Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw on April 20th and responded with a fix within hours—but not until after widespread attacks, with the bug apparently spreading "like wild fire" in the hacking community.
Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password: a link with the token is sent to an account linked to the Hotmail account, and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account.
Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet. Videos showing the technique (or at least, something close to it) can be found as far back as April 6th.
As well as targeted attacks against specific Hotmail users, there was also brute force cracking of accounts with two- and three-letter e-mail addresses.
Researchers at Vulnerability Lab discovered the flaw on April 6th, and they reported it to Microsoft on April 20th, with the patch following shortly after. It's also claimed that the flaw was discovered by a Saudi hacker at dev-point.com, and there's certainly plenty of discussion of the attack on that site during the period between Vulnerability Labs' claimed discovery and the decision to notify Microsoft.
If your account has been hacked with this technique, you'll know it instantly, as your password will no longer work. Getting it back may be more difficult, as the standard first step in any account hack is to reset all the recovery information so that the original owner can't retrieve it.
reader comments
43