Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation

Soulskill posted more than 2 years ago | from the barn-doors-and-horses dept.

Bug 88

suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."

Sorry! There are no comments related to the filter you selected.

Ouch (5, Funny)

symbolset (646467) | more than 2 years ago | (#39820489)

It's a good thing they've gotten so committed to security, hired so many competent folks. Otherwise stuff like this might happen over and over. I'm glad this one security vulnerability in Hotmail is now completely repaired. I'll sleep better at night.

Re:Ouch (5, Funny)

Sarten-X (1102295) | more than 2 years ago | (#39820511)

I sleep well enough at night myself... I don't use Hotmail.

Re:Ouch (5, Funny)

Anonymous Coward | more than 2 years ago | (#39823183)

Yeah I prefer hot females instead.

Re:Ouch (4, Funny)

bhcompy (1877290) | more than 2 years ago | (#39820599)

I use Windows Live mail, so I'm completely safe.

Re:Ouch (0)

firex726 (1188453) | more than 2 years ago | (#39820795)

Would you rather MS not even have a security team, and ignore issues like this till it started getting widespread attention and calling into question their marketing efforts?

Re:Ouch (0)

Anonymous Coward | more than 2 years ago | (#39821331)

No. Why do you ask?

Re:Ouch (3, Insightful)

lister king of smeg (2481612) | more than 2 years ago | (#39821549)

you mean pull an apple

Re:Ouch (4, Insightful)

Richard_at_work (517087) | more than 2 years ago | (#39820931)

Im guessing that, with that attitude, you are posting that comment using nothing but some wires, a battery and a fucking good knowledge of the tcp/ip protocol?

Every system ever built has the potential for issues, and the vast vast majority of systems have actually had issues - whatever you are using right now is not an exception.

Re:Ouch (1)

LordLimecat (1103839) | more than 2 years ago | (#39821395)

Batteries are vulnerable to buffer overflows, you know.

(For certain definitions of "buffer" and "overflow")

Re:Ouch (2)

X0563511 (793323) | more than 2 years ago | (#39822239)

What's that burning smell?


Re:Ouch (1)

NotBorg (829820) | more than 2 years ago | (#39822691)

Every system ever built has the potential for issues

Every system potentially has flaws but some vendors historically have had more exploits over time than others. Just because every system has flaws doesn't mean that the severity of the flaws can't be mitigated. Some vendors are in fact better at it than others.

Stop throwing your hands in the air as if to say that there's nothing anyone can do.

Example and history lesson: Windows 7 is more secure than XP even though all the while XP was popular everyone said there was nothing MS could do. Well, apparently, they did "nothing" and 7 is just coincidently more secure? Or was it just designed better and tested more? Or is 7 just as insecure as XP? See, you can't say that Microsoft improved security without reneging on the "their's nothing they can do" apologetics.

And it's not just Microsoft (They're just handy at the moment). This same bullshit line of apologetics pops up every time there's a wide spread exploit of a popular product. It's akin to saying that since you can't prevent 100% of fatal car accidents, seat belts are pointless.

Re:Ouch (0)

Richard_at_work (517087) | more than 2 years ago | (#39823049)

Do you not remember Microsoft Windows XP Service Pack 2? The one which caused huge outcries of "my thing just stopped working?!" and caused a lot of software vendors to have to fix their broken applications, because Microsoft fixed a whole ream of issues with the Windows code base?

That was caused by the original outcries over continuous exploits and issues.

Microsoft did something. And I don't recall there ever being a large contingent of people claiming "theres nothing they can do".

Re:Ouch (1)

NotBorg (829820) | more than 2 years ago | (#39823289)

I don't recall there ever being a large contingent of people claiming "theres nothing they can do".

What's the point in bringing up that all software has flaws if not to imply that there's nothing that can be done? What's the point in saying that MS has the biggest market share (and therefore the most targeted) if not to imply that there's nothing that can be done?

Re:Ouch (1)

symbolset (646467) | more than 2 years ago | (#39829243)

I'm going to leave this one alone from now on. Coming from this viewpoint Richard's probably heard enough about Microsoft's security problems to last a lifetime.

