Microsoft faces huge fine over security

NEWS

Microsoft faces a possible investigation and significant fines for a security lapse that could have exposed the personal information of millions of consumers. On Thursday, the software giant was scrambling to determine the impact of a flaw in the password reset feature of its Passport identity service. The vulnerability, first reported by CNET News.com, could have allowed attackers armed only with a Passport user's email address to access information such as the user's name, address and credit card number. For a company that has publicly made security a priority, the Passport problem was a serious setback. But the damage to the company could run to more than just bad public relations. Last August, Microsoft signed a consent decree promising the Federal Trade Commission that it would not make false statements about the security and privacy protections in its Passport service and that it would improve those protections. While the FTC doesn't comment on potential investigations, the agency does look into questions regarding a company's compliance with agreements. "Under our order, they need to take reasonable and appropriate steps and safeguards," said Jessica Rich, assistant director for the financial practices division of the FTC. "Obviously, there is not a standard that says if something went wrong, they are in violation of the order. But we will assess whether the steps that were taken were reasonable." The potential investigation -- which could lead to hefty fines at a rate of $11,000 per violation -- is the latest problem to hit Microsoft's beleaguered Passport service. A flaw found 18 months ago could have also allowed attackers to gain access to the identity information stored in some of accounts. That flaw and other issues led to the August 2002 consent decree with the FTC. The question now is whether Microsoft may have violated that decree when it changed the Passport system in September and added the vulnerable password reset feature. Provisions in the agreement call for the company to pursue the "design and implementation of reasonable safeguards to control the risks" to a customer's information. "Security is never absolute, so the question is whether they are using reasonable measures," said Chris Hoofnagle, deputy counsel with the Washington-based Electronic Privacy Information Centre. "The result certainly isn't reasonable, but that doesn't mean the company has been negligent. But in a situation like this, the result speaks for itself." Microsoft would not comment whether it was discussing the issue with the FTC. A violation could tarnish Microsoft's vision of its role in the Web-enabled future. The software giant has touted Passport as a technological centrepiece in Web services. Passport accounts are central repositories for a person's online data and can include personal information such as birthdays and credit card numbers. They can also act as a single key to access many online accounts. Microsoft uses Passport authentication for its Hotmail email service and its MSN Messenger instant messaging service. Other e-commerce services also rely on Passport -- it's used in transactions in online games and in purchases of Microsoft Reader e-books, for example. Several online retailers, such as eBay, Canon, Expedia and Starbucks, also use Passport authentication. Microsoft estimates there are 200 million active Passport accounts. The latest flaw allowed a single Web address -- or URL -- to be used to request a password reset form from the Passport servers. The URL contains the email address of the account to be changed and the address where the attacker would like to have the reset message sent. By entering the single line into a Web browser, an attacker could have caused the Passport servers to return a link that allowed the password to be reset, thus giving the attacker access to the account. Microsoft quickly moved to stop online vandals from exploiting the glitch. A security advisory was posted just before 8 p.m. PDT on Wednesday, and by 11:30 that night the company had essentially turned off the feature. "We have shut down all ability to reset passwords," said Sean Sundwall, spokesman for the company. On Wednesday, Microsoft disabled suspicious accounts, forcing some Passport subscribers to contact customer support directly for their reactivation. "Those people will have to get the account reactivated, and that will let us make sure the right people are there and the right people have access to the accounts," said Adam Sohn, product manager for Microsoft's Passport group. At least one Passport user who had confirmed the security vulnerability said on Thursday that his account was no longer accessible. "I'm locked out of MSN and Hotmail right now," he said. Some reports have indicated that if the FTC tries to levy fines on Microsoft, the total penalty could be as high as $2.2trillion (£1.4tn) if all accounts are tallied as violations. However, the number of people that have been locked out of their accounts may be a better basis for determining fines. Microsoft's Sohn said that the company should have caught the issue in its new development cycles, which have been revamped under the Trustworthy Computing initiative aimed at, among other things, reducing software vulnerabilities. "Of course we should have caught it; we should catch every (issue)," he said. "That's what you are working toward. We are always looking. There is not a beginning or end to this kind of effort."

For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Security News Section. Let the editors know what you think in the Mailroom.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

ike fuelband is great for every healthminded person ! to work out! theres this website called textme4free.com that you can use to text anywhere in...

7 hours ago by bordero on Nike's FuelBand wristband gamifies exercise

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

10 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

14 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

15 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

16 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

18 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

1 day ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

2 days ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

2 days ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

3 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint