Massive phishing scheme affects Microsoft Hotmail accounts - Security Bytes
Home > IT Blogs > Security Bytes > Massive phishing scheme affects Microsoft Hotmail accounts
« RSA banking Trojan research underscores problem tracking cybercriminals
Melissa Hathaway joins Harvard’s Kennedy School as senior advisor »
» VIEW ALL POSTS Oct 6 2009   3:03PM GMT

Massive phishing scheme affects Microsoft Hotmail accounts



Posted by: Robert Westervelt
Phishing, webmail security

Hotmail passwords stolen; Gmail, Yahoo affected as well.

Microsoft is blaming a highly successful phishing scheme for pilfering thousands of passwords to Microsoft Hotmail Live email account holders. In a blog posting, Microsoft said the Hotmail credentials were stolen over the weekend and posted to a third party website. In an update it said it was working to block access to exposed accounts.

Microsoft has set up a process for affected account holders to reclaim their Hotmail account.

Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers. As part of that investigation, we determined that this was not a breach of internal Microsoft data and initiated our standard process of working to help customers regain control of their accounts.

According to a report by Neowin.net, an anonymous user posted details of the phished account credentials Oct. 1 at pastebin.com, a site commonly used by developers to share code snippets. The list contained information on more than 10,000 accounts, according to the report.

An updated Neowin report found other webmail services affected as well including Comcast, Earthlink account holders.

Attackers have been stealing credentials to webmail accounts for years. The accounts are targeted to steal information or to be used as a platform to set up spamming runs before the accounts are identified and shut down by the email provider. If anything the message here is to get into the habit of regularly changing your passwords.

AddThis Social Bookmark Button     Comment     RSS Feed     Email a friend

Comment on this Post


You must be logged-in to post a comment. Log-in/Register

BethJones  |   Oct 7 2009   5:41PM GMT

Bear in mind this wasn’t a single phishing attack. It was more than likely a multi-vectored attack, using email phishing, keylogging botnets and rogue social network applications. We at Sophos have seen indications of this, given the number of “fake” email addresses, as well as a list of “kid culture” passwords. See our blog posts:

 <a href="http://www.sophos.com/blogs/sophoslabs/v/post/6719" title="http://www.sophos.com/blogs/sophoslabs/v/post/6719" target="_blank">http://www.sophos.com/blogs/sophoslabs/v…</a>
 <a href="http://www.sophos.com/blogs/chetw/g/2009/10/06/hotmail-heist-update-release/" title="http://www.sophos.com/blogs/chetw/g/2009/10/06/hotmail-heist-update-release/" target="_blank">http://www.sophos.com/blogs/chetw/g/2009…</a>

The rogue applications is definitely worth noting. While people may be wiser to email phishing attacks, social media sites are much newer so the trust factor is still high. Remember what the trust factor was like in the 1990’s with email? I am on several of the social media sites and I see rogue applications that are collecting email addresses and passwords at least a couple times a month. The whole “If you liked this application, send it to your friends” is really a phishing attack - it asks for your email address and password to “send” to your friends. The phishers then have your information.

We here at Sophos also saw in the list a lot of kid culture passwords, which lends credit to the multi-vectored attack. An email phish wouldn’t work on a small child, but a “send this application to your friends” would.

Another point worth noting is that this isn’t the fault of the email providers. Their technology wasn’t in use at the time of the attack. Someone entered in the credentials. It would be just like handing them over to a stranger in the street. No tech from Google, Hotmail, etc would be in use there either.


 
Visit Information Security Home |   Information Security News  |  Information Security White Papers  |  Information Security Videos  |  Information Security Resources