Forgot your password?
typodupeerror
Microsoft Idle

Microsoft's Hotmail Challenge Backfires 453

Posted by samzenpus
from the not-the-desired-outcome dept.
Barence writes "Microsoft challenged the editor of PC Pro to return to Hotmail after six years of using Gmail, to prove that its webmail service had vastly improved — but the challenge backfired when he had his Hotmail account hacked. PC Pro's editor say he was quietly impressed with a number of new Hotmail features, including SkyDrive integration and mailbox clean-up features. He'd even imported his Gmail and contacts into Microsoft's service. But the two-week experiment came to an abrupt end when Hotmail sent a message containing a malicious link to all of his contacts. 'What's even more worrying is that it's not only my webmail that's been compromised, but my Xbox login (which holds my credit card details) and now my PC login too. Because Windows 8 practically forces you to login with your Windows Live/Hotmail details to access features such as the Metro Store, synchronization and SkyDrive,' he writes."
This discussion has been archived. No new comments can be posted.

Microsoft's Hotmail Challenge Backfires

Comments Filter:
  • by Anonymous Coward on Wednesday April 25, 2012 @05:55PM (#39800523)

    Other than that, would this be an experience you would recommend to others?

    • by masternerdguy (2468142) on Wednesday April 25, 2012 @05:56PM (#39800541)
      I actually feel sorry for M$ on this. They tried so hard and genuinely improved the service and this happens. Still hilarious though.
      • by sortadan (786274) on Wednesday April 25, 2012 @07:39PM (#39801573)
        Agreed. Unless the hacker exploited a flaw in Hotmail to get the login credentials or it was obtained from some other Microsoft service (highly doubtful), then really it could be the editors fault for either having an easily guessable password (the same as he luggage perhaps), or logging in from a computer that had been rooted and was key logging or whatever.
        • by Dan541 (1032000) on Wednesday April 25, 2012 @08:31PM (#39801955) Homepage

          From TFA

          I set about trying to change my passwords. Hotmail was easy enough, but as that email address was also used as my iTunes login, I wanted to change that password as well. Except Apple’s changed its password policy since I last changed mine, forcing me to include a capital letter, a number, a set number of characters and a symbol from the Ancient Greek alphabet (I exaggerate only slightly). As my Gmail account was linked to that now compromised Hotmail inbox, I had to change that password too. So I now had three new passwords – all using slightly different systems – swimming round my slightly inebriated brain, and I can’t even remember the name of my news editor when I’m sober. If I’m still able to access my iPhone and Gmail account today, it will be nothing short of miraculous.

          I'm curious to know how strong this password, used in multiple places really was.

          • by Smallpond (221300) on Wednesday April 25, 2012 @08:59PM (#39802139) Homepage Journal

            I'm curious to know how strong this password, used in multiple places really was.

            Very strong. Instead of the usual 12345 he used 54321.

            • by kikito (971480)

              12345?

              Wow, that's even stronger than asdfg. Because you have to move your fingers up! Genius!

          • I'm curious to know how strong this password, used in multiple places really was.

            ... and how multiple the places really were, and how trustworthy all of them actually were...

            And a "place" doesn't actually need to be actively malicious, just sloppy/misguided. Such as making you log in over unsecured http, enabling a malicious third party to easily snoop. Some large chat/meetup site that I use only enables premium members to log in via https. Other must use plain http.

        • by PuZZleDucK (2478702) on Wednesday April 25, 2012 @09:05PM (#39802173) Homepage

          I'll third that. I was appalled with the editors attitude to paswords.

          • 1. He uses all lower case letters [FAIL - you know the rules you work at PCP]

          2. He was shocked one of his services had woken up and hardened its password policy [FAIL - you should be encouraging this kind of behaviour, not dissing it - I'm pissed when I'm _not_ allowed to use special characters]

          3. He obviously has no password managment plans [FAIL - If I had to replace every single one of my passwords today it would be a hasstle but there would be no chance of me not being able to recover accounts the next day]

          I feel less inteligent after having read this article... help me!

          • by Jah-Wren Ryel (80510) on Wednesday April 25, 2012 @10:22PM (#39802607)

            I feel less inteligent after having read this article... help me!

            And yet everything you listed is typical of regular users and hotmail's target audience is regular users. The author may be a dolt because he failed to apply the expertise that is a requirement of his job, but when you have to be an expert to properly use a consumer-grade service, the real problem lies squarely with the service, not the user.

