Microsoft took part of its MSN Web site offline over the weekend, after it learned of a flaw that could let an attacker gain access to Hotmail accounts, the company said.
The MSN Web site, http://ilovemessenger.msn.com/, contained a so-called cross-site scripting flaw, a Microsoft representative said on Monday. In its initial review of the issue, the company found that an attacker could use the vulnerability to obtain "cookies" from Hotmail users by getting them to click on a malicious URL. That could then grant access to those e-mail accounts, the representative said.
Cookies are small files stored on a computer that contain user data. Hotmail is one of the world's most popular Web-based e-mail services, with more than 200 million active accounts, according to Microsoft.
Microsoft's acknowledgement of the Hotmail issue comes after the security hole was disclosed on Saturday by Alex de Vries, a Dutch programmer, on the Net-Force Web site for security enthusiasts.
Cross-site scripting flaws are errors in Web site design, not in Web browsers, and were discovered more than five years ago. Microsoft has described the flaws as serious security vulnerabilities.
Hotmail customers are no longer at risk, according to Microsoft. "The 'I Love Messenger' Web site has been disabled," the company representative said in an e-mail statement. The site, which hosts emoticons, display pictures and backgrounds for MSN Messenger, Microsoft's free instant messaging service, will be restored once the issue has been resolved, the company said. On Monday afternoon PT, the I Love Messenger Web address was redirecting users to the main MSN Messenger Web site.
The Hotmail and MSN flap comes within a week after Microsoft acknowledged that its South Korean MSN Web site had been hacked. Attackers placed malicious software on the news section of MSN Korea in an attempt to steal passwords for "Lineage," a popular online game in Asia.
CNET's reporter must be brain dead to miss the real story which is that Microsoft disabled Outlook Express access to Hotmail starting late last week even for paid up customers to premium accounts. The service still isn't fully restored. Check out Usenet forums under Microsoft's newsgroup for Outlook Express to see the message traffic.
WebDAV ("outlook Express support") is still working!
WebDAV ("outlook Express support") is still working!
I have my (free) Hotmail account polled hourly, and there's no problem except the usual occasional connection failures (an average of one failure every three days in the past year). Just a minute ago it worked!
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
Whether Apple will release a new iPad next month doesn't seem to be the question as much as what day it will happen. A new rumor has it down to the day.
Tommy Jordan, the man who shot his daughter's laptop for YouTube, gets a visit from police and child protection services. Oh, and Good Morning America.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
As UC Berkeley students, the co-founders of "Back to the Roots" discovered they could grow mushrooms using recycled coffee grounds. Now their mushroom kit sells at grocery stores across the country.
system Windows, comes the i love messenger website!
Did we really think that the people who brought us windows would
bring us a website without a security flaw? *giggles*
I have my (free) Hotmail account polled hourly, and there's no problem except the usual occasional connection failures (an average of one failure every three days in the past year). Just a minute ago it worked!
I was really pissed that Microsoft kept a 1meg limit to e-mails and was ready to move to GMAIL when they suddenly increased my limit to 250MB.
Now they have discontinued supporting Hotmail in Outlook Express for free accounts.
Microsoft just seems to be making bad decisions daily.
They just made my decision to move to GMAIL !!
Asta la vista microsoft.