📎 AI Summary:
The thread discusses a security vulnerability in Hotmail that allowed attackers using a Firefox add-on to remotely reset passwords and access accounts by bypassing token protections. The original poster highlights that Microsoft was quickly notified, fixed the issue within a day, and publicly announced the patch shortly after. A subsequent comment expresses a somewhat skeptical or sarcastic sentiment regarding Microsoft's response to the security flaw.
A

Adamsappleone

U.S.Navy D.A.V.
Member details
Joined
Aug 2, 2009
Messages
1,642
Thread Author #1
It took Redmond 1 day to kill a threat that allowed users with a Firefox add-on (Tamper Data) to remotely reset the password of a Hotmail account and allowing them to access the outgoing HTTP request, then modify the data.

Remote attackers can bypass the password recovery service to set up a new password and bypass in place protections (token based). The token protection only checks if a value is empty, then blocks or closes the web session. A remote attacker can, for example, bypass the token protection with values “+++)-“. Successful exploitation results in unauthorized MSN or Hotmail account access.
Click to expand...

Microsoft was notified April 20, 2012, applied the fix April 21, 2012, then publicized it April 27, 2012

Quote from Microsoft squashes Hotmail password hijack bug ? The Register
 

You must log in or register to reply here.