Hotmail targeted by zero-day attack

Researchers at Trend Micro uncover a threat targeting a zero-day flaw in Microsoft's Hotmail Webmail service.

Hotmail accounts were recently targeted by an attacking against a zero-day vulnerability in the Microsoft Webmail system. The attack is more insidious than some because it executes without user intervention when a malicious email is opened.

Most attacks require some additional action on the part of the user. Malware often comes in the form of a file attachment, or URL link embedded within an email. Those attack vectors are successful enough, but at least some users are conditioned enough at this point to know not to open file attachments or click on links. But, a threat like this one -- that just works as soon as a message is viewed -- can be a significantly bigger threat.

Researchers at Trend Micro detected the threat, and dug in to learn more about what makes it tick. According to a Trend Micro blog post, when a specially crafted message is viewed the malicious script executes automatically. The script then steals email messages and contact information from the Hotmail account.

This particular attack seems to have been designed specifically as a targeted attack. The script connects to a URL which includes two variables: user account name, and number. The user account name is the Hotmail account the attack is intended for, and the number identifies the malicious payload that should be executed.

That URL also calls another malicious script -- identified by Trend Micro as JS_Agent.SMJ. This script triggers Hotmail to forward all email messages sent to the victimized Hotmail account to a designated email address.

Trend Micro also uncovered some clever coding that dupes Hotmail into unwittingly helping the attackers. "We analyzed the embedded crafted code before the actual email message's content and discovered that once Hotmail's filtering mechanism works on the code, it ironically helps inject a character into the CSS parameters to convert the script into two separate lines for further rendering in the Web browser's CSS engine. This allows the cyber-criminals to turn the script into something that allows them to run arbitrary commands in the current Hotmail login session."

Trend Micro disclosed the issue to Microsoft as a function of its membership in MAPP (Microsoft Active Protections Program), and Microsoft has already released an update for Hotmail to address the problem.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags spamantispamweb mailMicrosoftvirusestrend microsecurityphishingmalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?