Hotmail targeted by zero-day attack

Hotmail accounts were recently targeted by an attacking against a zero-day vulnerability in the Microsoft Webmail system. The attack is more insidious than some because it executes without user intervention when a malicious email is opened.

Most attacks require some additional action on the part of the user. Malware often comes in the form of a file attachment, or URL link embedded within an email. Those attack vectors are successful enough, but at least some users are conditioned enough at this point to know not to open file attachments or click on links. But, a threat like this one -- that just works as soon as a message is viewed -- can be a significantly bigger threat.

Researchers at Trend Micro detected the threat, and dug in to learn more about what makes it tick. According to a Trend Micro blog post, when a specially crafted message is viewed the malicious script executes automatically. The script then steals email messages and contact information from the Hotmail account.

This particular attack seems to have been designed specifically as a targeted attack. The script connects to a URL which includes two variables: user account name, and number. The user account name is the Hotmail account the attack is intended for, and the number identifies the malicious payload that should be executed.

That URL also calls another malicious script -- identified by Trend Micro as JS_Agent.SMJ. This script triggers Hotmail to forward all email messages sent to the victimized Hotmail account to a designated email address.

Trend Micro also uncovered some clever coding that dupes Hotmail into unwittingly helping the attackers. "We analyzed the embedded crafted code before the actual email message's content and discovered that once Hotmail's filtering mechanism works on the code, it ironically helps inject a character into the CSS parameters to convert the script into two separate lines for further rendering in the Web browser's CSS engine. This allows the cyber-criminals to turn the script into something that allows them to run arbitrary commands in the current Hotmail login session."

Trend Micro disclosed the issue to Microsoft as a function of its membership in MAPP (Microsoft Active Protections Program), and Microsoft has already released an update for Hotmail to address the problem.