Hacking Hotmail

[Cirdan]

I've only seen hotmail "hacked" through keylogging,or either social engineering,though I never heard it ever being hacked with just a script,or program or something of the sort.

[sparkant]

About a year ago I remember that there was a quite popular exploit in Hotmail.

You had to send someone an email with in the subject field a javascript command.
First you had to it like this, then they found out and patched it, still leaving a kind of buffer-overflow exploit open, which could be exploited using the same javascript command, but a long one, which caused the buffer to overflow, and at the end there had to be a second javascript command, which was executed. Which worked for a while too.

I believe that one could actually have the passwd of a mailbox mailed to him with this.

Correct me if I'm wrong,

Grtz.

[neel]

This post isn't directed to people who know of past exploits and people who are intelligent.

<rantlikething>
To all smartass morons (pretty much noone who posted in this thread I think) who think hacking hotmail is easy as hell just because it's ran by microsoft, now prove it. I will be on vacation this week, if you hacked hotmail before I get back, send me a PM and you get some of my home grown weed. You also get my apoligy. If you fail you're still a moron, but a bit bigger moron the you already were.
</rantlikething>

Thank you.

[thread_killer]

Actually, what I think is funny about hotmail is how much time Bill Gates spends telling us all that *nix sucks, but then on the back cover of my copy of The FreeBSD Handbook 2nd Edition published by the FreeBSD documentation project it says:

"FreeBSD is the choice of thousands of Internet Service Providers and other organizations which depend of FreeBSD's high performance and reliability. Many of the world's largest Internet sites run on FreeBSD, including Yahoo! and Microsoft's Hotmail subsidiary."

Bold text added by me.

How come your not running that sucker on Exchange Bill? Huh? Huh?


Alright, I know that M$ bought hotmail and it was a pre-existing entity with it's own infrastructure, but you got to admit it's funny that it runs on *nix.