Re:Ouch (1)

symbolset (646467) | more than 2 years ago | (#39829219)

I probably could pull that off sometime before Microsoft manages to make Hotmail secure enough to be useful.

Re:Ouch (1)

symbolset (646467) | more than 2 years ago | (#39829813)

This is your way of saying there is no hope for a thorough Hotmail security audit, even in the light of two rookie flaws making the news in a few days. Because we should just expect Hotmail to be insecure even at this level of unprofessionalism. Thanks for that. I'm really looking forward to the festival of fun that Live integration with W8 will bring.

Re:Ouch (0)

Anonymous Coward | more than 2 years ago | (#39829117)

Shouldn't Microsoft report Vulnerabilities Lab to DHA as a terrorist organization for their activities t

We built it, Microsoft fucked it up. (-1, Troll)

I'm just joshin (633449) | more than 2 years ago | (#39820527)



PcPro (4, Insightful)

gbjbaanb (229885) | more than 2 years ago | (#39820547)

and to think of all the people who claimed that there was nothing wrong with Hotmail security and the PCPro chap who switched to Hotmail over Google must have had his password hacked by an alternative site.....

oh well, I'm sure this is just a coincidence, right.

Re:PcPro (2, Funny)

binarylarry (1338699) | more than 2 years ago | (#39820569)

Where's TechOK/TechFL/Bonch/etc when you need him, eh?

Re:PcPro (0)

Anonymous Coward | more than 2 years ago | (#39821009)

He's now TechNY, and you can find his latest shill here [] . Some of the responses to the shill are good, though.

Re:PcPro (1)

Anonymous Coward | more than 2 years ago | (#39820585)

The PCPro guy's password was not changed, correct? My understanding from the story was that someone somehow got his password; this exploit should allow someone to change it.

Re:PcPro (1)

adonoman (624929) | more than 2 years ago | (#39820987)

This would *require* someone to change it, to work.

Re:PcPro (-1, Flamebait)

Richard_at_work (517087) | more than 2 years ago | (#39821011)

Yup, because its not as if a Gmail account has ever been hacked ;)

Oh no, two "pro MS" comments in one story, I must be a shill!

Re:PcPro (0)

Anonymous Coward | more than 2 years ago | (#39823465)

It's actually a lot worse than that. Google was pwn3d by the Chinese government and Tavis Ormandy, asshole at work, was completely clueless about it for several months.

Looking for a software engineer position in Atlanta. Sundar Pichai's incompetence resulted in me losing my job.

Re:PcPro (1)

symbolset (646467) | more than 2 years ago | (#39829253)

They've banished Windows from their network, so Google doesn't have that problem any more.

Re:PcPro (4, Insightful)

Jaktar (975138) | more than 2 years ago | (#39821609)

Well, since the PCpro guy logged right back in to his email, however it was compromised it wasn't with the password reset token.

If it had been the password reset token, they wouldn't know his original password, they'd have changed it to something that only the hacker would know and he wouldn't have been able to log back in like he did.

So yes, it was a coincidence and/or another unknown hack.

Re:PcPro (2)

ArsenneLupin (766289) | more than 2 years ago | (#39822051)

So yes, it was a coincidence and/or another unknown hack.

Not necessarily so... The following scenario could have happened:

  1. Attacker resets PCpro guy's password using this vulnerability
  2. Attacker rifles through PCpro guy's mails...
  3. ... and find a confirmation mail from another site, containing the password to that site (yes, some sites unfortunately do this...)
  4. On a hunch, and in order to stay discrete, attackers sets hotmail password "back" to the password found in that confirmation mail

Re:PcPro (2)

tbannist (230135) | more than 2 years ago | (#39822417)

Even more likely the PCpro guy reset his password and simply didn't mention that step.

Hotmail Challenge (5, Informative)

Rik Sweeney (471717) | more than 2 years ago | (#39820561)

Looks like PC Pro's Barry Collins weak password [] wasn't ultimately a problem.

