Hotmail defences were not compromised says Microsoft

 

Gallery

Posted on 6 Oct 2009 at 15:00

Microsoft has said that the recent Hotmail hack, which ended up with more than 20,000 account details and passwords being posted online, was not due to its defences being breached.

"We are aware that some Windows Live Hotmail customers' credentials were acquired illegally and exposed on a website," said a Microsoft in a statement. "Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers. As part of that investigation, we determined that this was not a breach of internal Microsoft data."

The likely cause of the problem would be a phishing attack, where people are tricked into entering their details in to a fake website pretending to be Hotmail. Alternatively, a virus designed to harvest details could do the same thing.

The hack was discovered on Monday when 10,000 account details were put on to Pastebin.com, a website designed to let developers share snippets of code.

Since then the account details have been removed from the website, and Microsoft is helping customers regain access to any accounts that were breached.

The hack shows how times have changed. Rather than bothering to write code to hack through a website's defenders, hackers are going straight for the weak point and using social engineering to trick people into giving up their credentials.

We recommend that you never click a link in an email requesting you to enter any account details. Instead, always type a web address directly in to your browser, so that you know the site you are visiting is good.

Author: David Ludlow