocked.com scam and is named after one of the early domain names used to hoodwink users into revealing their hotmail password. Over the past few months, the people behind it have repeatedly changed the domain names used in the scam and have also added support for multiple languages. The sites promise to send invitations to all a victims' contacts.

No doubt, other password-stealing scams abound. The question is how the details, which normally are kept under wraps by the people who worked so hard to filch them, managed to go public. One theory is they were inadvertently published when they were stored on a server that was visible to search engine spiders and then republished on Pastebin. Or the miscreants may have decided to share them with world + dog out of twisted sense of altruism.

While one of the pages containing the credentials was published on October 1, Google caches show the same details published almost a week earlier. The list has been the topic of conversation on several online forums, with some participants making the unconfirmed claim that all accounts were breached.

The appropriation of a web-based email account can often lead to much bigger compromises because many people tie online accounts for banks and e-commerce sites to their addresses. Those who have any doubt about the security of their Windows Live addresses ought to change their passwords immediately out of an abundance of caution. ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.