 |
| CNN WEB SITES: |
|
| TIME INC. SITES: |
| MORE SERVICES: |
| video on demand |
| video archive |
| audio on demand |
| news email services |
| free email accounts |
| desktop headlines |
| pointcast |
| pagenet |
| DISCUSSION: |
| message boards |
| chat |
| feedback |
| SITE GUIDES: |
| help |
| contents |
| search |
| FASTER ACCESS: |
| europe |
| japan |
| WEB SERVICES: |
From...
HotMail scrambles to fix password-security glitch
August 27, 1998
Web posted at: 10:40 AM EDT
by James Niccolai
(IDG)
-- Microsoft's HotMail subsidiary is scrambling to fix a security glitch
in its free e-mail service that could allow someone to steal passwords
from HotMail members, a spokesperson with the company's public relations
firm said Tuesday.
The security breech was uncovered Monday by a Web developer at Canadian firm Specialty Installations, which has posted an explanation of it on the company's "Because-We-Can" Web page.
|
|
||
|---|---|---|
 |
IDG.net home page | |
| PC World home page | ||
| FileWorld find free software fast | ||
| Make your PC work harder with these tips | ||
| Reviews & in-depth info at IDG.net | ||
 |
IDG.net's desktop PC page | |
| IDG.net's portable PC page | ||
| IDG.net's Windows software page | ||
| IDG.net's personal news page | ||
| Questions about computers? Let IDG.net's editors help you | ||
| Subscribe to IDG.net's free daily newsletter for computer geniuses (& dummies too) | ||
|
Search IDG.net in 12 languages |
||
| News Radio | ||
 |
Fusion audio primers | |
|
|
Computerworld Minute | |
The scheme involves sending an e-mail message to a HotMail user that contains a particular JavaScript program. When the user opens the e-mail the JavaScript program starts running almost instantly, creating a message box that tells the user their account access has timed out, and asking them to reenter their log-in information.
The victim's user name and password are then winged back to the person who sent the malicious e-mail. Armed with that information, the intruder could delete, send, and read the victim's e-mail, access the victim's address book, and check messages on other mail servers the victim may have configured to be accessible from the HotMail account, according to Specialty Installations.
"HotMail is working right now on a permanent fix ... they're working flat out," said Peter Ross, a spokesperson for HotMail's public relations firm. HotMail cannot say at the moment how long it will take to implement the fix, he added.
As a temporary measure, HotMail users can disable the JavaScript support in their browser software, Specialty Installations advised.