Menashe Eliezer
15/10/03, 17:30
Microsoft Hotmail Vulnerability
Release Date:
October 15, 2003
Severity:
Critical (Potential Hotmail worm)
Systems Affected:
Internet Explorer and any software application used for reading Hotmail =
messages.
Status:
Microsoft has already patched the Hotmail system.
Description:
Finjan Software discovered a new critical cross site scripting =
vulnerability in Microsoft's Web-based e-mail service, Hotmail. This =
vulnerability had the potential to allow hackers to develop an attack =
that could have caused significant computer damage during regular e-mail =
use. The new vulnerability was reported to Microsoft and fixed within =
24hrs.
This vulnerability resulted from the failure of Hotmail's active content =
filter to adequately block Active X controls and affected all system =
platforms that read Hotmail e-mail messages. An exploit could have =
launched automatically once a user opened an e-mail message. The =
vulnerability could have also potentially allowed a worm to read the =
address book of a Hotmail account, replicate and send itself to everyone =
in the address book, and have this process repeat at an exponential =
rate. This potential very dangerous Hotmail worm could have a large =
impact to the Hotmail user community. Due to preliminary detection and =
reporting to Microsoft, this scenario was prevented.
"This vulnerability was discovered and reported to us by Finjan =
Software", said Stephen Toulouse, security program manager, Microsoft =
Corporation. "We worked with Finjan Software to fix the issue within 24 =
hours and helped protect Hotmail users."=20
"Finjan asked us to replicate the vulnerability to validate their =
findings," said Drew Copley, research engineer at eEye Digital Security. =
"Their discovery of the vulnerability in Hotmail is accurate and had the =
potential to allow hackers to steal contacts, write e-mails in the name =
of the Hotmail user, and run active scripting. This security issue was =
extremely dangerous because these are the components required to create =
an automated, mail-borne worm."
=20
Technical details:
The potential worm could have done anything that the user could do. It =
was a potentially automatic attack. Users had to simply read the =
infected email message.
This was a cross-site scripting vulnerability of the Hotmail server.
The purpose of Hotmail's active content filter is to block the injection =
of any active content into Hotmail messages. However, the basic failure =
that allowed this vulnerability is that there was no blocking of =
dangerous tags if they are prefixed with more than two dashes, e.g. =
---<LINK, ---<object, ---<iframe.
For example: <iframe src=3Dhttp://www.finjan.com>=20
The LINK tag can be used to call a CSS file that includes JavaScript =
code.
The injected JavaScript code is responsible for:
-Getting Passport/Wallet cookies.
-Automatic launching of malicious code.
-Identity theft using a spoofed re-login window (suggested by =
http-equiv@malware.com).
-Read and Disclose User inbox & contacts.
-Sending an e - mail message.
The JavaScript code has been used for creating demos, but Finjan =
Software won't reveal this source code.
The ActiveX control could have been used for a destructive payload of =
the propagating worm. It also allows propagation to non-Hotmail users.
The basic attack does not require an ActiveX control. The ActiveX =
control is the payload that can be used to extend the attack to =
non-Hotmail users, or to perform any malicious activity, including =
formatting of the hard disk
Upon using the ActiveX control, end user may get a security warning. It =
depends on the security setting of the browser. An example: =
http://www.finjan.com/mcrc/demos/activex.cfm (Click on the 'test me' =
button after reading the disclaimer)
Protection:
This specific vulnerability has been eliminated by Microsoft based on =
Finjan Software notification. Finjan's content security products: =
SurfinGate for Web, SurfinGate for E-mail, SurfinShield Corporate and =
SurfinGuard Pro, provided proactive defense against this Hotmail =
vulnerability prior to its detection and correction. Finjan's patented =
behavior inspection engine will protect computer users from similar =
future vulnerabilities and comparable potential exploits.
Credit: Dror Shalev and Menashe Eliezer.
Reviewers: Drew Copley (thePull) , Liu Die Yu, Jelmer and http-equiv.
=20
Release Date:
October 15, 2003
Severity:
Critical (Potential Hotmail worm)
Systems Affected:
Internet Explorer and any software application used for reading Hotmail =
messages.
Status:
Microsoft has already patched the Hotmail system.
Description:
Finjan Software discovered a new critical cross site scripting =
vulnerability in Microsoft's Web-based e-mail service, Hotmail. This =
vulnerability had the potential to allow hackers to develop an attack =
that could have caused significant computer damage during regular e-mail =
use. The new vulnerability was reported to Microsoft and fixed within =
24hrs.
This vulnerability resulted from the failure of Hotmail's active content =
filter to adequately block Active X controls and affected all system =
platforms that read Hotmail e-mail messages. An exploit could have =
launched automatically once a user opened an e-mail message. The =
vulnerability could have also potentially allowed a worm to read the =
address book of a Hotmail account, replicate and send itself to everyone =
in the address book, and have this process repeat at an exponential =
rate. This potential very dangerous Hotmail worm could have a large =
impact to the Hotmail user community. Due to preliminary detection and =
reporting to Microsoft, this scenario was prevented.
"This vulnerability was discovered and reported to us by Finjan =
Software", said Stephen Toulouse, security program manager, Microsoft =
Corporation. "We worked with Finjan Software to fix the issue within 24 =
hours and helped protect Hotmail users."=20
"Finjan asked us to replicate the vulnerability to validate their =
findings," said Drew Copley, research engineer at eEye Digital Security. =
"Their discovery of the vulnerability in Hotmail is accurate and had the =
potential to allow hackers to steal contacts, write e-mails in the name =
of the Hotmail user, and run active scripting. This security issue was =
extremely dangerous because these are the components required to create =
an automated, mail-borne worm."
=20
Technical details:
The potential worm could have done anything that the user could do. It =
was a potentially automatic attack. Users had to simply read the =
infected email message.
This was a cross-site scripting vulnerability of the Hotmail server.
The purpose of Hotmail's active content filter is to block the injection =
of any active content into Hotmail messages. However, the basic failure =
that allowed this vulnerability is that there was no blocking of =
dangerous tags if they are prefixed with more than two dashes, e.g. =
---<LINK, ---<object, ---<iframe.
For example: <iframe src=3Dhttp://www.finjan.com>=20
The LINK tag can be used to call a CSS file that includes JavaScript =
code.
The injected JavaScript code is responsible for:
-Getting Passport/Wallet cookies.
-Automatic launching of malicious code.
-Identity theft using a spoofed re-login window (suggested by =
http-equiv@malware.com).
-Read and Disclose User inbox & contacts.
-Sending an e - mail message.
The JavaScript code has been used for creating demos, but Finjan =
Software won't reveal this source code.
The ActiveX control could have been used for a destructive payload of =
the propagating worm. It also allows propagation to non-Hotmail users.
The basic attack does not require an ActiveX control. The ActiveX =
control is the payload that can be used to extend the attack to =
non-Hotmail users, or to perform any malicious activity, including =
formatting of the hard disk
Upon using the ActiveX control, end user may get a security warning. It =
depends on the security setting of the browser. An example: =
http://www.finjan.com/mcrc/demos/activex.cfm (Click on the 'test me' =
button after reading the disclaimer)
Protection:
This specific vulnerability has been eliminated by Microsoft based on =
Finjan Software notification. Finjan's content security products: =
SurfinGate for Web, SurfinGate for E-mail, SurfinShield Corporate and =
SurfinGuard Pro, provided proactive defense against this Hotmail =
vulnerability prior to its detection and correction. Finjan's patented =
behavior inspection engine will protect computer users from similar =
future vulnerabilities and comparable potential exploits.
Credit: Dror Shalev and Menashe Eliezer.
Reviewers: Drew Copley (thePull) , Liu Die Yu, Jelmer and http-equiv.
=20