hotmail.passwd.trap.txt

`Date: Fri, 23 Apr 1999 13:55:24 -0500  
From: David L. Nicol <[email protected]>  
To: [email protected]  
Subject: javascript hotmail password trap  
  
Hello, I was informed this morning that a free form data mailer  
I maintain (http://www.tipjar.com/generic.html) was being involved  
in a javascript-based hotmail password stealing scheme.  
  
I have located the originating page (with the script) and sent it  
to the contact address hotmail puts on their autoresponder documents.  
  
I will share an URL for the (fully escaped) exploit in a week or two,  
to give hotmail time to patch their systems. (that's correct procedure,  
right?)  
  
So far the perp has a few dozen passwords (and I've got them too,  
they appear in my apache server log)  
  
I have offered to send hotmail the list. As there are many free form  
data mailers around, I am not making any modifications to my tool (which  
is performing correctly) which would chase the password trapper to  
another form mailer whose admin does not keep as good of logs.  
  
The page with the script on it contains a warning that your password  
has just been trapped; so unless there are other copies of this script  
running around all the victims know it already.  
  
----------------------------------------------------------------------  
  
Date: Mon, 26 Apr 1999 02:18:08 -0500  
From: David L. Nicol <[email protected]>  
To: [email protected]  
Subject: Re: javascript hotmail password trap  
  
ha ha.  
  
No, it wasn't a traditional password trap (like yours) but  
a javascript which takes advantage of cookie-based security  
hooks to contact hotmail's database and change your password.  
  
  
  
  
frisco wrote:  
>  
> Is that originating page anything like  
> http://www-personal.wccnet.org/~frisco/code/assorted/hotmail.html  
> ? It's a page i made a while back to describe some security issues to  
> some co-workers.  
>  
> just curious.  
>  
> -f  
> http://www.peruano.org/  
>  
  
________________________________________________________________________  
David Nicol 816.235.1187 UMKC Network Operations [email protected]  
"If you're calling about the Nobel prize, press 4" GPG+ P+++ e*  
  
`