            • Yet funny enough, I have integrated my phone to send me a code when i log in to my hotmail account else it does not let you...why would he not have used this if he really wanted to test all the new features, facebook has it, gmail has it...thats like only testing the gas pedal on a car without touching the brake pedal and then saying it was not the same driving expereince...

        • by shutdown -p now (807394) on Wednesday April 25, 2012 @11:35PM (#39803009) Journal

          From TFA:

          (Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.

          So, seven lowercase letters. And this guy thinks it's "not that weak".

          • Ya, that's pretty weak. But that said, shouldn't all secure sites use an anti-hammering scheme with a specified cool down period. You could apply this behavior on a per source IP only so as to not DOS an account. In theory, a distributed botnet could attempt a brute force crack from multiple sources against one account, but how often would that happen unless you were specifically targeted in the first place?

          • by the_B0fh (208483) on Thursday April 26, 2012 @03:18AM (#39804019) Homepage

            Does it matter if it is "weak" or not? Unless the hackers compromised hotmail's password file and is busily trying to crack it, it is irrelevant.

            What is relevant is that hotmail is apparently open to being bruteforced. Now, *THAT* is a fail.

      • This is also very informative, at least for me, as it gives me one more reason to avoid Win 8 as i had no idea everything in their new appstore was tied to hotmail. So Barance thanks for submitting this article, most grateful. Sorry about the poor bastard that tried Hotmail and got pwned but there is a good reason why many of us avoid hotmail like the clap.

        as for feeling sorry for MSFT? the only thing I feel sorry for them for is they are stuck between a rock and a hard place, but that was their own design and shortsightedness so i am having trouble feeling sorry for it. What I mean is that they really need a hold in mobile because the desktop is mature tech and won't be gaining anymore but the only reason people buy Windows is for Windows programs which of course don't run on anything but x86. But of course this is their own fault as Cutler originally designed WinNT to be portable and if they would have maintained that focus instead of going Wintel they wouldn't be screwed out of mobile as they are now as the Windows programs could have run on ARM, or MIPS, or any other chip.

        • I think they need an a Live account or something, and your hotmail account is automatically one, but I have seen people using GMail ids for making this live account and logging in to Win8.

        • by shutdown -p now (807394) on Wednesday April 25, 2012 @11:37PM (#39803019) Journal

          Are you also avoiding Android? Because that requires you to be signed into your Google account to do a lot of useful things (like sync stuff).

          On the other hand, just like with Android, you don't have to use your LiveID in Win8.

          As for why the guy got pwned... I'll just quote TFA.

          (Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.)

        • by tobiasly (524456) on Wednesday April 25, 2012 @11:40PM (#39803041) Homepage

          This is also very informative, at least for me, as it gives me one more reason to avoid Win 8 as i had no idea everything in their new appstore was tied to hotmail.

          Haha no kidding. I wonder if they still delete your Hotmail account if you don't log in for 30 days or whatever. Because that would be awesome to find out all my purchased apps were inaccessible because they deleted my "inactive" account...

      • by Xeno man (1614779) on Wednesday April 25, 2012 @09:47PM (#39802415)
        Don't, they have done it to them selves. If Microsoft stopped forcing it's own software down your throat and gave users choice they would have better products. Windows 8? You need to use your windows live account, check your email through Live messenger, you want to use Internet explorer, don't you. Also your default search is Bing, whoops you changed that to Google, lets change that back to Bing because you fucking love Bing, don't you? Don't you!?!

        Sometime when products work together they work better but sometimes you need separation between your accounts. If I have an Xbox live account I may want my credit card on there to buy things but if I also have a hotmail account, I may have zero reason for hotmail to have my credit card number. Maybe I want them linked together and to share data and maybe I want them worlds apart and not even know the other exists. Just give me a fucking choice.
        • by DavidD_CA (750156) on Wednesday April 25, 2012 @10:08PM (#39802529) Homepage

          You need to use your windows live account, check your email through Live messenger, you want to use Internet explorer, don't you.

          Hello. I am using Windows 8.

          I did not need to provide my Windows Live login for anything. While it is suggested, it certainly wasn't required.

          I am using the built-in email, calendar, and messenger apps. All of them allow connectivity to multiple services including Exchange, Facebook, and more. (Yes, I can even see my Facebook contacts and events integrated into the various apps.)

