ad info




CNN.com
 MAIN PAGE
 WORLD
 ASIANOW
 U.S.
 LOCAL
 POLITICS
 WEATHER
 BUSINESS
 SPORTS
 TECHNOLOGY
   computing
   personal technology
   space
 NATURE
 ENTERTAINMENT
 BOOKS
 TRAVEL
 FOOD
 HEALTH
 STYLE
 IN-DEPTH

 custom news
 Headline News brief
 daily almanac
 CNN networks
 CNN programs
 on-air transcripts
 news quiz

  CNN WEB SITES:
CNN Websites
 TIME INC. SITES:
 MORE SERVICES:
 video on demand
 video archive
 audio on demand
 news email services
 free email accounts
 desktop headlines
 pointcast
 pagenet

 DISCUSSION:
 message boards
 chat
 feedback

 SITE GUIDES:
 help
 contents
 search

 FASTER ACCESS:
 europe
 japan

 WEB SERVICES:
Computing

Hotmail hole: hack or bug?

mail
On this screen, one of the sites that could be used as a gateway, users were able to enter any Hotmail user name to access the account.
mail account
Once the username was entered, anyone could send, read and forward e-mail from that account. Hotmail has over 40 million subscribers.  
 

August 30, 1999
Web posted at: 2:57 p.m. EDT (1857 GMT)

By Robin Lloyd
CNN Interactive Senior Writer

(CNN) -- The cause of a Hotmail security breach remained unclear Monday, after millions of e-mail accounts provided by Microsoft were accessible to anyone.

The breach worked via several Web addresses, which prompted for a Hotmail username. Once a username was entered -- no password required -- the Hotmail account appeared and the mailbox was available. However, access failed later in the day.

The breach allowed CNN Interactive to open all accounts it tested. But e-mail messages couldn't always be opened. The bug first was reported in the Swedish newspaper Expressen's Monday editions.

The breach allowed users to read and forward a member's old messages, read new messages and send e-mail in some cases under the name of the user -- assuming the member's identity.

Hotmail, which has had trouble with security breaches in the past, boasts 40 million subscribers. The free Hotmail service was down for an hour to respond to the situation.

"It was apparently a problem where a malicious hacker with specific knowledge of advanced Web development language was able to gain access to the servers," according to a Microsoft statement.

Microsoft said it introduced code Monday to prevent future attacks and all its servers were up again after the morning shutdown. All Hotmail users would receive an e-mail from the service notifying them of the situation, a Microsoft spokeswoman said.

However, Richard Smith, a computer security specialist, said the fault for the security lapse may lay with Microsoft.

"It looks like a bug at the Hotmail servers," said Smith, president of Phar Lap Software Inc. in Cambridge, Massachusetts. "They are logging in through some sort of back door."

Smith said the back door might have been through a new service Microsoft released this weekend called Passport. That service allows the use of Hotmail usernames and passwords to log into other Microsoft Network services.

Shortly after CNN Interactive posted an initial story about the breach, one of the sites was changed to a simple message, "Microsoft rules." Shortly after that, the URL redirected the user to a site for a new Web company. Later, it redirected users to a Microsoft security screen or returned an error message.

Other sites - situated all over the world but all using the same Hotmail gateway program -- first provided access without a password but later returned "Forbidden" messages.

Ari Schwartz, a policy analyst with the Center for Democracy and Technology, said the security hole in Hotmail was troublesome because Web-based e-mail is a good privacy solution for people sending personal e-mail at work. But no e-mail is totally secure, he said.

"There is a question of how secure you can make any e-mail system," Schwartz said, "especially if people are trying to hack it all the time."

At this point, there is no legal precedent to protect e-mail users from privacy violations, said David Sobel of the Electronic Privacy Information Center.

"It's not clear that a Hotmail user whose privacy has been compromised really has any recourse against Microsoft for what might be found to be negligent engineering of this feature," Sobel said.


SPECIAL SECTION:
Insurgency on the Internet

RELATED STORIES:
Federal agency recruits hacker teens
August 26, 1999
Anti-gay site goes back to rightful owners
August 23, 1999
Hackers, IT consultants embrace free security tool
August 13, 1999
Hacking group reveals IP-security glitch
August 13, 1999
Hacking your way to an IT career
August 13, 1999
Microsoft says "crack this!"
August 6, 1999

RELATED SITES:
Microsoft
Hotmail
Phar Lap Software
The Center for Democracy and Technology
Electronic Privacy Information Center
Note: Pages will open in a new browser window
External sites are not endorsed by CNN Interactive.

 LATEST HEADLINES:
SEARCH CNN.com
Enter keyword(s)   go    help

Back to the top   © 2001 Cable News Network. All Rights Reserved.
Terms under which this service is provided to you.
Read our privacy guidelines.