An Exploit Explained: Web based Email JavaScripts
by little_v (little_v@your-house.com)
http://blacksun.box.sk - Black Sun Research Facility (where this tutorial came from)
Date: 1/10/99
Version: 1.0
"pleez, pleez, PLEEZ teach me how to hack a Hotmail Account!!!"
-unidentified IRC user
>From here on in you walk alone. Neither little_v OR Black Sun Research Facility AND its members will be responsible for
what you do with the information presented here. Do not use this information to impress your "l33t0_b0rit0" friends. Do
not operate in shower. Objects in article may be closer than they appear.
Note: If you see (x), where x is a number, it means that this term is defined at (x) at the bottom of this article.
Intro
-------
The purpose of this article is NOT, I repeat, NOT to teach someone how to "hack an email account". It's true purpose is
actually MUCH more devious. The purpose of this and all other articles in the "An Exploit Explained: " series is to teach
readers about various web technologies, and the basics of security and exploiting. I will try to give you a hands-on,
learn as you go type of education in computer security. Sound good??? Then let's get in to it!!
Preface
------------
On Wednesday, Sept. 22 1999, yet another bleary day in the life of little v, the following message was sent to my inbox:
To: BugTraq
Subject: Yet another major Hotmail security hole - injecting JavaScript using "javasCript:"
Date: Wed Sep 22 1999 10:48:04
Author: Georgi Guninski
Message-ID: <37E8D004.EF848F34@nat.bg>
Yet another major Hotmail security hole - injecting JavaScript using
"javasCript:"
There is a major security flaw in Hotmail which allows injecting and
executing
JavaScript code in an email message using the javascript protocol.
This exploit works both on Internet Explorer 5.0 (guess IE 4.x) and
Netscape Communicator 4.x.
Hotmail filters the "javascript:" protocol for security reasons. But it
does not filter properly
the following case: "javasCript:" where "C" is the ASCII code of
"C".
So the following HTML is executed if the user has
enabled automatically loading of images (most users have).
Probably this may be used in other HTML tags.
Executing JavaScript when the user opens Hotmail email message allows
for example
displaying a fake login screen where the user enters his password which
is then stolen.
I don't want to make a scary demonstration, but I am sure it is also
possible to read user's
messages, to send messages from user's name and doing other mischief.
Hotmail deliberately escapes all JavaScript (it can escape) to prevent
such attacks, but obviously there are holes.
It is much easier to exploit this vulnerability if the user uses
Internet Explorer 5.0.
AFAIK this is not a browser problem, it is Hotmail's problem.
Workaround: Disable JavaScript
The code is:
....
....
Regards,
Georgi Guninski
http://www.securityfocus.com/external/http://www.nat.bg/~joro
Ok, don't puke, I'm going to explain what just happened in a fashion that even your dog can understand.
What is this all about?
-----------------------------------
This important part of this posting to the Bugtraq(1) (http://www.securityfocus.com) mailing list is the actual exploit(2).
The exploit would be:
What does it do?
--------------------------
As this exploit, when put into an email message sent to a hotmail user, opens a little box using the "alert()"(3) function in
javascript(4), and is also supposed to read who the first message in your inbox is from. However, this code does not
work on its own. You see, the email also says that you need to use the ASCII(5) code for "C" in the message. If I get out
my handy HTML reference book, I can see that the ASCII code is C. If we substitute this into our little exploit, minus
the "read who the first message in your inbox" part, we get this:
How does it work?
-----------------------------
Finding out how an exploit works is always the part that makes people a bit spindizzy. If we look at that gibberish we
call code one more time we can see that it uses an tag, which all you who took my HTML tutorial would know is
to display an image onto the page. Because hotmail tries to be the "top dog" webmail provider, they allow you to set
autoloading of images, so the image just shows up on the same page as the mail. When you open a new hotmail
account, this option is already set (hurray!). The conflict happens because your normal browser allows you to put
javascript tags into your IMG tags. Because JavaScript is a strong little language, and allows just about full control over
someone's browser, if the conditions are right. Naturally, people like you and me started exploiting hotmail's allowing
of javascript. Soon, the