UP TO a million Facebook accounts could be vulnerable to an all-too-simple method of email hijacking that requires no programming skills or computer expertise. All you need, it turns out, is patience and someone鈥檚 expired Hotmail address.
So say security researchers at Rutgers University in Newark, New Jersey. The threat arises, , because Microsoft retires unused Hotmail accounts after 270 days of inactivity and reassigns the email addresses to new users who request them. Facebook, meanwhile, uses an email address as a login. So an attacker can gain access to any Facebook account that uses an expired Hotmail address as a login 鈥� if they know where to look.
To find out if a target鈥檚 Hotmail address has expired, an attacker can simply send a test email. If a message saying 鈥渕ailbox unavailable鈥� bounces back, they probably have a viable target. Importing Facebook contacts into Windows Live Messenger makes things even easier, because it automatically tells a user whose addresses have expired.
Advertisement
The attacker can then sign up to Hotmail, ask to be assigned the address and reactivate it. Entering the address into the Facebook login screen and opting for 鈥渇orgotten password鈥� will trigger Facebook to send an email to the reactivated email address, whereupon the attacker can reset the password and gain full control of an account.
In a test, the researchers successfully gained access to 15 Facebook accounts, but then halted the experiment to avoid 鈥渆thical dilemmas鈥� and 鈥減otential legal problems鈥�. They estimate that attackers could gain access to as many as a million Facebook accounts. This represents a small fraction of the service鈥檚 one billion accounts.
聯The researchers estimate that attackers could gain access to as many as a million Facebook accounts聰
The team will present the loophole this week at the World Wide Web conference in Rio de Janeiro, Brazil.
Other online services could be similarly vulnerable, but a spokesperson at Google confirmed that the company does not recycle its users鈥� email addresses.
In an email to New 杏吧原创, a member of Microsoft鈥檚 Hotmail team wrote: 鈥淭his isn鈥檛 an issue with either Facebook or Hotmail. When someone stops using their Microsoft account, they should similarly stop having it associated with other internet services.鈥�
This article appeared in print under the headline 鈥淓xpired emails provide easy way into Facebook profiles鈥�
