Language Selection

English French German Italian Portuguese Spanish

MSN site hacking went undetected for days

Filed under
Microsoft
Web

Password-stealing software planted by hackers was active on Microsoft's popular MSN Web site in South Korea for days before the world's largest software company learned about the break-in and removed the computer code.

Police investigators and Microsoft specialists are continuing to search for clues to the culprits behind this week's high-profile computer break-in. More details emerged Friday about the hacking, which targeted subscribers of an online game called "Lineage" that is popular in Asia.

Microsoft Corp. said it had cleaned the Web site, www.msn.co.kr, and removed the software code that had been planted on its news page. It said another company that operates the MSN Korea site apparently failed to apply necessary software patches, leaving its server computers vulnerable.

Security researchers at San Diego-based Websense Inc. discovered the break-in late Sunday during routine scans it makes against more than 250 million Web sites each week looking for sources of viruses and other infections.

A previous inspection by Websense of the MSN Korea site the evening of May 27 did not detect the dangerous software.

"Our alarms went off (Sunday). We noticed it was infected," said Dan Hubbard, its senior security director.

Hubbard said Websense researchers investigated further and quickly updated protective software to keep its own corporate customers safe. It did not successfully reach Microsoft officials to warn them about the break-in until midday Tuesday, a day after the Memorial Day holiday weekend.

Microsoft said it removed the password-stealing software from the MSN site hours later.

The chronology suggests the hackers could have harvested stolen passwords from visitors to the MSN site for up to three days. But their target -- passwords to game accounts -- lessened the significance of the break-in since the hacker software appeared not to collect any network or banking passwords.

The Lineage game and its successor boast more than 4 million subscribers, mostly in Asia, who pay about $15 each month, said Mike Crouch, a spokesman for the U.S. subsidiary of South Korea-based NCSoft Corp. Crouch said he was unaware of any significant increase in complaints by subscribers about stolen passwords tied to the Microsoft break-in.

South Korea is a leader in high-speed Internet users worldwide. Microsoft's MSN Web properties -- which offer news, financial advice, car- and home-buying information and more -- are among the most popular across the Web.

A Microsoft spokesman, Adam Sohn, said the company was confident its English-language Web sites were not vulnerable to the same type of attack.

Microsoft shares fell 36 cents to close at $25.43 on the Nasdaq Stock Market. They have traded in a range of $23.82 to $30.70 over the past 52 weeks.

Associated Press

More in Tux Machines

Alice is killing the trolls -- but expect patent lawyers to strike back

Open source software developers rejoice: Alice Corp. v CLS Bank is fast becoming a landmark decision for patent cases in the United States. The Court of Appeals for the Federal Circuit, which handles all appeals for patent cases in the United States, has often been criticized for its handling of these cases -- Techdirt describes it as "the rogue patent court, captured by the patent bar." But following the Alice decision, the Court of Appeals seems to have changed. Read more

How to Give your Smartphone the Android L Look

Android L is Google's latest mobile operating system. Apart from a complete UI overhaul, this version brings along a myriad of performance improvements. Compared to its competitor iOS 8, Android L outperforms the Apple mobile operating system in design and performance. Though there is no clear announcement as to when Android L will be reaching our devices, its Material Design has slowly started catching up among app developers. Furthermore, many apps have come up that let you completely change the Android smartphone’s user interface to match that of Android L. Although many of those apps are annoyingly hard to use, some of them make the job really simple. Below, we'll show you how to make the most out of such apps and then transform your phone’s UI to completely match the Android L look. Read more

Webconverger 26 Is a Secure Kiosk OS That Doesn't Store Any Data

Webconverger is a distribution designed and developed with a single goal in mind, namely to provide the best Kiosk experience possible. This means that people will be able to use that OS as a regular system, although its functionality will be limited and it will be impossible to install any other apps. This is a very helpful solution if this is a public PC, like in a library or a cafe, and it preserves the quality of the installation for a very long time. Because users can't interact with it on a deeper level, the operating system will remain stable and it will be pretty much the same like in the first day that it was used. Read more

Today in Techrights