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39820733)

Yeah, I guess I shouldn't have dissed him for that as the source of the problem. But my scolding over Hotmail LETTING him use such a weak password still stands. That does not inspire confidence even though the source of the problem seems to be yet another security issue.

Re:Hotmail Challenge (1)

SJHillman (1966756) | more than 2 years ago | (#39821065)

You're one of those people that thinks cars should all be limited to 65mph and ISPs should block all websites they find distasteful, aren't you?

Re:Hotmail Challenge (1)

Isaac Remuant (1891806) | more than 2 years ago | (#39821327)

He is right though. 7 words, all lowercase is to be frowned upon when you're allegedly knowledgeable about technology.

Re:Hotmail Challenge (1)

Anonymous Coward | more than 2 years ago | (#39822047)

7 letters, 7 words would have been a fairly strong password, even if it was all lowercase.

Re:Hotmail Challenge (2)

isorox (205688) | more than 2 years ago | (#39822369)

7 letters, 7 words would have been a fairly strong password, even if it was all lowercase.

Assuming that a hacker knew it was 7 lowercase letters, and they were random, that's 26^7
That's more secure than 5 random characters from the about 72 upper/lower/numeric/symbols

Now I believe his password was actualy xxx, giving about 2000*26*26*26 combinations, only as secure as a 4 random character password, however unless someone had access to hotmail's hashes, it doesn't matter.

Most backs have a password of 4 numbers. That's 10,000 combinations, it's barely more secure than a 2 symbol password! However those banks lock you out after 3 failed attempts, you won't be brute forcing that. I'd hope things like hotmail would do something similar -- maximum of 5 login attempts in 5 minutes for example, and an email to your account whenever you get a wrong password.

Re:Hotmail Challenge (1)

Isaac Remuant (1891806) | more than 2 years ago | (#39825579)

you're right. I mixed that up.

Re:Hotmail Challenge (1)

vakuona (788200) | more than 2 years ago | (#39824663)

How do you run through 26^7 possible password combinations on an online service?

Unless Microsoft lost the password hash database, it should be impossible to brute force a 7 letter password.

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39824911)

And maybe they didn't need to bruteforce that pass.

There's not enough details to decide anything in this case. Maybe that was some hole in Hotmail (which makes it a second one, as the one from TFA doesn't work like this), or maybe he had a trojan on his PC, or maybe he logged into Hotmail over plain HTTP (not sure if hotmail allows this) on unsecure WiFi and got his pass sniffed, or maybe he used same password on some other site which didn't hash passwords and had his hotmail linked. Just not enough data in yesterday's article.

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39823359)

Heck, no. But I guess whether you think it is good security practice would depend whether you think the internet is the equivalent of a quaint little village where it's okay to leave your door unlocked at night, or whether you think it's a wretched hive of scum and villainy that shouldn't be trusted in the least. I'm not sure I'd trust my e-mail to someone who thought the internet was the former.

Re:Hotmail Challenge (1)

SJHillman (1966756) | more than 2 years ago | (#39823713)

I'm from the place where people are responsible for locking their own doors, not relying on a building inspector coming around to make sure all of the locks are working properly.

Re:Hotmail Challenge (4, Informative)

Anonymous Coward | more than 2 years ago | (#39820891)

Check out comment 143 from Barry's original PCPro article []

Barry Collins Says:
April 27th, 2012 at 11:10 am
I consider myself suitably and rightfully admonished, Mr Winder. However, I don’t think I did fall victim to the zero-day exploit, as that would have required the hackers to reset the password. I was still able to access my account after it was hacked.

Barry Collins

Barry believes this was not the cause to his account being breached. Sounds like the fault may still be on his password choice.

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39821255)

The trick is that the hacker actually reset it to his own password, not knowing he'd be dumb enough to use "hunter32" as his actual password.

Re:Hotmail Challenge (2)

fxbar (2627205) | more than 2 years ago | (#39821429)

I think this once more shows how amateurish software is developed at microsoft**. So I would bet some money that there is a second 0-day flaw that is used which does not require to change the password of the user. I don't believe that this password was brute forced, because even microsoft should (now) be able to prevent brute forcing. Or are they not even able to achieve that? Because his account was new it means that many attempts to brute force would have been done in a short period of time, any reasonable system today prevents that...

