Hotmail Targeted by Zero-Day Attack

Hotmail accounts were recently targeted by an attack against a zero-day vulnerability in the Microsoft Webmail system. The attack is more insidious than some because it executes without user intervention when a malicious email is opened.

Most attacks require some additional action on the part of the user. Malware often comes in the form of a file attachment, or URL link embedded within an email. Those attack vectors are successful enough, but at least some users are conditioned enough at this point to know not to open file attachments or click on links. But, a threat like this one--that just works as soon as a message is viewed--can be a significantly bigger threat.

Researchers at Trend Micro detected the threat, and dug in to learn more about what makes it tick. According to a Trend Micro blog post, when a specially crafted message is viewed the malicious script executes automatically. The script then steals email messages and contact information from the Hotmail account.

This particular attack seems to have been designed specifically as a targeted attack. The script connects to a URL which includes two variables: user account name, and number. The user account name is the Hotmail account the attack is intended for, and the number identifies the malicious payload that should be executed.

:story: Full story: PC World