Wanted to let you know that Microsoft is investigating this issue, and provide our current status. We have verified that there is a security issue associated with the Microsoft Passport sign-out service involving customers using Netscape 4.0 and higher when using the optional setting for Advanced Security to restrict cookies. We have verified that this issue does not affect customers of the Passport wallet service. Microsoft is working diligently to address this issue and provide our customers with a solution as soon as possible. We take security seriously, and are committed to ensuring that all our customers have an easy and safe online experience. Secureat_private -----Original Message----- From: Pete Krawczyk [mailto:pkrawczyat_private] Sent: Thursday, October 21, 1999 7:28 AM To: BUGTRAQat_private Subject: Hotmail security vulnerability Within the last couple weeks, Microsoft has unveiled their new Passport service which allows you to log in to multiple sites and do your work with one single login. However, they failed to realize that not all people allow all cookies everywhere to be put on their computer. It is possible by making a settings change in Netscape (and possibly IE) to transparently let a user log in as the last user that used Hotmail on that computer. By setting the Cookies preference to "Accept only cookies that get sent back to the originating server", you can keep the authorization cookie that allows a user to log in to Hotmail and read the last user's mail. The authorization cookie is temporary, however, and is deleted when the browser closes. Try it: 1) In Netscape, set your cookie preference to the above. 2) Log in to any Hotmail account. 3) Choose "Sign Out". 4) From the MSN page that appears after sign-out, choose the Hotmail link. 5) You will be back in the Inbox. Possible Fixes: 1) Set cookies to "Accept all cookies" 2) Close your browser immediately after signing out. Tested on Netscape 4.5 and 4.6, using both the "Increased Security" and "Neither" authorization methods. When contacted at Hotmail_Technical_Support_Xat_private (Hotmail gives you this address to ask security questions if you send a blank email to howsecureat_private ), I got a Mail Delivery error that the address did not exist. -Pete K -- Pete Krawczyk http://www.uiuc.edu/ph/www/pkrawczy/ pkrawczy at uiuc dot edu Finger for PGP Public Key
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:08:29 PDT