          And while Windows 8 certainly ships with IE 10, you're not forced to use it. I could have easily installed Firefox and tabbed it to the Metro screen if I wanted.

    • by cratermoon (765155) on Wednesday April 25, 2012 @06:03PM (#39800635) Homepage
      Obligatory: Other than that, Mrs. Lincoln, how did you like the play?
    • by devitto (230479) on Wednesday April 25, 2012 @06:14PM (#39800801) Homepage Journal

      Other than that, would this be an experience you would recommend to others?

      I can't see why Playstation owners wouldn't migrate.

    • by AngryDeuce (2205124) on Wednesday April 25, 2012 @06:20PM (#39800899)

      It's funny, but that was exactly the same thing that convinced me to leave Hotmail once and for all 2 years ago, and I'd had the same Hotmail email address since before Microsoft even bought it back in the late 90's.

      The thing that really pissed me off was that, when I contacted Microsoft and told them I got hacked and requested they delete the account, they flat out refused to do so, and told me I'd just have to wait until it was deleted due to inactivity. Because I'd had that email address for so long, I had literally hundreds of contacts that got hit with spam messages (to include former employers and companies that I had job applications on file for, how embarrassing THAT was). I wanted the email address dead so that I didn't have to worry about it happening again in 8 months, but apparently that was just too much to ask. My password was not some ridiculous '123456', either, it was a non-dictionary stream of mixed-case letters with numbers and special characters, so simply changing the password was not a satisfactory course of action in my opinion (and I told them that), but of course, what the hell can I do when they just say "no"? Sue them? I wish I had that kind of time and money. For all I know, they could have hacked the email again and reset the clock, but I made sure to delete every contact, set the inbox to exclusive, and set it to delete junk immediately upon receipt before I abandoned the account, so if the assholes manage to steal it again, it won't be much use to them.

      The Xbox Live people were much, much more helpful with migrating my account to Gmail. For the days it took for the Live Mail team to respond to me, I was squared away in minutes with the XBL rep, and we even ended up bullshitting about old school video games for like 25 minutes afterwards.

      Funny how much different two arms of the same fucking company can be.

      • by vux984 (928602) on Wednesday April 25, 2012 @06:30PM (#39801037)

        What makes you think deleting the email account that minute would have made the slightest difference?

        They got in, skimmed it for the contact list, and they are done.

        They don't actually need access to your account to send email masquerading as being from you to spam your contacts from then on.

    • by FrootLoops (1817694) on Wednesday April 25, 2012 @07:09PM (#39801365)

      How is this Microsoft's problem? The possibilities are...
            (1) A guy writing articles about his new email address used a relatively weak password and someone guessed it
            (2) He logged in on a compromised machine
            (3) Microsoft has a genuine security problem

      The guy leaped right to (3), which seems the least likely to me. Since "my PC login" has also been compromised, (2) seems right. I can't help but feel this would have been pointed out long ago if the service were Gmail instead of Hotmail.

      Before it gets quoted back to me, he justified (3) by saying

      although I have to say from anecdotal evidence that Hotmail seems far more susceptible to account hijacking than Gmail.

      That's a very weak argument--it's based on anecdotal evidence and ignores possible differences between user populations. You'd think the editor of a magazine would take the time to write a thorough article instead of a knee-jerk one.

      • by danomac (1032160)

        From the article:

        Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.

        Yeah, not a very strong password. What the hell was he thinking? At least mix case and have one number. Passwords I use have mixed case, n

        • by Ruie (30480) on Wednesday April 25, 2012 @08:29PM (#39801933) Homepage

          From the article:

          Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.

          Yeah, not a very strong password. What the hell was he thinking? At least mix case and have one number. Passwords I use have mixed case, numbers and symbols in it so it's not so easy to guess.

          Why would a moderate strength password not be enough ? I am sure even MS rate-limits login attempts. And if someone got root to Hotmail servers you are screwed anyway.

          • While I tend to agree, I've always figured people get around rate limits by having a huge pool of addresses they try brute forcing. Rotate the addresses quickly enough to prevent being rate-limited (possibly using a botnet to spread the IPs around?). The odds of guessing correctly are essentially the same with either strategy (this actually has lower variance, though the expected number of compromised accounts should be the same).

            Someone mentioned a good possibility in this vein: he reused his password on a

    • Re: (Score:3, Funny)

      by sjames (1099)

      Other than that, Mrs. Lincoln, how was the play?

  • Backfires? (Score:5, Funny)

    by busyqth (2566075) on Wednesday April 25, 2012 @05:56PM (#39800529)

    Hotmail sent a message containing a malicious link to all of his contacts

    It seems to me that it was convincingly demonstrated that Hotmail has a few features that Gmail lacks.
    Good job Microsoft!

    • Ah yes... the always-free DAVIT suite! (Darwin AntiVirus Involuntary Testing)! ...but wait, they've had that for years now. You'd think GMail would have at least aped the feature once or twice...

  • Epic Fail (Score:5, Insightful)

    by girlintraining (1395911) on Wednesday April 25, 2012 @05:56PM (#39800533)

    Because Windows 8 practically forces you to login with your Windows Live/Hotmail details to access features

    So the Marketing department got the green light over the Security department during the development of Windows 8. Naturally, it is the Security department's responsibility to ensure that when the Marketing department does something stupid like linking account credentials between two separate administrative domains, it's Security's responsibility to sprinkle magic fairy dust over it.

    Okay, I'd like my $80,000 bonus now, and a letter of resignation from the chief designer of the Windows Live security team please. Also, let the marketing department know that we'll need to find someone to spin the bad press away, you know, the usual crap about it being a beta release and then suing him for violating the NDA that says he can only report positive experiences with the beta.

    • Hotmail login same as windows log on and windows store with CC? WOW windows 8 may flop so bad that they have to have a windows 9 next year or a windows 7.5

      • by Anpheus (908711) on Wednesday April 25, 2012 @06:13PM (#39800783)

        If you took the cursory amount of time to research this, you'd find that (a.) no, Microsoft doesn't expect business users to rely on authenticating against Windows Live, and (b.) that Windows Live log in is optional and not necessary, and a local account works just fine. You just don't get access to some easy synchronization items, but you can still access the windows store and apps by manually logging in.

        But hey, this is slashdot. Who needs to verify before they make grandiose claims?

        • by Zero__Kelvin (151819) on Wednesday April 25, 2012 @06:21PM (#39800911) Homepage
          ... well then ... it's a damn good thing that almost all Windows users are business users then! You know ... because regular folks would probably sacrifice security for usability if they even knew that was what they were doing. Thank God there aren't many of those types with 'puters connecting their tubes to the Internet!
          • by Anpheus (908711) on Wednesday April 25, 2012 @06:42PM (#39801157)

            That's irrelevant though, and you're just picking a fight. I was responding to Joe_Dragon's completely inane objection to Windows 8 from a business standpoint, see his title: "that will be a death note to enterprise use". No, it won't be, and I explained why.

            Do you want to engage on a debate on Windows Live logins as well? Because you should know before you start that the Windows Live login has minimum security requirements, doesn't appear to store the Windows Live password locally, and appears to follow some pretty damn good security practices. Now, I haven't fully verified all of these claims, but the login process for Windows Live login appears to use local passwords and certificates to verify the local account password against The Cloud(tm) when available. This is actually an astoundingly good process, as I don't think the hash of the Windows Live password is ever stored on the computer, rather, it can be used to access the local password, but I don't think physical access to a Windows 8 machine can possibly give you access to a user's Windows Live credentials. You can only gain access to local, unencrypted data.

            There are bits of this I haven't verified, but are based off hunches of exploring the system and poking and prodding it. I haven't disassembled the login routines to verify what I think is happening is the actual process, but it appears that Microsoft has very much followed good security practices here. I was extremely impressed to notice that enabling Windows Live login merely downloads a certificate to the user's local certificate store (encrypted by a local password) and that other mechanisms appear to be in place to mitigate security risks.

        • You forgot to mention the part where it was probably a piece of malware that sent the emails using his contact list from hotmail and pretty much had nothing to do with hotmail. I've seen malware that does hotmail AND gmail or outlook or thunderbird or whatever have you.

          It sounds like they made a large mistake. They asked a high touch user to evaluate something and when he had problems he blamed hotmail. I dont think anything that happened to him had much of anything to do with hotmail or windows 8.

          But it

      • Re: (Score:2, Insightful)

        Hotmail login same as windows log on and windows store with CC? WOW windows 8 may flop so bad that they have to have a windows 9 next year or a windows 7.5

        It won't have any domain authentication, no group policy, and not much as far as granular security (obviously). No, it was dead on arrival as far as business use is concerned, and Microsoft has already stated as much. Apparently Microsoft Bob, Windows ME, etc., and now Windows 8 demonstrates that Microsoft will continue its "Trek" release schedule; You know, that whole odd-even thing. :\

        • by dave420 (699308)
          You are sorely mistaken about domains and group policies. But why let facts get in the way of a good ol' moan at Microsoft.
          • by lgw (121541)

            I suspect he's thinking of the ARM-based devices, which can't join a domain. Windows 8 on Intel/AMD won't habe the limits the GPP is complaining about, but the ARM-based stuff will be useless to the corporate world.

    • Looking at it from a Black Hat perspective, if they're stupid enough to keep requiring that, then once Windows 8 gets released, things will become, well, interesting...

    • Re:Epic Fail (Score:4, Informative)

      by Anonymous Coward on Wednesday April 25, 2012 @06:18PM (#39800869)

      Because Windows 8 practically forces you to login with your Windows Live/Hotmail details to access features

      Google does exactly the same thing (even with google Checkout; at least the xbox account can only be used to buy games for that same account).
      Apple does the same thing, as far as I am aware.
      I'm not saying it's right, but it seems to be par for the course

  • RTFA (Score:2, Informative)

    by Anonymous Coward

    From the article (but curiously missing from the summary):

    (Update: For those of you inquiring about the strength of my Hotmail password – it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun. It’s not the world’s strongest password, and I can feel the parental glare of Davey Winder from 200 miles away, but it wasn’t that weak, either.)

    In other words he used a shitty password and got hit by a dictionary attack. Nothing new or interesting here. Move along.

    • by Soporific (595477)

      His password was the same as the one to his luggage...

      ~S

    • Re: (Score:3, Informative)

      by Anonymous Coward

      7-letter lowercase password that's not a dictionary word... that's about 33 bits worth. And that's not offline bruteforceable. What kind of retarded system doesn't do *something* after a few BILLION failed login attempts?

      • by SpryGuy (206254)

        What he DIDN'T say was that the accronym was "aaa" and the noun was "arch", so it really didn't take many brute-force attempts. :-P

    • Re:RTFA (Score:5, Insightful)

      by ais523 (1172701) <ais523(524\)(525)x)@bham.ac.uk> on Wednesday April 25, 2012 @06:05PM (#39800679)
      No way that a web-based service should allow that sort of dictionary attack to succeed. It's not too hard to deliberately spend a sufficiently long time authenticating someone (especially if there have been a bunch of password failures recently on the account / from that IP) that dictionary attacks become unfeasible; it's not like you get to attack the hash. (Look at Wikpedia, for instance, where three login failures cause you to need to fill in a CAPTCHA to log in.)
      • Funny, I wrote a brute force login app for Hotmail back in like 2002, to see if such a thing was feasible (brute forcing that is). After about 5 failed login attempts, each one after that took over a minute. When did they undo this?
        • Re:RTFA (Score:5, Informative)

          by IamTheRealMike (537420) <mike@plan99.net> on Wednesday April 25, 2012 @06:33PM (#39801077) Homepage

          Yes, no serious web mail service can be compromised by brute force attacks and that is not what happened here.

          Almost certainly, the password in question has been re-used at some other third party website that then got hacked, its password database dumped and the hashes reversed using video cards.

          I work on account security at Google and have spent the last 2.5 years of my life on Gmail anti-hacking. So I'm all too familiar with this type of problem, where spammers mail your contacts with a link to their online stores (or malware). Really feel for the Hotmail team here - it's a hard problem to solve. That said, we've made a lot of progress over time. We've blocked very large numbers of logins to compromised accounts (often between half a million to a million accounts per week). There are still occasional campaigns that get past us but it's getting rarer all the time. It may well be that this guys password was the same on Gmail (ie, he had one password for everything), and there was an attempt made against his account, but we redirected it to the identity verification quiz and thus it was blocked. It wouldn't be remarkable if so.

          I did a public talk at RIPE64 [ripe.net] on the topic of signup and login security at Google, for those who are interested. It's about 30 minutes long.