**I have a little experience with microsoft because we had to support IE in a project. But how IE handles private keys on smart cards is not secure at all (all sessions stay active even card is removed, which was a absolute no-go in this project). Answer from microsoft after needing weeks (and much communication overhead) to confirm the flaw: it will not be fixed before IE 11.

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39821271)

Given that he was still able to log into his account using his old password, it is very unlikely that this exploit was used, since it requires changing the password to work. The chances of an attacker resetting Barry's password to exactly what it was before, without prior knowledge that would sort of make using the exploit pointless, is infinitesimally small.

Re:Hotmail Challenge (1)

cc_pirate (82470) | more than 2 years ago | (#39823589)

There has to be another zero day hack out there because I know several people who had their Hotmail account hacked last year and in some cases they hadn't even logged in to Hotmail in months when they were hacked. They could have had weak passwords, but still. How do you manage to run thousands of password attempts against an online service like Hotmail without having some other hack (i.e. password Hotmail's hash file or such).

There has to be another zero day hack out there for sure or else M$ has the same problem I think Blizzard has (internal folks selling logins on unused accounts).

Re:Hotmail Challenge (0)

Anonymous Coward | more than 2 years ago | (#39824321)

Or keyloggers. Its not exactly uncommon to hear about people losing their account credentials 'out of nowhere', and that sadly does include Gmail as well. Sometimes they're just very slow about actually trying the collected data on you.

Re:Hotmail Challenge (1)

cc_pirate (82470) | more than 2 years ago | (#39827135)

Which part of 'hadn't logged in for months' didn't you understand?

Keyloggers are unlikely since none of their other, more lucrative accounts were hacked or invaded.

And since their passwds weren't changed, I dont think it was this 0 day exploit.

M$ security sux.

Critical Infrastructure (2, Insightful)

TWX (665546) | more than 2 years ago | (#39820641)

Consider this- Hotmail is a very high profile and widely used e-mail system that theoretically is profitable in its advertising for its owner, and has a lot to lose immediately by being thoroughly exploited in the potential for a rapid loss of users to other non-fee email systems like Google and Yahoo, and they still didn't take any action to resolve this until disaster was literally looming

The federal government wants to require actual critical infrastructure to be security vigilant and is getting pushback from industry, again critical infrastructure, not even some silly free-ish service, to try to avoid the expense.

Corporations, by and large, do not share interests with the public. Corporations are there for profit for shareholders and management first and foremost, and due to extreme myopia in those sectors, where the quarterly profit rules supreme, spending money on things like security are not considered necessary because they don't make profit, rather they cost money. Worse, utility companies and other infrastructure companies aren't high profile; most people don't give any thought to their electric supply beyond paying the bill unless it ceases.

Corporations are not looking out for your interest, unless you happen to be one of the very few people who has any real amount of money tied up in them.

Re:Critical Infrastructure (5, Insightful)

Sarten-X (1102295) | more than 2 years ago | (#39820709)

I think your tinfoil hat's on a bit too tight.

Re:Critical Infrastructure (0)

Anonymous Coward | more than 2 years ago | (#39820915)

I think your tinfoil hat's on a bit too tight.

Corporations exist to generate profit for their owners. What part of that (or the natural consequences laid out by GP) are "tinfoil hat"?

Re:Critical Infrastructure (1)

Sarten-X (1102295) | more than 2 years ago | (#39821839)

For one, the tenuous attachment of this post to the topic is the assumption that Microsoft only fixed this when they were facing a profit disaster... except they were only aware of the problem a few hours before the fix was released, per the summary.

The rant against corporations assumes that corporations are those big evil faceless things that are just money-making machines. That's an incredibly simplistic and naive approach. Corporations exist to accomplish whatever goals their directors want, and that's not necessarily just "make money". I've worked with one company whose stated goal (even on a plaque and everything) was "make cool-looking things". Drive down the right highway at the right time, and you'll see an animated Christmas light display, built by the company as a training exercise in the engineering and construction of DMX lighting. Last I knew, the company had one paying client and made no profit, but still met their goal.

