New Security Flaw In Hotmail

By junkam
in Back Page News

 Share

Recommended Posts

Collaborator

junkam

Posted
Posted

computer science student discovered a new security flaw in Microsoft email service Hotmail, that could let hackers take control over your Hotmail and Messenger account, and even reset the password.

The student told Microsoft about the flaw over 3 weeks ago and they still haven't fixed the problem.

Link to comment
https://www.neowin.net/forum/topic/490965-new-security-flaw-in-hotmail/
Share on other sites
Veteran

TheDogsBed

Posted
Posted
Three weeks have passed and the problem still exists, according to Naamana. After three weeks Naamana decided to go public with the information in a hope that this will make Microsoft respond faster and fix the flaw.
And, of course, get his name recognised a little.
Grand Master

John Veteran

Posted
  • Veteran
Posted
Baha Naamana, who discovered this flaw reported his finding to Microsoft three weeks ago, and got a response from Microsoft Security Response Center that they will investigate the report, and they asked him not to disclose the information.

So they were looking in to it and told him not to disclose the information, and then he does? Did he wait to get a response back from them? Did he try to contact them again before making the information public?

I don't think he understands how busy MSRC is, and that he'd be doing more harm than anything else by making this information public.

Mentor

KHaKi-

Posted
Posted

I was actually hoping this would be a good flaw, I was actually excited :shiftyninja: . Then i read it and Im like ".....another one of the 'a user has to be an idiot and click something from someone they don't know' flaws." Sure, on level it could be abused, but some of the more technical people arent going to click it unless they know who its from to BEGIN with. :rolleyes:

Community Regular

AxelStone

Posted
Posted

Its microsoft's own fault. They have no status notification or current notification que if the issue has been resolved. It doesnt have to be anything complicated.

What do you expect, someone mentions to you a problem and you just say "ok".... what are they going to think? 99% of the time they will think, "he just ignored me". Not "Oh, they must be busy and are still working on it."

Grand Master

The Teej

Posted
Posted

Wow, what an ass. If nobody knows about the flaw how can it possibly be of any harm? ****ing off Microsoft by going against what they specifically said not to do won't earn him any brownie points, so why do it? Fame, recognition? Nobody is gonna remember Bananarama's name in a few weeks anyway, so his 15 seconds won't go very far.

Grand Master

L3thal Veteran

Posted
  • Veteran
Posted

It should not take so long for Microsoft to fix this problem, it's not like they need to distribute a patch to client, they just need to fix the server application.

Well, considering Microsoft has other bigger fish to take care of, I don't think this is really a priority to them since its not being abused in a big scale and it has just been announced publicly.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Google is opening the world's first AI museum in Los Angeles

      By excalpius · Posted

      The proportion (or number of iterations) has nothing to with this aspect of Copyright I am describing. In short, it doesn't matter how many times the manager tells you to change something or how. Your work product is always YOURS until and unless you then assign that to the person representing the client/company, usually for financial compensation -- either in salary or as a subcontract work for hire payment. if iterations determined copyright, then businesses would have learned to just keep making changes until they could claim they owned the copyright, without having to compensate the artist for their work. And that would be BAD. The only place where the amount of changes does have a role is in how much does a human modify a previous public domain work (from any source) before it is considered fair use or their own work, etc. For example, if a human makes substantial changes to a public domain (re: AI, by definition) work, then they can then claim that derivative work as their own...but NEVER the original version, of course. That's why anyone can make a movie about Dracula, for example, as long as it is based on the public domain novel, but not if they take new ideas from copyrighted movies made afterwards. As one of the people who personally advised the US Copyright Office on their recent ruling on these very issues, be assured that I specifically used the terminology precisely -- though I made it simple enough for laymen to understand it. If I made this confusing by doing so, I apologize. But, to be clear regarding your assumption that I would agree to your second statement that I quoted above -- the answer is NO. If AI does the work, no matter how much "direction" you give it, it cannot be copyrighted. All AI generated content is in the Public Domain and therefore the copyright cannot be assigned to ANYONE, even you -- until and unless substantial modifications are made to it BY A HUMAN BEING (yourself or a contracted artist/writer/etc.) and then that copyright on the derivative work is legally (in writing) transferred to you. This is a critical distinction. And it is important that people, especially AI sloppers, understand this. For example, YouTube is not paying AI slop generators for the copyright, etc. of their AI slop. What YouTube is doing is sharing AD REVENUE for permission to publish your AI slop. Copyright/ownership/rights never come into it. Importantly, that means that anyone can copy any AI slopware on YouTube, etc. and rehost it anywhere they want, even back on YouTube, and there is nothing legal that YouTube can do about it with regards to copyright protections, ownership, DMCA, etc. Anyone is legally free to use any AI slopware in any way they want. When this ruling was pending, I warned Disney legal of all of this before they did their OpenAI deal -- that it would literally dilute their entire IP portfolio forever. They ignored that warning for the PR and stock bump. But that is why, when the ruling came down last year, Disney quickly extricated themselves from that OpenAI deal, even eating the initial upfront fees -- followed closely by OpenAI ending their entire AI video generating business model. They adjusted their PR release dates to make this less obvious to shareholders, of course. Phew. I hope that this clears up the key distinctions for you and anyone reading. If you have any additional questions or even hypotheticals about AI and Copyright, please feel free to ask.
    • Windows 11 gets new audio improvements in the latest builds

