hacking hotmail..fyi

i came across an exploit on my own the other day and i thought i'd ask if this had already been done. i guess you can say this is a form of social engineering but oh well. you must know the name and birthday, area and zip in order for this to work. this is the process. go to this site

http://registernet.passport.com/cont...f?lc=1033&sd=h

that should bring back a page for resetting passwords. now all you have to do, is enter in the adress you want to hack, the "alternate email address" is going to be your account that you want their email sent to. and then you must enter all the other appropriate fields. and this is important, at the bottom, for last sign in date, you must put a really old date of last sign in, or a date that you know they have checked since then and make it one day before that. now hotmail is kind enough to send you an email to the alternate email address you specified. and if you entered in a date that you know is too old to be the last sign in date, they will say that they are sorry and you have signed in since then...this is the good part.. reply to them saying someone has hacked your account and you need to have your password reset immediately. they will then reply to you with a new password that they specify(all to the account you told them to send to)...now you have access to the account. do what you want in it, and here is what i suggest. assuming they have AIM, go to aol.com and say you forgot your password for the sn you gave. they will send an email to the account the sn is registered to. aka the account you have access to. so read the email and you now have their sn pass...most likely their sn pass and their email passes are the same. so just change the email pass to the sn pass and they wont know the difference. however, i reccomend getting into their personal information(going thru the options section) and then copying their old secret question but putting a new answer in it so you will always have access to their account if need be

ummmmm some advice - this is a security web-site.......and not only that but alot of peps need to balance out their antipoints

prepare to duck & cover from all the reds that are gonna be flying your way!

v_Ln

Now this is realy lame.

drew_1790 what are you slow :mad:

a security website yes, but i posted to share knowledge, people read what they are interested in, if they didnt care about reading it then they wouldnt have clicked on the post in the forum...i am just sharing a flaw in hotmail

Quote:

---

Originally posted here by drew_1790
a security website yes, but i posted to share knowledge, people read what they are interested in, if they didnt care about reading it then they wouldnt have clicked on the post in the forum...i am just sharing a flaw in hotmail

---

As true as you likely believe that statement to be, you picked a really bad day to make it. You might want edit this and find a way to delete the tread before you end up on the "Close to being Banned" list.


Cheers:

Yes, this is a security site. I think your post would be fine, but you have to include ways to PREVENT this from happening. Include ways to protect yourself from having this happen to you. Then it might be acceptable. If you want to share knowledge on how to hack stuff go somewhere else.

why would i be banned? for sharing knowledge?? isnt that what this site was intended for? oh well...sorry i picked the "wrong day"...the original question in the post was, has this been done before?!?? thats what i am asking

WAYS TO PREVENT THIS HACK:
-------------------------------------------
i suggest when you register, dont use your real birthday, or zip code!!

To try to make this a more positive thread, I'm going to share my methods for protecting my previous hotmail accounts, and I will then proceed to balance my AP assignments. First, I don't give out any real information to the hotmail people. Even if you know me extremely well, knowing my name, birthdate, zipcode, etc., you still won't be able to steal my password. And I change my lies each time. One day I'll be Alex Baston, born June 16, 1973, of 90210, and then I'll be Sam Goodwin, December 3, 1992, of 46512. If you're random, and you leave no pattern to be found, chances are that your account should be pretty safe from impersonators.

Now, for the reddies....

--PhirePhreak

Quote:

---

Originally posted here by drew_1790
a security website yes, but i posted to share knowledge, people read what they are interested in, if they didnt care about reading it then they wouldnt have clicked on the post in the forum...i am just sharing a flaw in hotmail

---

Most of us already around here know how to hack hotmail(but would never), but the kiddies don't, we don't need someone teaching them how to hack hotmail and send a virus they made with a program. They would probaly use this for bad. Would you really want to teach malicious script kiddies how to hack hotmail, I don't. But, thats my opinion, some script kiddies are good, but start as script kiddies.

The "hacking hotmail" or "how to hack hotmail" thread seems to be a tradition here.

Drew, I have some advice for you:
- don't call your thread with a such name.
- don't post a such thread if you have only 5 old posts. It is suspect.
- you should use a less direct way (in your syntax) to talk about such things.

Otherwise your next nick will be drew_1791.

Quote:

---

Originally posted here by drew_1790
WAYS TO PREVENT THIS HACK:
-------------------------------------------
i suggest when you register, dont use your real birthday, or zip code!!

---

I have that little "Warning members" thingy on my/AO's homepage so I need to start posting again.... o.O

Anyways, you want a way to "prevent this hack", well, I have a way, don't make your secret question and answer easy for a person to guess. If you want to go further into preventing whatever it is you want, consult the Hotmail staff at [email protected] or [email protected]. They'll be more than willing to help you out.

Quote:

---

original question in the post was, has this been done before?!?? thats what i am asking

---

Yes, this has been done before. It isn't a flaw in hotmail's system, it is a flaw in peoples thinking. They think that no one who would hack their account would know that much about them, yet most people who hack hotmail accounts are doing it to people they know.

Quote:

---

why would i be banned? for sharing knowledge?? isnt that what this site was intended for?

---

This site is intended to share security knowledge. You don't post an exploit unless you also post a fix. It isn't good to post the fix 10 posts later, you have to do it when you make your original post.

Quote:

---

people read what they are interested in, if they didnt care about reading it then they wouldnt have clicked on the post in the forum

---

Many of us read every single thread on this forum, weather we are interested or not. If you found a new exploit, and gave a fix at the same time, I would have been interested, even though I don't use hotmail. If someone posts about samba, there are only about a dozen people that can help them. We read posts to find new information and help those that need it. And then sometimes we read them to flame a stupid post.

Viper...i was just showing that it is not necessary to know the secret question's answer. this was one way to get around it, however, someone can gladly remove the post, sorry for the trouble...lol

Yes this is old. Personally I have no reason to get into hotmail, and I doubt I would be successful at any particular account. What pisses me off is when people assume that you can auto-magically get into any specified account without a combination of herculean effort or roundabout methods (such as stealing their password from THEM rather than hacking hotmail), or for that matter a one-time vulnerability...

What also pisses me off is that 9/10 newbies use this "I'm just spreading knowledge" and "information wants to be free." I'm choking on the triteness of these stereotype-inspired platitudes.