Another implication in the post is that companies are rejecting security mandates purely out of concern for profit. From my experience in IT, this is seldom the real issue. More often, the IT managers are balking at the time and effort mandated for no practical gain. As one example, I used to work at a company that dealt with medical data. Before we were required to be HIPAA-compliant, we salted & hashed (SHA512, multiple times for technical reasons) personal identifiers before they were stored. After HIPAA, we were required to use a two-way encryption algorithm, and have the decryption key stored offsite by another company. The end result was less actual security (because the data could be decrypted, and the key did exist somewhere) and a lot of effort by the software developers.

It's been my experience that security mandates and certifications involve a lot of hassle to meet a set of standards that are too strictly-defined to be practical. I'm not surprised to hear corporations are pushing back against government bureaucrats.

Re:Critical Infrastructure (1)

symbolset (646467) | more than 2 years ago | (#39829407)

There is a profit motive associated with securing electronic systems for the purveyors of those systems. It is simply not profitable to be seen as having shoddy security. This is a rookie mistake any decent security audit would have caught - and that implies that responsible audits are not being done. It follows straight on the heels of another one involving allowing users to have inadequate passwords. That means it's open season on Hotmail still and there's a heck of a lot of money to be made compromising it. A crash program to audit everything about Hotmail security had better already be underway because I guarantee if it's got faults this obvious it has many dozen far more obscure.

There are some here making excuses for the vendor involved and that's lame. This is a commercial enterprise that wants to be taken seriously in matters relating to confidence, security, the ability to handle money. People use email to handle important personal and business matters, to pass sensitive materials, to manage accounts for things that handle real money. This vendor is responsible for operating systems and applications that manipulate most of the world's commerce, credit, medical records and other serious matters. These failures represent simple and obvious neglect of their responsibility to practice due care. It should take them a long time to recover the respect and confidence they lost from this - and that will require that they get full control of their security situation even if it is inconvenient or expensive to do so.

"Vulnerabilities happen" is a copout. Vulnerabilities on this level of violation of best practice must not happen in an organization that hopes to maintain this level of responsibility.

Re:Critical Infrastructure (2)

srussia (884021) | more than 2 years ago | (#39821353)

I think your tinfoil hat's on a bit too tight.

Not to mention inside out. I mean, the federal government is the good guy here? WTF?

Re:Critical Infrastructure (1)

tunapez (1161697) | more than 2 years ago | (#39821439)

How is an environment that fosters and encourages the bare minimum effort for the maximum return a conspiracy? From what little I know of corporate law, the OP's comment is spot on. My father, his neighbor and a third associate all called me in the last month to help fix the worm-like behavior associated with their hotmail accounts. Of the very small sample of hotmail users I know, at least three of them fell victim to these account exploits. I can only guess how many more there are in the world and none of my contacts have yet received any acknowledgement or assurance from MS besides the automated response email. Perhaps a conspiracy of hard is it for an email service provider to send a mass response? Perhaps they could take some pointers from the spammers that exploit their servers daily.

Re:Critical Infrastructure (1)

NotBorg (829820) | more than 2 years ago | (#39822841)

In GP's defense, you actually want it some what tight. If it's loose and sagging it can potentially block your view of the real world.

Re:Critical Infrastructure (2)

Baloroth (2370816) | more than 2 years ago | (#39821387)

This is often repeated on Slashdot, and yet, it still isn't true. Corporations are most certainly interested in the interests of the public, insofar as the public ultimately represents their biggest customer. Not all corporation sell directly to the public, of course, and therefore they don't act in the public interest (oil companies, government contractors, etc.) but by and large, it is in Microsoft's and many corporations interest to work in the interest of consumers and the public because they are a large portion of their customer base.

