The Register's 'Hacking Hotmail made easy' is a misleading
The Register has posted a
story about some news that was
just published in BugTraq and
is really making a mountain
out of a molehill... Thomas
Greene elaborates "Some bright
empiricist from Root-Core has
discovered that anyone can log
into their Hotmail account and
then call messages from any
other Hotmail account by
crafting a URL with the second
account's username and a valid
message number.
Finding a valid message number
is of course total guesswork,
but they all follow a
consistent format and always
have the same number of digits
(i.e., a time stamp), so with
the help of a little
brute-force progie one can try
numerous combinations in the
background rather than type
them in....
It's necessary that you be logged into another (any other) Hotmail account. Now copy in the attack URL, click 'go' and voila.
You can only read messages; the button links on the page don't work; they'll bounce you back to the account you're working from. But it is a nifty trick, and it is proof of a major hole in Hotmail security.
The hacking danger here is very much limited by the need to guess message numbers, which is slow going. And while there is a handy program for bruting the numbers it's quite slow, trying only about one message page per second in 'fast' mode.
It has a GUI but remains a bit clunky, and also needs to be paused after it brings up the Hotmail login page so you can enter a valid username and password. After two unsuccessful attempts, I got it to work as advertised. It's more a proof-of-concept exercise than a cracking tool -- so enjoy it as such.
Click here if you really want to read more about this 'exploit' at The Register.