          • BTW I don't own a mobile phone, can you add an option to quit bugging me about 2-factor authentication?
          • Re:RTFA (Score:5, Informative)

            by DrkShadow (72055) on Wednesday April 25, 2012 @08:25PM (#39801909) Homepage Journal

            This happened to me. Around October last year, I logged in, checked e-mail, and left the tab to do something else. About 20 minutes later, I went back to the tab, clicked Inbox, and... nothing happened. Clicked a few more things, nothing expected was happening. Hit refresh, was redirected to the login page. This is _not_ typical.

            When I logged in again, I had 30 bounceback e-mails. I checked sent items, I had 50 new sent e-mails, about 5 addresses each, to my entire contact list with a slew of bad URLs. A couple people contacted me about it. I checked the sent e-mail headers, and the sending IP had an address from Russia, China or some such.

            Compromised password? Not likely -- the password on my e-mail is completely unique, had never been used anywhere else, greater than 10 characters, computer-generated. I never type it on public machines, and hadn't used Hotmail on anything but my work machine, home machine (Gentoo) and Ubuntu box in... a long, long time. They would've needed a keylogger to get it. I scanned my work machine for viruses. Nothing. Perhaps there's an Ubuntu bug that somehow got exploited on me, but that box has never connected directly to the internet.

            I did some research, and the best that I could come up with is a 2011 attack where if an attacker sent you a bad URL, and you opened the e-mail, they could get your session cookie, log in and act like you. That is the _only_ thing that I found. But it was supposed to be fixed earlier in the year, and I don't recall opening any odd e-mails -- clearing the junk folder, seeing the subject, but not opening them. A few from expected sources, sure, but nothing that struck me as odd.

            So I changed my password and immediately stopped using the Hotmail web interface. The problem has not recurred, so suggests it's not an Ubuntu bug. This suggests, then, that there is still a session-hijacking bug in Hotmail somewhere that persists to today.

            Don't always assume it's user error if you can't figure out the flaw.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      I'm not so sure, other AC
      Any internet exposed service of non-tribal size will tarpit/lockout an account LONG before a string of characters that long is brute forced/dictionaried.

      For a long time I've seen a LOT of hotmail accounts compromised. Actually, pretty much everyone I've known that has ever used a hotmail account has had it hacked. I would not be surprised if there's another vector here.

    • That "dictionary attack" should've triggered something on Hotmail's servers after, oh, the 48 millionth failed login attempt in less than five minutes...

  • by Anonymous Coward

    Or did he just use a crappy password or have malware already on his computer? I know it's popular to bash MS, and I dislike the account convergence we are rapidly screaming towards, but blaming the service when it was more likely that he created the vulnerability is just tacky.

  • weak password (Score:5, Informative)

    by cratermoon (765155) on Wednesday April 25, 2012 @05:59PM (#39800577) Homepage
    From the story: 'For those of you inquiring about the strength of my Hotmail password - it was a seven-letter string of lowercase letters. Not a dictionary word, but part acronym, part proper noun.'
    • Re:weak password (Score:4, Interesting)

      by TJ_Phazerhacki (520002) on Wednesday April 25, 2012 @06:01PM (#39800611) Journal
      Sure. But was it actually Hotmail that was hacked, or the way more likely cause of a non-unique password or existing compromise on his pc? Hell, I know script kiddies who would SALIVATE at the chance to make Hotmail look bad for teh lulz...
      • Re:weak password (Score:5, Insightful)

        by cratermoon (765155) on Wednesday April 25, 2012 @06:05PM (#39800677) Homepage
        Could be any of those things, or all of those things. In a fully Microsoft monoculture of shared architecture and sloppy security practices, it only takes one weak link to break the whole chain.
        • Thing is that you can have your browser up and running and you're logged into your web mail service. Or perhaps you saved the password in your browser. Then you log into facebook and click on some dumb link or perhaps you go to some malicious website. Some errant javacript loads up your hotmail account in an iframe, your browser helpfully provides the credentials or a valid cookie and the script then proceeds to propagate itself to all your contacts.

          This does not seem hotmail specific at all.

        • The problem is, in a Microsoft monoculture, there's lots of weak links - the password a human has to type in - everywhere.

          Even in this case, it's a 7 letter password that's not (just) a dictionary word and cant be hacked offline (presumably). That's not that weak a link, yet it was broken.

    • 7 characters alpha - that's terrible. Bruteforce can find that in seconds, no dictionary needed.

