A security researcher has won $24,000 from Microsoft for finding a critical vulnerability in the authentication system at Live.com, which could allow a hacker to gain access to a user's Outlook account or other Microsoft services.
Microsoft's Live.com service is the authentication system that everyone goes through when a user needs to identify themselves to use Outlook.com and other Microsoft services, including OneDrive, Windows Phone, Skype, and Xbox LIVE.
Hacking a Hotmail (Outlook.com) account
It's one account for all services. So, for example, if Outlook wants to access other apps, it uses a standardized set of code called OAuth.
OAuth is an open standard for granting access that keeps your passwords safe when visiting other websites, and instead of sharing the user's password, it shares a special key called an "access token" to gain access to the app.
Access via OAuth is achieved through a question, as shown below, where in order to be permitted and log in to their account, the user must click on "Yes".
However, security researcher Wesley Wineberg discovered a serious flaw that allowed him to bypass Microsoft's OAuth protection mechanism using his malicious proof-of-concept application, called "Evil App.".
According to the technical details published by the security researcher, malicious applications of attackers can gain access to the victim's account by tricking the victim into visiting a website, which does not require any other interaction from the user.
Demonstration
You can watch the attack in the video below:
