Hacking Hotmail made easy

Hurry, before they close the hole


Some bright empiricist from Root-Core has discovered that anyone can log into their Hotmail account and then call messages from any other Hotmail account by crafting a URL with the second account's username and a valid message number.

Finding a valid message number is of course total guesswork, but they all follow a consistent format and always have the same number of digits (i.e., a time stamp), so with the help of a little brute-force progie one can try numerous combinations in the background rather than type them in.

The basic URL for an attack looks like this:

http://pv2fd.pav2.hotmail.msn.com/cgi-bin/saferd? _lang=EN&hm___tg=http%3a%2f%2f64%2e4%2e36%2e250%2fcgi%2dbin%2fgetmsg&hm___qs=%26msg%3dMSGXXXXXXXXX% 2e(X)X%26start%3d1%26len%3d99999999999%26login% 3dUSERNAME%26domain%3dhotmail%2ecom

where USERNAME is the account name, XXXXXXXXX is a nine-digit message number, and (X)X is a second number between zero and (I think) fifty-nine.

(I've inserted spaces in the URL so the page here doesn't grow a mile wide, so be sure to remove them before you play with it.)

Now, let's say you have a Hotmail account called r00tarded@hotmail.com. Just log in, click on any message in your inbox, and then look at the URL. You'll see something like this:

http://lw2fd.hotmail.msn.com/cgi-bin/getmsg? curmbox=F000000001&a=5691b2b44e104176111971aa0fbb1274&m sg=MSG998000947.3&start=197078&len=1060&msgread=1&mfs=182

Copy the URL and log out. Now, log into another of your Hotmail accounts, and commence to play.

The message number for the item you viewed in your r00tarded account is MSG998000947.3 and it needs to be inserted in the attack URL along with the username thus:

http://pv2fd.pav2.hotmail.msn.com/cgi-bin/saferd? _lang=EN&hm___tg=http%3a%2f%2f64%2e4%2e36%2e250%2fcgi% 2dbin%2fgetmsg&hm___qs=%26msg%3dMSG998000947% 2e3%26start%3d1%26len%3d99999999999%26login% 3dr00tarded%26domain%3dhotmail%2ecom

It's necessary that you be logged into another (any other) Hotmail account. Now copy in the attack URL, click 'go' and voila.

You can only read messages; the button links on the page don't work; they'll bounce you back to the account you're working from. But it is a nifty trick, and it is proof of a major hole in Hotmail security.

The hacking danger here is very much limited by the need to guess message numbers, which is slow going. And while there is a handy program for bruting the numbers it's quite slow, trying only about one message page per second in 'fast' mode.

It has a GUI but remains a bit clunky, and also needs to be paused after it brings up the Hotmail login page so you can enter a valid username and password. After two unsuccessful attempts, I got it to work as advertised. It's more a proof-of-concept exercise than a cracking tool -- so enjoy it as such.

And please, I beg you, don't contact me for tech support. I've nothing to do with it. It works; it does take a bit of tweaking; so just give it a whirl and be playful. ®


Other stories you might like

  • Apple's latest security feature could literally save lives
    Cupertino is so sure of Lockdown Mode it's offering $2m to bug hunters to break it

    Apple's latest security feature won't be used by most of its customers, but those who need Lockdown Mode could find it to be a literal life saver.

    The functionality, coming with iOS/iPadOS 16 and macOS Ventura, dramatically shrinks an iDevice's attack surface by disabling many of its features. It's designed to protect the small number of Apple users who, "because of who they are or what they do, may be personally targeted by some of the most sophisticated digital threats, such as those from NSO Group and other private companies developing state-sponsored mercenary spyware," Apple said in a statement. 

    Lockdown, thus, effectively reduces the number of potential vulnerabilities spyware could exploit to compromise a device, cutting the possible routes into surveillance targets' kit.

    Continue reading
  • Has Intel gone too far with its Ohio fab 'delay' stunt?
    With construction unceremoniously underway, x86 giant may have overplayed its hand

    COMMENT The way Intel has been talking about the status of its $20 billion Ohio fab project, you would be forgiven if you assumed that construction on the Midwest mega-site has been delayed in light of Congress struggling to pass a large subsidies package that would support new American chip factories.

    When Intel delayed a groundbreaking ceremony for the Ohio manufacturing site two weeks ago out of frustration over the subsidies inaction, some headlines may have given you the impression the semiconductor giant was putting off construction entirely.

    However, an Intel spokesperson made it clear to The Register and others at the time that the start date for construction had not changed.

    Continue reading
  • Hive ransomware gang rapidly evolves with complex encryption, Rust code
    RaaS malware devs have been busy bees

    The Hive group, which has become one of the most prolific ransomware-as-a-service (RaaS) operators, has significantly overhauled its malware, including migrating the code to the Rust programming language and using a more complex file encryption process.

    Researchers at the Microsoft Threat Intelligence Center (MSTIC) uncovered the Hive variant while analyzing a change in the group's methods.

    "With its latest variant carrying several major upgrades, Hive also proves it's one of the fastest evolving ransomware families, exemplifying the continuously changing ransomware ecosystem," the researchers said in a write-up this week.

    Continue reading
  • What do you mean your exaflop is better than mine?
    Gaming the system was fine for a while, now it's time to get precise about precision

    Comment A multi-exaflop supercomputer the size of your mini-fridge? Sure, but read the fine print and you may discover those performance figures have been a bit … stretched.

    As more chipmakers bake support for 8-bit floating point (FP8) math into next-gen silicon, we can expect an era of increasingly wild AI performance claims that differ dramatically from the standard way of measuring large system performance, using double-precision 64-bit floating point or FP64.

    When vendors shout about exascale performance, be aware that some will use FP8 and some FP64, and it's important to know which is being used as a metric. A computer system that can achieve (say) 200 peta-FLOPS of FP64 is a much more powerful beast than a system capable of 200 peta-FLOPS at just FP8.

    Continue reading
  • Meta's AI translation breaks 200 language barrier
    Open source model improves translation of rarer spoken languages by 70%

    Meta's quest to translate underserved languages is marking its first victory with the open source release of a language model able to decipher 202 languages.

    Named after Meta's No Language Left Behind initiative and dubbed NLLB-200, the model is the first able to translate so many languages, according to its makers, all with the goal to improve translation for languages overlooked by similar projects. 

    "The vast majority of improvements made in machine translation in the last decades have been for high-resource languages," Meta researchers wrote in a paper [PDF]. "While machine translation continues to grow, the fruits it bears are unevenly distributed," they said. 

    Continue reading
  • Tracking cookies found in more than half of G20 government websites
    Sorry, conspiracy theorists, it's more likely sloppy webdev work rather than spying

    We expect a certain amount of cookie-based tracking on retail websites and social networks, but in some countries up to 90 percent of government sites have implemented trackers – and serve them seemingly without user consent. 

    A study evaluated more than 118,000 URLs of 5,500 government websites – think .gov, .gov.uk. .gov.au, .gc.ca, etc – hosted in the twenty largest global economies – the G20 – and discovered a surprising tracking cookie problem, even among countries party to Europe's GDPR and those who have their own data privacy regulations.

    On average, the study found, more than half of cookies created on G20 government websites were third-party cookies, meaning they were created by outside entities typically to collect information on the user. At least 10 percent, going up to 90 percent, come from known third party cookies or trackers, we're told.

    Continue reading

Biting the hand that feeds IT © 1998–2022