~10,000 Hotmail Accounts Apparently Compromised

[Prometheus]

Was just told of this, and I can't see it posted here yet. http://www.neowin.net/news/main/09/10/05/thousands-of-hotmail-passwords-leaked-online

Basically details of some 10,000 or so Hotmail accounts were posted into the wild, and as far as I can see, there seems to be some debate at the moment as to whether it was due to phishing or some sort of breach somewhere.

Linking to it so more folks know, if they don't already.

 

[sam fisher]

It couldn't possibly be a breach as surely Microsoft are not stupid enough to store users passwords as plain text instead of some form of hash?

 

[gruso]

Hotmail is basically Darwinism 2.0.

 

[Prometheus]

There's been a comment added to the story since I posted this that's worth quoting - it seems to indicate that it is, in fact, due to phishing.

Nice of us to get a mention on these news sites

The accounts are obviously phished accounts that are on the list. Some of the accounts on the list are not correct.

For instance:

aroncf@hotamil.comassword (Incorrect Domain)
ararat973@hoymail.comassword (Incorrect Domain)
aroru83assword (No domain name at all)
arq_rdg37assword (Again, no domain)

If these were taken from Microsoft surely they would all be correct

So those of us who haven't been silly enough to be trapped by these should be okay

 

[WizardStan]

It couldn't possibly be a breach as surely Microsoft are not stupid enough to store users passwords as plain text instead of some form of hash?

If they didn't, there wouldn't be a "retrieve password" link. Or have they got rid of that finally?
*checks*Ah, a reset password, not a retrieve. Perhaps they have wised up a little.

 

[Tag5]

Nothing new to Microsoft really, same s**t different day/application.

 

[Squidge]

Unless of course they had a similar exploit as Wordpress - the ability for anyone to reset your password

 

[Fishbong]

There's been a comment added to the story since I posted this that's worth quoting - it seems to indicate that it is, in fact, due to phishing.

Nice of us to get a mention on these news sites

The accounts are obviously phished accounts that are on the list. Some of the accounts on the list are not correct.

For instance:

aroncf@hotamil.comassword (Incorrect Domain)
ararat973@hoymail.comassword (Incorrect Domain)
aroru83assword (No domain name at all)
arq_rdg37assword (Again, no domain)

If these were taken from Microsoft surely they would all be correct

So those of us who haven't been silly enough to be trapped by these should be okay

But if they´re phished accounts, then why only hotmail?

 

[Titcher]

Probably came from that spyware people get that makes them message MSN contacts linking to a page that asks to sign-in with MSN details.

 

[Enverex]

So in short, MS didn't leak anything. Stupid people gave their passwords away. That isn't a security compromise.

 

[Prometheus]

Exactly. And the British press are seemingly only just discovering that phishing exists, whilst confusing terms like "security breach" and "hackers" with it. :blink: (I'm sure everyone's seen the similar reports regarding details for accounts from other services, today. :rolleyes: )

 

[Username]

Wow what a bunch of stupid people. I know people that have fallen for worse phishing schemes though.

 

[(naw)mcx]

I have the list here, if you want to give me your username and password, I can check if you're on it, you're worried.

 

[lulzfish]

I have the list here, if you want to give me your username and password, I can check if you're on it, you're worried.

that's okay because, as we all know, the GP32x boards block sensitive information automatically:

Username: **********@hotmail.com
Password: ***********

Let me know if I'm on there!

 

[WizardStan]

Me too!
AzureDiamond@hotmail.com
hunter2

edit: doesn't look like stars to me

 

[Squidge]

Thats because it only blocks actual, valid information. If you enter fake details, it doesn't bother to block it

 

[WizardStan]

Spoilsport

 

[gruso]

Now the media are babbling about Yahoo and Gmail being "hacked" too. Just more phishing.

http://www.smh.com.a...91007-gllm.html

(I don't know why I keep reading these stupid tabloids)

 

[Prometheus]

I was rolling my eyes at the way some of the British media were using "security breach", "hackers", and "phishing" as though they were interchangeable terms, with that one, Gruso... (And don't get me started on the complete lack of explaining to their readership what "phishing" even means - that's poor journalism. )

 

[Fishbong]

ITT nerd rage.
oh well, its the same here, especially with that whole "Killerspiele" issue. Kinda ironic how the media coverage of these games makes me aggressive while the games do not.

EDIT: I just heard them talking about the email phishing on the radio, they got it right though.