Vulnerability in the Microsoft-Hotmail system

February 13, 2002

RaSta used our newssubmit to tell us about a discovered vulnerability in Microsoft's Hotmail:

Another vulnerability in the Microsoft-Hotmail system has just been exploited by hackers. They successfully bypassed the procedure that is supposed to ask people security question before changing their passwords when they forgot them.

Some implications of the hacked Hotmail is that anyone going through the procedure might lose personal Hotmail service if the Secret Question is accessed. One account has already been hijacked and its rightful user has "Who Owns You?" to look at.

The hack affects the MSN's .NET network as well. This means a hacker can use the hijacked account and use it to make purchases, charging everything to the victim's credit card.

You can read the full article here.

Source: washingtonpost.com