Feeds

10,000 Hotmail passwords mysteriously leaked to web

Phishing booty free for taking

  • alert
  • submit to reddit

Using blade systems to cut costs and sharpen efficiencies

Updated Login credentials for more than 10,000 Microsoft Live accounts have been posted to the internet, most likely by miscreants who found them or harvested them in a phishing attack.

In all, there were 10,028 pairs of user names and passwords posted to multiple pages of public upload website Pastebin.com, some of which remained live at time of writing. The stash is likely only a small sample of a much larger haul, since the alphabetical list begins with the user name ararat973@hoymail.com and concludes with blando2713@hotmail.com.

The discovery coincided with unsubstantiated posts that claimed passwords for all Windows Live accounts had been leaked. That seemed highly unlikely. If one assumed there were 5,500 accounts beginning with each letter of the alphabet - a crude estimate based on the sample - that would come to just 143,000 compromised accounts total. That's a tiny fraction of the 450 million or so total Windows Live accounts out there.

The leak is most likely the result of miscreants who harvested the passwords using keystroke-logging trojans or phishing scams. A Microsoft spokeswoman confirmed that the company doesn't store passwords in the clear and said its security team has been investigating the leak since this weekend.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers," she wrote in an email. "As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts."

A quick web search reveals a wide variety of active campaigns to steal hotmail login credentials. One of them, documented here on the NirSoft.net blog, is dubbed the msn-blocked.com scam and is named after one of the early domain names used to hoodwink users into revealing their hotmail password. Over the past few months, the people behind it have repeatedly changed the domain names used in the scam and have also added support for multiple languages. The sites promise to send invitations to all a victims' contacts.

No doubt, other password-stealing scams abound. The question is how the details, which normally are kept under wraps by the people who worked so hard to filch them, managed to go public. One theory is they were inadvertently published when they were stored on a server that was visible to search engine spiders and then republished on Pastebin. Or the miscreants may have decided to share them with world + dog out of twisted sense of altruism.

While one of the pages containing the credentials was published on October 1, Google caches show the same details published almost a week earlier. The list has been the topic of conversation on several online forums, with some participants making the unconfirmed claim that all accounts were breached.

The appropriation of a web-based email account can often lead to much bigger compromises because many people tie online accounts for banks and e-commerce sites to their addresses. Those who have any doubt about the security of their Windows Live addresses ought to change their passwords immediately out of an abundance of caution. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.