OTOH consumers are, as a group, not particularly smart, so they often act against their own interests. Corporations, for their part, often do as well, since they are even more divided than individual consumers (by being, quite literally, divided). The result is that the public often gets screwed over. Keep in mind, though, that in cases like this, people choose to use Hotmail despite having dozens of free (and IMO better) alternatives. So, while Microsoft does share the interests of the public, they often act like they don't (again, because the public itself doesn't act in their own interest, so MS doesn't either, as far as they can get away with it).

I do have a Hotmail account, since I used them a long, long time ago, and it is still useful for sign-ups to sites I don't really care about, but I would never use them for anything serious.

Re:Critical Infrastructure (0)

Anonymous Coward | more than 2 years ago | (#39822345)

The federal government wants to require actual critical infrastructure to be security vigilant and is getting pushback from industry, again critical infrastructure, not even some silly free-ish service, to try to avoid the expense.

Yes, but Microsoft for years now has made hotmail (ie, msn or Live) the mandatory access method for all sorts of things, such as windows volume licensing. Windows 8 will use it as well.

I bet many other things (like universities & cities outsourced cloud email) run on hotmail, or federate with hotmail for authentication.

Re:Critical Infrastructure (1)

aztracker1 (702135) | more than 2 years ago | (#39825041)

You can get any email validated as a "live" login.. just *most* will chose the hotmail option (as other options are a bit buried).

What's Hotmail? (1)

AttyBobDobalina (2525082) | more than 2 years ago | (#39820667)

Was overrun by spam years ago - have not used an account there since the rise of the G-mail.

Re:What's Hotmail? (1)

SJHillman (1966756) | more than 2 years ago | (#39821101)

I stopped using Hotmail long before Gmail ever came out, but from what I hear they largely fixed their spam problems so it's on par with Gmail now.

Re:What's Hotmail? (1)

Cro Magnon (467622) | more than 2 years ago | (#39821703)

I've tried Hotmail recently, and so far so good for spam. Of course it doesn't get near the use of my gmail, but even light use would have gotten me spam-swamped in the "good old days".

Re:What's Hotmail? (1)

TheLink (130905) | more than 2 years ago | (#39823223)

Alternate theory: even the spammers have given up on Hotmail.

Re:What's Hotmail? (1)

kaatochacha (651922) | more than 2 years ago | (#39821853)

I've begun using my hotmail account recently as the "giveaway" address.
It was unusable not too long ago. Now, I really never get any spam in it.

Luckily Microsoft sec is ten years ahead of Apple! (-1, Offtopic)

Anonymous Coward | more than 2 years ago | (#39820681)

Luckily like that anti-virus peddler said Microsoft security is ten years ahead of Apple on security or this could have been bad!

How to change email account? (1)

hort_wort (1401963) | more than 2 years ago | (#39820705)

Alright. I read about the hotmail security breach the other day and now this. I had my own account accessed twice before, but I thought it was just due to a weak password on my part each time. Now I'm thinking it wasn't just me. I want to switch now.

So for people in the know on email accounts, I have two questions:
1) What is the best choice of service for a lazy person? (Gmail? Seems like that one should be a target itself just from popularity.)

2) What sorts of obstacles will I face when switching? I have my current hotmail addy associated with every service I subscribe to, and I don't think I can change it with many of them. Am I supposed to empty out all the messages and contacts in it, then have it transfer all messages immediately to my new account?

Re:How to change email account? (1)

semi-extrinsic (1997002) | more than 2 years ago | (#39820949)

When I migrated from university webmail to Gmail last year, I used Thunderbird to transfer the gigabytes of sent/received email I had there. First download from "YourOldMail", then upload to "YourNewMail". Painless experience, and I recommend this approach if "YourNewMail" can't import directly from "YourOldMail".

And yes, Gmail is pretty good. The only gripe I have is that I can't set up mail encryption (GPG for message header/body) in Gmail's webmail interface, but this is mainly interesting if your tinfoil hat is frequently used. On the upside, I'm pleasantly impressed by how well it handles "Event Invitations" sent from people using Outlook, you'll appreciate the possibility of two-factor authentication, and of course searching through mail is magic.

