Outlook.com had classic security blunder in authentication engine

Redmond pays $25k to hacker who spotted flaw allowing anyone to own your email

Synack senior security researcher Wesley Wineberg has received US$25,000 from Microsoft for quietly disclosing a bug that allows any Hotmail account to be hijacked.

The cross-site request forgery vulnerability means that any user visiting a malicious page can have their accounts hijacked without further interaction.

The since-patched hole existed in Microsoft Live.com and could have been spun into a dangerous worm, Wineberg says.

"With IMAP and contact book access, a worm could easily email all of a user’s contacts - or at least the ones who use Hotmail, Outlook.com - with something enticing, ILOVEYOU virus -style, and spread to every user who clicks the link," Wineberg says.

"The only prerequisite was that the victim was logged in and had a valid session token in their cookie.

"This CSRF lets me bypass the user interaction step of the OAuth authentication system."

Wineberg created a proof-of-concept application that could hijack sessions and showcased it in a video.

He says the vulnerability is merely a "classic" cross-site request forgery that happens to exist in a critical authentication area.

The hacker says Microsoft's other APIs encountered in regular login appear secure. ®