PakCERT
Security Advisory PC-080503
http://www.pakcert.org/advisory/PC-080503.html
Multiple Vulnerabilities found in Microsoft .Net Passport Services
May 08, 2003
BACKGROUND
“Microsoft®
.NET Passport is a Web-based service designed to make signing in to
Web sites fast and easy. .NET Passport enables participating sites to
authenticate a user with a single set of sign-in credentials, eliminating
the need for users to remember numerous passwords and sign-in names.”
“Since
its launch in 1999, Microsoft® .NET Passport has become one of the
largest online authentication systems in the world, with more than 200
million accounts performing more than 3.5 billion authentications each
month. .NET Passport participating sites include NASDAQ, McAfee, Expedia.com,
eBay, Cannon, Groove, Starbucks, MSN® Hotmail, MSN Messenger, and
many more.”
Benefits
of Using .Net Passport Services
•
“Use one name and password to sign in to all .NET Passport-participating
sites and services.”
•
“Store personal information in your .NET Passport profile and,
if you choose, automatically share that information when you sign in
so that participating sites can provide you with personalized services.”
DESCRIPTION
PakCERT
has discovered two serious vulnerabilities in Microsoft .Net Passport
Services, which if exploited, affects over 200 million users worldwide.
Using these vulnerabilities and the single sign-in feature of Microsoft
.Net Passport, an attacker can completely take control of a user’s
account including Hotmail email account, personal information, credit
card numbers, shopping lists etc and use it on any of the .Net Passport
participating web sites.
Issue One:
Bypass Security Questions
An attacker
can bypass the security questions asked before resetting the password.
When Microsoft Hotmail/.Net Passport users forget their passwords, they
have to fill out a web form that requires their email address, state,
zip code and country. After submitting the correct information users
are prompted to answer the secret question they entered during their
signup for the service.
As a result
of this vulnerability, Microsoft Hotmail/.Net Passport users who rely
on questions like “What’s my name?” or “What’s
my favorite color?” could find themselves loosing their accounts.
Issue Two:
Password Reset Vulnerability
An attacker
can reset any Microsoft Hotmail/.Net Passport user account with no prior
information like state, zip, country, answer to the secret question
and the old password. Normally, a user has to answer the security questions
and than answer the secret question if he wants to reset his password.
By exploiting this vulnerability, an attacker can submit a specially
crafted URL to get the password reset instructions and reset any user’s
password.
TECHNICAL
DETAILS
Due to
the nature of this vulnerability and the fact that there is no fix available
yet, no technical details are being made available with this advisory.
Full technical details will be made available on our website once the
vulnerability is fixed by Microsoft. Please note that we were forced
to release this information public as these vulnerabilities are actively
being exploited in the wild and are one of the most severe vulnerabilities
ever found in Microsoft Hotmail/.Net Passport.
FOUND BY:
Qazi Ahmed & Shoaib Rehman
AUTHOR:
Qazi Ahmed
DISCLAIMER
The information
within this paper may change without notice. Use of this information
constitutes acceptance for use in an AS IS condition. There are NO warranties
with regard to this information. In no event shall the author be liable
for any damages whatsoever arising out of or in connection with the
use or spread of this information. Any use of this information is at
the user's own risk.
PakCERT
Contact Information:
Email:
pakcert@pakcert.org
Phone:(+92-21) 4322124 - 4322126
Fax: (+92-21) 4322127
Postal
Address:
PakCERT
Suite
807, Kawish Crown
Block
7/8, D.A.C.H.S.
Shahrah-e-Faisal
Karachi, Pakistan
REFERENCES
http://www.passport.com/
http://www.hotmail.com/
http://www.msn.com/
http://www.microsoft.com/net/services/passport/
http://www.microsoft.com/net/services/passport/business.asp
