Hotmail Hack

[laserblazer]

One of our TAs has just knocked on my door to say her hotmail account has been hacked and spam sent to evryone on her addressbook. She says if she tries to log in to her account a message comes up asking for her mobile phone number to reset the account. Sounds a bit iffy to me?

[mdench]

not sure bout hotmail but sometimes when people sign up for online services it asks you for your mobile number then you if you lose access you can request a reset / access code to be sent to your mobile which you can then enter online and then reset your password. Much easier way of regaining access and proving the account is yours.

 

Obviously try to be sure that the page requesting the mobile number is part of the hotmail site and that it looks legit

[synaesthesia]

It's quite common and if it has been hacked it's just a password jobby - there's no way they can make a popup that asks for mobile number so just give it a once over and should be OK.

[X-13]

She says if she tries to log in to her account a message comes up asking for her mobile phone number to reset the account. Sounds a bit iffy to me?

 

I got this. It's semi-legit. [Actual Microsoft thing, douche move.]

 

The account is all but disabled, you can't send any e-mails. I've had thing on 2 old [unused] accounts.

 

 

It's quite common and if it has been hacked it's just a password jobby - there's no way they can make a popup that asks for mobile number so just give it a once over and should be OK.

 

But they can. And do.

 

It comes up if you haven't given Microsoft your phone number.

[synaesthesia]

Sorry, by "they" I mean the hax0rs.

[X-13]

Sorry, by "they" I mean the hax0rs.

 

Oh, oops... 6_9

 

Well... "they" could aswell.

 

[Off of the top of my head, with only 1 coffee.]

 

Set up the page you want displayed, host it and mask the URL to appear legit

set up a cookie to see if they said not now or do it

set up a redirection going from Hotmail main page to fake page, with cookie check [if exist no redirect.]

???

PERSONAL INFORMATION!

 

 

//Note: URL masks won't really work anymore as browsers strip then down and display it properly.

//[except here... bloody IE7]

//Spoofing the IP may allow the URL to be masked, but I can't be bothered to check.

[dhicks]

One of our TAs has just knocked on my door to say her hotmail account has been hacked and spam sent to evryone on her addressbook.

 

Just to add that there seems to have been a bit of a spate of this over the past week or two. I think it's just a succesful phishing email ("Log in here with your Hotmail details to read the message!") that seems to be doing the rounds, nothing that techincal, no password-breaking or keyboard-recording code, just someone convincing people to hand over their password.

[Garacesh]

I had to do this (to my dismay) to reactivate my hotmail account so I could transfer my xbox profile to a new console. I haven't used my hotmail address in years since moving to gmail full-time. It's legit, albeit an annoyance.

[Davit2005]

We had one of our teachers Hotmail do this. I suggested he change his password, seems ok for last 2-3 weeks since.