  • In other news it's my home builders fault that I left my keys in my door and I was robbed.
  • by Anonymous Coward on Wednesday April 25, 2012 @06:05PM (#39800673)

    It's only recently (Nov. 2010) that hotmail even had the option of using SSL:

    http://windowsteamblog.com/windows_live/b/windowslive/archive/2010/11/09/hotmail-security-improves-with-full-session-https-encryption.aspx [windowsteamblog.com]

    And SSL still isn't the default option for hotmail.

    Gmail at least had the option for SSL for many many years, and google made SSL the default a few years back (after they got hacked by the Chinese).

    • by ewanm89 (1052822)
      No, infact, their enable to make it default on your account warns you that the windows mobile live app and some others will stop working.
  • by X0563511 (793323) on Wednesday April 25, 2012 @06:08PM (#39800719) Homepage Journal

    Why is this in idle? After that blatant dupe earlier...

    You are grounded!

  • by Groo Wanderer (180806) <charlie AT semiaccurate DOT com> on Wednesday April 25, 2012 @06:10PM (#39800759) Homepage

    MS is continually bashed for security reasons, and mocked for being a virus spreading engine etc etc. Those who continually make such silly and baseless allegations, as evidenced by the story above, don't even once think about the alternatives and THEIR security problems.

    After dumping Windows and MS products in general a few years ago, I have had a first hand hard lesson in the probelms of 'alternative' OSes, if you can call them that. My problems have been nearly unending since switching to Linux, I mean just last month, or was it the month before, my laptop crashed. This wasn't the first time either, it routinely happens 2-3 times a year.

    Think about it people, if you don't use MS, you might not have horrific security problems that compromise all conected devices and identities, but you may have to suffer through a similar fate to me. Be careful what you ask for, and THINK before you whine in public.

                      -Charlie

    • by Microlith (54737)

      Unfortunately, due to Poe's Law (or whatever reciprocal exists for fanboys) I cannot discern if this post is just satire or if it's dead serious.

  • by SpryGuy (206254) on Wednesday April 25, 2012 @06:13PM (#39800787)

    ...perhaps this will light a fire under Microsoft to get their system a bit more secure (in spite of weak passwords like the one the guy used), and not allow things like spamming all contacts without some second-source notification/response, or some other easy to implement blocks to this sort of behavior.

    And the result for consumers will be a more robust system in general (Microsoft Account/WindowsLiveID, as well as HotMail, Win8, XBoxLive, etc).

    Failures often spur innovation and improvement. They're not always a bad thing (though this one is particularly embarassing, it may be just that level of embarassment that drives the motiviation to work on solutions to the problem).

  • by silentcoder (1241496) on Wednesday April 25, 2012 @06:14PM (#39800797) Homepage

    http://xkcd.com/936/ [xkcd.com]

    Truth be told the passwords we actively encourage are no stronger than what he used.
    If you want a really strong password, use a sentence of random words. Password length matters far more than password content - this is a simply provable fact - too bad hardly anybody in security realizes it.

    • by swillden (191260) <shawn-ds@willden.org> on Wednesday April 25, 2012 @07:44PM (#39801605) Homepage Journal

      http://xkcd.com/936/ [xkcd.com]

      Truth be told the passwords we actively encourage are no stronger than what he used. If you want a really strong password, use a sentence of random words. Password length matters far more than password content - this is a simply provable fact - too bad hardly anybody in security realizes it.

      That XKCD strip is consistently misunderstood. Random words aren't more secure than a sequence of random letters, numbers and symbols. For example, a random sequence of seven letters (mixed case), symbols (assume 10 of them) and numbers has the same amount of entropy as the four dictionary words Munroe mentions. Eight characters is signficantly stronger and four words. "Length matters more than content" is an oversimplification to the point of meaninglessness. Arguably, Munroe's example is shorter, since it's a sequence of four randomly-chosen symbols, rather than seven or eight. It's just that the symbols are chosen from a larger set (2048 vs 72).

      The point of the strip is that, for most people, the sequence of words provides a strong password that is easier to remember. If remembering your password is your problem, then a sequence of random words is a good solution (but don't fall for the temptation to pick a favorite sentence). However, Munroe's example is almost four times as many letters to type -- call it three times as many keystrokes after accounting for the need to hit the shift key a few times in a random character sequence. Even worse, the fact is that many (lame) authentication systems won't accept very long passwords. In many ways multi-word passwords are impractical.

