this news story illustrates some of the hazards msn has placed its users in because of its third party management arraignments...
MSN Korea hacked
CNET News.com
June 03, 2005, 09:25 GMT
Microsoft was forced to take its Korean portal offline after an attack directed at its news section put users at risk
Microsoft has discovered an apparent attempt by hackers to steal user information from its South Korean MSN Web site and has taken action to repair the problem.
The attack was directed at the news section of the MSN Korea Web site, said Adam Sohn, a Microsoft spokesman. Microsoft was alerted Tuesday morning that the site had been compromised and took the site offline for a few hours to fix the problem, he said.
Microsoft has received no reports of users falling victim to the attack. The software maker is still investigating the issue and has called in law enforcement to investigate and take action against those responsible, Sohn said.
Early investigation has shown that the attackers placed an additional frame on the Web site, a so-called IFRAME, Sohn said. These frames could be used in malicious attacks that take advantage of a flaw in Microsoft's Internet Explorer Web browser that the company patched last December.
The IE Elements flaw, also known as the IFRAME vulnerability, could allow an attacker to take control of a victim's PC. Microsoft's Windows XP Service Pack 2 security update is not vulnerable to the flaw.
Microsoft is confident that its other MSN Web sites are not vulnerable to the same type of attack. The Korean site, unlike the US and most other international MSN sites, was not hosted by Microsoft, but by a Microsoft partner, Sohn said. "There may have been unpatched servers," he said, which could explain the break-in.
In Microsoft's own data centres, the company makes sure its servers are patched and in secure physical locations, Sohn said.
Broadband and mobile Internet usage is popular in South Korea. The market is important to Microsoft's MSN group, which has trialled new services in the country.
-----------------------------------------------------------------------------------------
Exclusive to bloggingmsnchat:
speaking of hacking msn. heres one way hackers talented in social engineering techniques have been using the msn chatline to surreptituously install .EXE (executable) files into the pc's of msn's unspecting chatters. executable files containing who knows what.
(1) get you an access to the msn chatline (chat.msn.com) it doesnt matter that one reason microsoft gave in going to a paid subscription chat service was so they would have everyones credit card information in case they needed to track anyone down. nah forget that you are a hacker.
(2) go to freewebs.com and get you a free website then upload your .exe file there and give it a deceptive url/file name like uh me-jpg.exe or something like that. as long as it ends in ".jpg.exe" maybe no one will notice. much to freewebs credit though they have instituted a policy where new accounts are what freewebs calls "provisional" this period lasts 7 days in which time they do not allow .exe files or files larger than about 700k to be uploaded into their system.
(3)next get your msn profile in order with the sexy picture promising a nude picture of me! weeeeeeee
which points to your executable here:
now park in every chatroom on msn and reel em in.
voila. how clever.
did msn find you? was msn even aware of your existence on their chatline. NO! it wasnt until chatters had to go to the help desk and report it that you did anything. saying that msn did anything is stretching it because you have your mIRC scripts that allow you to onjoin and refresh you return to the chatline within minutes and stay until reported again because msn isnt looking for you nor do they care.
SexyPrincess22_ thelobby1 wednesday 17 august 2005 1158 pm edt
