Phishing attack targets Hotmail (10000+ Hotmail Accounts Compromised)

[The Stig]

BBC NEWS | Technology | Phishing attack targets Hotmail

For those with the link blocked:

Phishing attack targets Hotmail
By Jonathan Fildes
Technology reporter, BBC News
http://newsimg.bbc.co.uk/shared/img/999999.gif

Thousands of accounts on web-based e-mail system Hotmail have been compromised in a phishing attack, software giant Microsoft has confirmed.

BBC News has seen a list of more than 10,000 e-mail accounts, predominantly originating from Europe, and passwords which were posted online.

Microsoft said it had launched an investigation.

Phishing involves using fake websites to lure people into revealing details such as bank accounts or login names.

"We are aware that some Windows Live Hotmail customers' credentials were acquired illegally and exposed on a website," said a Microsoft spokesperson.

"Upon learning of the issue, we immediately requested that the credentials be removed and launched an investigation to determine the impact to customers."

Quick change

Graham Cluley, consultant at security firm Sophos, told BBC News the published list may just be a subset of a longer list of compromised accounts.

"We still don't know the scale of the problem," he told BBC News.
Technology blog neowin.net was the first to publish details of the attack. It said the accounts were posted on 1 October to pastebin.com, a website commonly used by developers to share code.

Although the details have since been removed, BBC News and Neowin has seen a list of 10,028 names beginning with the letters A and B.
BBC News has confirmed that the accounts are genuine and predominantly originate in Europe.

The list included details of Microsoft's Windows Live Hotmail accounts with email addresses ending hotmail.com, msn.com and live.com.
Mr Cluley advised Hotmail users to change their password as soon as possible.

"I'd also recommend that people change the password on any other site where they use it," he said.

Around 40% of people use the same password for every website they use, he added.

Hotmail is currently the largest web-based e-mail service.

I fail to see the issue here for the educated (read: us/BG!). For those even remotely well educated in online security, if you didn't put your e-mail address and password in some sort of a phishing site, it is safe to assume it's all fine?

Not sure if it's just the usual LCD factor here of hotmail users, but there's sites everywhere where everyone is going CHANGE UR PASWORD (regardless). But common sense tells me if I haven't been phished for it, there is no need to change my (retarded) password.

[Charismatic]

In an attempt to be informative I posted a thread over in general:

http://www.bluegartr.com/forum/82697...mpromised.html

Unfortunately I think because of the words used in the post/URL my work proxy has blocked me from accessing the thread LOL (in an attempt to protect me, no doubt...)

Someone mention that in there for me please

Looks like the man is stuck out of his own thread Q_Q

[Mizango]

I've been dealing with this shit in a round about fashion all week long and I am to the point where I want to punch myself in the face repeatedly. I know its hard to believe but you would be surprised at how easily and how frequently something like this works.

It's not just old people either.

[Brill Weave]

Oh Miz...you didn't...

[Mizango]

Never that.

[Gulkeeva]

oh but wait theirs more...!

BBC NEWS | Technology | Google targeted in e-mail scam

Not just hotmail...! But for many other services with people stupid enough to click strange stuff in their e-mail

[Ragnell]

oh but wait theirs more...!

BBC NEWS | Technology | Google targeted in e-mail scam

Not just hotmail...! But for many other services with people stupid enough to click strange stuff in their e-mail

Everyone needs alittle enhancements

[Kaylia]

If only natural selection would work on the internet....

[Charismatic]

darwini-

Oops, sorry... forgot we can't do that anymore.

[Jefe]

Ever since I got my gmail account back when it was invite only, I've seen 1 spam. Nothing beats gmail's spam filters.

[Darte]

Ever since I got my gmail account back when it was invite only, I've seen 1 spam. Nothing beats gmail's spam filters.

This is why hotmail is my spam account. Nothing more.

[deshende]

Ever since I got my gmail account back when it was invite only, I've seen 1 spam. Nothing beats gmail's spam filters.

I had one of those gmail accounts and never used it for anything (didn't sign up for anything with the email and never gave it out to anyone). I came back months later (after I forgot that I had signed up for it) and the inbox was full of spam.

They have since gotten better, but I wouldn't say they've always been perfect. I'd say they all have their issues.

[Mayareira]

Using my gmail account since 2004 and never had a problem with spam. My hotmail is pretty much unusable with all the junk I get.

[Khamsin]

I use gmail for friends and on my resume, and never get junk mail from it. Which surprises me, since my resume with that email on it has been on monster.com before, and I figure that'd be ripe for email farming.

I use hotmail for people I meet online but don't really know, subscription services and signups for websites I want to be involved with (e.g. my amazon.com account, BG account email, etc.) and get the occasional junk mail but not often. Maybe once a week or so.

I use yahoo for signups on websites I don't care about and just need a throwaway email for free accounts and whatnot. I get junk mail everyday, but then, I never check it because I never need to.

[SephYuyX]

Been using Yahoo since late 90s, and never had a problem with it. Ive a hotmail and gmail account as well, but yahoo is much more friendly and filtered. I cant remember the last time I got spam.

But I use Outlook for all of them anyway, so it's been a couple years since I actually logged into the actual websites.

[shukudai]

I think this just goes to show sometimes, how out of touch those of us with even a small amount of knowledge in regards to the internet with those who aren't.

I work for a small ISP, who's members get blatant fishing scam e-mails pretty much weekly. The most typcail is phishers pretending to be the ISP going "Your e-mail account is over quota/will be closed/is in danger if you do not reply to this automated message with your account #, username, address, date of birth, or will be closed. Thank you, your ISP!"

We get flooded with reports asking if they're valid, and occasionally, "can you change my password? I filled that out, then I thought maybe it was a scam!"

There isn't almost a day where I don't encounter someone who is paying for a service they know mindbogglingly little about, just that "it gets email" and you can be online. I always find it humorous when I ask someone to type in the "Address Bar at the top, the long white bar" of the their browser, because 75%+ will type it into the Google search bar.

[Charismatic]

darwini-

Oops, sorry... forgot we can't do that anymore.

quoting for good measure