      Personally I optimize for ease of typing, not ease of memorization. I use my most important passwords sufficiently frequently that remembering them is no problem, but being able to type them quickly and accurately can be. I use a random password generator to generate a random 10-character sequence, then I permute it for ease of typing. Permuting in a fairly predictable way (grouping shifted characters and arranging to alternate touch-typing hands between pairs of characters) reduces the entropy a little, which is why I generate 10 characters rather than eight or nine.

      • by c++0xFF (1758032)

        My company has some crazy password policies, to the point that remembering all my passwords is quite a challenge. So, I tried the XKCD method, and this is what I found:

        1. Typing four words is a lot of typing, but it's amazingly fast due to muscle memory! Just make sure your dictionary has relatively short words in it.

        2. Changing passwords often isn't a problem, even when you have multiple accounts to deal with.

        3. I think five short words with a smaller dictionary) is better than four words with a large

  • Not uncommon (Score:5, Interesting)

    by krelian (525362) on Wednesday April 25, 2012 @06:16PM (#39800833)

    This is not the first time I hear about a hotmail account being hacked to send malicious links. I had a few friends with the same problem, always hotmail. It's possible there is a serious security problem with the service. And even if there isn't, logic should be in place to suspend account who start mass emailing their contact lists with suspicious links, it shouldn't be that hard to stop.

    • Re:Not uncommon (Score:4, Insightful)

      by FrootLoops (1817694) on Wednesday April 25, 2012 @06:53PM (#39801249)

      And even if there isn't, logic should be in place to suspend account who start mass emailing their contact lists with suspicious links, it shouldn't be that hard to stop.

      The same thing was mentioned above, but all a hacker needs is the contact list. They can spoof your email address and bypass Microsoft entirely afterwards. Of course the same is true of all email providers.

  • by smack.addict (116174) on Wednesday April 25, 2012 @06:20PM (#39800907)

    His password is 7 lower case characters. It's a wonder his GMail account wasn't hacked ages ago.

  • Hotmail's default isn't SSL as far i know, and their chat service isn't ssl or encrypted or even able to run encrypted ( unlike google's chat/XMPP). So it isn't exactly safe, not long ago someone was trying an dictionary attack of some sort for days on my MSN messenger account as it prevented me from logging in due to "too many password attempts" . ( when i had not been the one doing those attempts.)
  • by Jafafa Hots (580169) on Wednesday April 25, 2012 @06:43PM (#39801163) Homepage Journal

    and their new layout sucks. Totally. No colors in labels, screen spacing all wasted, hard to look at.
    Meanwhile hotmail HAS improved.

    I still prefer gmail, but the difference has narrowed mostly because of gmail's steps backwards into "Apple iTunes ripoff "I'm stupid like your grandma" design concepts. They fucked up something great and made it merely OK.

    Hotmail's still sucks in many ways, but their inbox os SO much easier to clean out now, that single improvement makes hotmail easier in many ways to use than gmail.

    If gmail were to ditch the shitty "everything has to be big and rounded and words have to disappear and be replaced by vague non-descriptive icons" blech, AND institute cleaning like hotmail,. they'd be miles ahead.

    Now... if either took the invention of usenet provider Easynews, and allowed a "ranges" feature, they would be golden. If you use easynews, you know what I mean.

    If not, it works like this - take a page of 300 items each with individual selection boxes. Click one near then top, one lower, another lower still, and then one more. Click "select ranges"

    You get the whole range between your 1st and 2nd selection selected, items afterward are unselected until your NEXT selection, and those between that and the end selection are selected.

    Hard to explain, but it's fucking BRILLIANT. No other site I've seen uses that, and it's fucking GREAT.

  • by SuperDre (982372) on Thursday April 26, 2012 @02:36AM (#39803845) Homepage
    The main issue now is, how did it get hacked, as millions of users are using hotmail/live-platform daily without problems.. Maybe the reporter was a bit dumb and put his login-account details on a hazy-website for some reason (like an external importing app, or a maulicious App for his phone/tablet/whatever)..
    It's not like an account can be hacked that easily (just as easy as a GMail account could be hacked)..

    So the hacking of his account doesn't have anything to do with the service itself..

If a listener nods his head when you're explaining your program, wake him up.

Working...