Glitch Found in Microsoft's IM Service

Microsoft Corp. is investigating a problem that allows users that register formerly-defunct Hotmail accounts to access the old user's MSN Instant Messenger user names and contact lists.

In a statement released Thursday, Microsoft said its security response center was "thoroughly investigating" the issue that they learned about last week through a posting on the BugTraq Web site. Microsoft did not give any indication when the glitch may be fixed.

The most recent BugTraq security listing came from James Nelson, a systems administrator at Cisco Systems Inc. in San Jose. Nelson posted a warning Aug.

14 that stated that he attempted to re-start a Hotmail account after not using it for four months. Microsoft officials told him he never had an account with them.

So, Nelson said he re-registered the same account and found he still had access to his old buddy list. He also wrote that he learned that someone appeared in his contact list, someone who had registered another one of his former accounts.

Dmitri Alperovitch, a software developer and part founder of Encryption Software Inc., learned of the glitch in July 1999 and posted his concerns on BugTraq. In his posting, Alperovitch stated that someone potentially could register a user's old Hotmail account and have the capability of impersonating that user on MSN Messenger.

Microsoft, in Redmond, Washington, can be reached at +1-425-882-8080 or

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about CiscoMessengerMicrosoftMSN

Show Comments