Another method of hacking Hotmail has been discovered this week, allowing attackers to evade the service's filter system and execute JavaScript commands in the victim's inbox.
A Netherlands coder, going by the name of ObLiviON, revealed that, by adding JavaScript to the 'From' field of an email, the code will not be picked up by Hotmail filters, which are geared to block potentially dangerous code in the 'Subject' line and message body.
The hack works in such a way that all a victim has to do is view their Inbox for the code to be executed. An attack could be crafted to steal a user's login information, redirect a viewer's browser, run another program on a remote server or perform a more malicious and damaging attack.
Hotmail was forced to close another security hole about two weeks ago and has battled with the JavaScript security menace in the past. In 1998 the company began filtering scripts from the message body when it emerged that they could be malicious.
But on numerous occasions since, hackers have found ways of evading the filters, such as embedding code in HTML 'IMG' tags.
Information on the hack can be found here.
Despite warnings, Cross Site Scripting still a threat
Exploit tool lets crackers peek at users' mail.
How web services contribute to data headaches
Remote access - Three steps to getting connected
3.4 million UK professionals now work from home – is your company equipped?
Cost benefits of a global collaboration network
This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications
Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.
Chris Adams, Office Client product manager for Microsoft UK, explains...
Critics says government proposals to curb illegal downloading are unworkable...
Do you agree?
Have your say on this article