Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Hotmail Targeted by Zero-Day Attack

26 May 2011   #1
Borg 386

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 
Hotmail Targeted by Zero-Day Attack

Quote:
Hotmail accounts were recently targeted by an attacking against a zero-day vulnerability in the Microsoft Webmail system. The attack is more insidious than some because it executes without user intervention when a malicious email is opened.

Most attacks require some additional action on the part of the user. Malware often comes in the form of a file attachment, or URL link embedded within an email. Those attack vectors are successful enough, but at least some users are conditioned enough at this point to know not to open file attachments or click on links. But, a threat like this one--that just works as soon as a message is viewed--can be a significantly bigger threat.

Researchers at Trend Micro detected the threat, and dug in to learn more about what makes it tick. According to a Trend Micro blog post, when a specially crafted message is viewed the malicious script executes automatically. The script then steals email messages and contact information from the Hotmail account.
This particular attack seems to have been designed specifically as a targeted attack. The script connects to a URL which includes two variables: user account name, and number. The user account name is the Hotmail account the attack is intended for, and the number identifies the malicious payload that should be executed.

That URL also calls another malicious script--identified by Trend Micro as JS_Agent.SMJ. This script triggers Hotmail to forward all email messages sent to the victimized Hotmail account to a designated email address.

Trend Micro also uncovered some clever coding that dupes Hotmail into unwittingly helping the attackers. "We analyzed the embedded crafted code before the actual email message's content and discovered that once Hotmail's filtering mechanism works on the code, it ironically helps inject a character into the CSS parameters to convert the script into two separate lines for further rendering in the Web browser's CSS engine. This allows the cyber-criminals to turn the script into something that allows them to run arbitrary commands in the current Hotmail login session."
Read More:


Hotmail Targeted by Zero-Day Attack | PCWorld Business Center


My System SpecsSystem Spec
.

Reply

 Hotmail Targeted by Zero-Day Attack




Thread Tools





Similar help and support threads
Thread Forum
Heartbleed Attack Targeted Enterprise VPN
Source A Guy
Security News
A close look at a targeted attack delivery
Read more at: A close look at a targeted attack delivery - Microsoft Malware Protection Center - Site Home - TechNet Blogs
Security News
Do I really need Outlook Hotmail Connector when I don't use Hotmail?
I removed Outlook Hotmail Connector because I considered it bloatware. I don't use Hotmail. I use a hybrid system involving Outlook for my computer and Gmail for my Andriod phone and that is working fine. After removing Connector, I kept getting a message from Outlook about installing the...
Microsoft Office
DDoS Attack, Changed IPs Still Under Attack
I'm being DDoS attacked. My ping was been spiking from 50 to 250+. I've tried changing my IP multiple times and I still was attacked (Note: I own 3 computers and 1 tablet). I've tried disabling startup processes, av scans, and basic rootkit scans and found nothing. However, after I uninstalled...
System Security
Frequently get Hotmail message "We can't connect to Hotmail right now"
The Hotmail message "We can't connect to Hotmail right now. Please make sure that you're connected to the internet and try again." seems to appear all the time. Is this caused by poor internet speed, because I've got that, or is it something with google chrome, the browser I'm using? When...
General Discussion
New, unusual targeted attack against MS Office in the wild
New, unusual targeted attack against MS Office in the wild - Neowin.net
Microsoft Office

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 23:23.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App