      By wingliston · Posted

      Each of the devices displayed on this page now has a little volume meter next to it to show if there is audio actively playing. About time.
    • Windows 11 version 26H2 is now available for testing in the latest preview build

      By LiLmEgZ · Posted

      Owing to the nature of Windows feature enablement updates, it was distributed over Windows Update services as a complete system upgrade rather than as an ordinary cumulative update
    • Politically funny images of the World

      By +primortal · Posted

    • Microsoft confirms Windows 11 26H2, urges IT admins to prepare for release

      By Usama Jawad96 · Posted

      Microsoft confirms Windows 11 26H2, urges IT admins to prepare for release by Usama Jawad Windows 11 typically follows an annual update cycle, but Microsoft recently broke that tradition a bit by releasing a "26H1" version in the first half of this year as a "scoped" build for select new silicon PCs only. This version was not available for customers using 24H2 and 25H2 builds, as Microsoft is busy preparing version 26H2 for them, confirmed officially for the first time. In a Windows IT Pro blog, Microsoft has urged IT admins to prepare for the upcoming release of Windows 11 version 26H2. The company has confirmed that this will be a small enablement package (eKB) that will simply light up certain disabled features that are already present in the operating system's code base. This means that the "refined" Windows update and deployment experience will be simpler and quicker, with minimal disruptions, as the feature update will simply toggle a few flags rather than performing a complete replacement. Microsoft has explained that this is all possible because the standard Windows 11 releases share the same servicing branch and hence, the same source code. However, this also means that Windows 11 26H1 users won't be able to upgrade to 26H2 as that is a different branch, but this is something we have known for a while now. Similar to previous annual feature updates, Windows 11 26H2 will offer the following support cycles: 24 months of support for Home, Pro, Pro EDU, and Pro for Workstations editions 36 months of support for Enterprise, Education, IoT Enterprise, and Enterprise Multi-session editions Microsoft has not confirmed a concrete release date for Windows 11 26H2, but noted that it is "coming soon". If we go by the ongoing release cadence, we can expect it to begin rolling out in early October 2026. As such, IT admins have been encouraged to begin validating Windows Insider releases in the Experimental Channel, plan rollout rings, and strategize the utilization of their existing deployment tools.

  • Recent Achievements

    • Collaborator
      ryansurfer98 went up a rank
      Collaborator
    • Week One Done
      Eurosoft10 earned a badge
      Week One Done
    • One Month Later
      Eurosoft10 earned a badge
      One Month Later
    • One Year In
      Skeet Campbell earned a badge
      One Year In
    • One Month Later
      Sharbel earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      569
    2. 2
      +Edouard
      188
    3. 3
      Michael Scrip
      79
    4. 4
      PsYcHoKiLLa
      74
    5. 5
      neufuse
      72
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!