New hacker risk hits Hotmail users

A hacker has discovered a new way to attack MSN's Hotmail email system. 'Oblivion' told members of security mailing list bugtraq of a way to smuggle code through Microsoft Javascript filters by adding it to the 'From' line of messages sent to Hotmail users.

The code could be used to redirect users to a hacker-owned web page that could trick them into divulging their Hotmail passwords. Once the user revisits their Inbox, the hacker can then read or delete email or send new messages under the user's name.

Microsoft has said it is investigating the new exploit, but has yet to comment further.

Hotmail has faced numerous Javascript-related security problems over the last three years, and has battled to close loopholes as hackers discover new gaps.