You are currently viewing our boards and having a limited access. Feel free to register so you can express your feelings with us. You need to register before you can post in forums. Registration takes only a minute. No validation via mail required in registration.

Hotmail flaw leads to attacks vs users — IT security firm

Go down

Hotmail flaw leads to attacks vs users — IT security firm Empty Hotmail flaw leads to attacks vs users — IT security firm

Post by Justin_Romile on Sat May 28, 2011 10:59 am

A vulnerability in Microsoft's Hotmail e-mail service was exploited by cybercriminals recently in an attempt to acquire personal information from uninformed users.

The criminals reportedly carried out the attack by sending to targeted users an e-mail message seemingly coming from Facebook's security team, informing them that their account has been accessed from an unknown location.

Unlike other e-mail malware, however, users would simply have to open the e-mail message for their systems to get infected.

"Previewing the email message prompts the download of a script from a remote URL. The script is then injected to the page to initiate information theft," said Trend Micro's Taiwan Threat Solutions Team, who discovered the exploit, in a blog post.

Information possibly culled from the attacks include e-mail messages and contact information, but it also sends all of the infected users' messages to a specific address, Trend Micro noted.

This scenario becomes more complex in a corporate environment, where multitudes of personal employee information can easily be harvested by the cybercriminals, it added.

Threat response engineer Karl Dominguez said the malicious script takes advantage of a bug in Hotmail's script filtering system, which reportedly aggravates the problem instead of solving it.

"Once Hotmail’s filtering mechanism works on the code, it ironically helps inject a character into the CSS parameters to convert the script into two separate lines," Dominguez said.

"This allows the cybercriminals to turn the script into something that allows them to run arbitrary commands in the current Hotmail login session," he added.

Microsoft has since fixed the security hole, he said.

In order to ward off such attacks in the future, Dominguez advised companies to "always patch your browsers, applications, and operating systems; update your security software regularly; only access trustworthy websites; disable scripting or limit it to trustworthy sites; use alternative browsers; and always use original software."

Posts : 219
Join date : 2010-05-11
Age : 24
Location : Antipolo City, Philippines

Back to top Go down

Back to top

- Similar topics

Permissions in this forum:
You cannot reply to topics in this forum