(BTW, most subscription services I've seen allow changing your email, but it's often hidden pretty well. Good hunting.)

Re:How to change email account? (2)

Ingenium13 (162116) | more than 2 years ago | (#39824051)

You actually can setup GPG in Gmail's web interface, at least in Chrome: [] . It seems that FireGPG was unfortunately discontinued for Firefox.

Re:How to change email account? (1)

dejanc (1528235) | more than 2 years ago | (#39821359)

My Gmail account got hacked into. It was a big hassle. The password wasn't weak, but I might have given it away to somebody by providing it to an "open id" login, or something like that.

I still have that Gmail account but with two step authorization (they send me an SMS with a code whenever I change IPs) but I am moving away from it.

Instead, I purchased a Linode server and deployed email solution there for primary email. It took me maybe a couple of hours to configure, but I am very happy with it, and I also utilize it for other nifty stuff, like my own dynamic dns solution, SVN/GIT repository, backup server, etc.

Re:How to change email account? (1)

the eric conspiracy (20178) | more than 2 years ago | (#39822073)

I've been running my own mail server for a decade now. Right now it's on Scientific Linux running on a Atom based machine. I love it because there is no latency for inbound mail, and it isn't dependent on ISP servers for inbound processing.

For outbound I still use my ISP mostly because I don't have a static IP and lots of services reject mail from dynamic IPs.

Re:How to change email account? (1)

aztracker1 (702135) | more than 2 years ago | (#39825101)

I have my own mail server, on a commercial internet account... I find that I use my gmail account far more than my vanity domain. I have been using SmarterMail for a number of years now, with pretty good settings for spam prevention... just the same, gmail's web interface and integration (with android) has worked out better for me.

Re:How to change email account? (1)

tmarthal (998456) | more than 2 years ago | (#39825433)

Did it get hacked into before or after you added the two step auth?

Also, are you using Google Account Reports? It now tells you exactly where and how you've logged into your Google Accounts; I think the SMS that you get are actually from this, not the two-step auth.

I feel much safer with the application one-time passwords and two-step hardware keycodes than any other service.

Does your Linode Server have two step auth to access email? And can you do that on your phone?

a link with the token is sent to an account linked (-1, Offtopic)

zincsulfates (2483892) | more than 2 years ago | (#39820761)

a link with the token is sent to an account linked to the Hotmail account []

Re:a link with the token is sent to an account lin (-1, Offtopic)

zincsulfates (2483892) | more than 2 years ago | (#39820871)

Re:a link with the token is sent to an account lin (0)

Anonymous Coward | more than 2 years ago | (#39822795) [] Malwarebytes - a top-of-the-line Windows security app. - thinks that the rqsulfates link above has malicious links and or links to mailicious sites. ( Be wary of clicking anything on this page - or even going there... unless you're testing your security apps of course!

Hacking Community (4, Funny)

Vegemeister (1259976) | more than 2 years ago | (#39820895)

spreading 'like wild fire' in the hacking community

For definitions of 'hacking community' sufficiently close to 4chan, I presume?

Go alternate ... (0)

Anonymous Coward | more than 2 years ago | (#39820945)

... pigeon style (0-day hackable by stones but it takes a whole lot more than youtube videos to grow the slingshot skills).

Re:Go alternate ... (1)

ch-chuck (9622) | more than 2 years ago | (#39821075)

Total coincidence, but I saw this ancient B&W episode of Robin Hood [] yesterday where he did hack a carrier pigeon. The sheriff was going to use pigeons to carry some pearls to his place, but Robin switch birds with Maid Marion's and took them elsewhere!

Dear Microsoft (1)

fxbar (2627205) | more than 2 years ago | (#39821077)

Dear Microsoft Support,
I own 100'000 hotmail accounts (now), but I don't consider them save anymore. Can I please return them? Would you mind exchanging them for a GMail account?

Wide-spread (1)

no-body (127863) | more than 2 years ago | (#39821113)

0-day - MSoft .... giggle

How long has this been going on? (0)

Anonymous Coward | more than 2 years ago | (#39821397)

Was there not a post earlier this week about the online journalist that got his hotmail hacked? Not the most secure password in the world, but there was no way it could have been brute/dictionaries. A tarpit or lockout would have made that impractical given the time frame.

I've got a feeling this has been going on for years. Nearly everyone I know who's ever had a hotmail acct has had it compromised.

Re:How long has this been going on? (1)

Kernel Krumpit (1912708) | more than 2 years ago | (#39823245)

I have 3 hotmail/livemail accounts, 1 Gmail account and my own Exchange Server with 50 or so email addresses (from 5 Domains). Some interesting facts from my digital life follow. - My hotmail accounts have never been compromised (1 of my hotmail accounts is over 12 years old) - my gmail account has never been compromised - I pick-up email from my 4 cloud accounts above via POP. I leave no emails in the cloud and seldom access my online accounts. - the only email addresses i've ever had compromised were both "unique" and jacked from The US Bank (e.g. and the Bill Paying company my city council uses for their utility payments (e.g. Shocking I know but the "secure" online Bill Payer lied and denied and obfuscated the compromise and the US Bank admitted tit and were "looking into it"!! Needless to say those two compromised emails were changed within 2 minutes.

This is bad. (0)

Anonymous Coward | more than 2 years ago | (#39822103)

I hope Microsoft has the decency of rolling back the affected accounts upon request. I mean, damage is done if the hacker got their contacts list, but no one should have to lose his or her account.

Hotmail should be doing more to protect users' accounts.
How about a master password in which someone can log in and reverse the damage done? It'd make it safer to log in with a regular password, and it could help reverse damage done by exploits, to a certain extent.

At one point the recovery system was pathetic. Forgot your password? No problem, send it to an alternative e-mail address. Oh, don't have access to your alternative e-mail address anymore? Well, no problem! Just answers these questions (answers readily available on the user's personal website or blog) and we'll change your alternative e-mail address to your choice. And I think this has to do with actual Hotmail employees regarding the alternative e-mail address situation.

Oh, and to make matters worse, the ones without an alternative e-mail addess could be recovered by answering such simple questions that after a few guesses, well, enough said.


Re:This is bad. (1)

Kernel Krumpit (1912708) | more than 2 years ago | (#39823313)

Interestingly enough one of my more "senior" clients forgot their original 10 year old MSN password. After a few days "battling it out" with MSN and all the usual verification tests - for the innocents involved - MSN REFUSED to hand over the account with either a new or an old password to the rightful account owner!

Not Again! (0)

Anonymous Coward | more than 2 years ago | (#39824431)

God dammit, my WoW character is naked.

Old buggy reset (0)

Anonymous Coward | more than 2 years ago | (#39826573)

I had a hotmail account from 1998 with a cool ID that did not have an alternate email address because they didn't have the feature when I set it up. I was screwed out of my account in 2007 when someone reset it.

Hotmail staff were not helpful. Since they had previously purged my account of all data, I was unable to identify any mail that might link it to me. They were unwilling to reset the password to the previous version, despite my contacting them from the IP that had previously used the account, in the city where it was originally setup, etc. Tough nuts, they said.

Solution to email phishing .. (1)

dgharmon (2564621) | more than 2 years ago | (#39828637)

The problem with email security is that once the attacker knows your email address, he can then go onto acquire the password through either phishing or guessing your password reset information. A simple solution that would mitigate against that is to provide the email identity in two parts, a private identity and a public email aliase. People send email to the public email address but only you can login with the private ID. The private ID is never transfered to any third party.

Re: (1)

moneybabylon (2226376) | more than 2 years ago | (#39830323)

"spreading 'like wild fire' in the hacking community"

well, it is hotmail afterall.

Just Solve It (1)

ryanisflyboy (202507) | more than 2 years ago | (#39831849) 451 "Due to overwhelming security issues with hotmail, your e-mail provider has been blocked. Please switch e-mail providers, your e-mail is not safe at hotmail."

# grep /var/log/maillog | wc
    20935 419204 4814336

If everyone did this, we wouldn't have an issue any more.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?