MSN Groups Forum Vulnerability

Rift · Post by **Rift** » Wed Sep 01, 2004 3:04 pm

I have found what i think to be a potential problem in the Forum feature of MSN Groups. I have tried contacting MSN Groups via the MSN Feedback form and by using the Groups Contact Us page located here: [url=\"http://groups.msn.com/contact\"]http://groups.msn.com/contact[/url] I have still not received any e-mail as of yet and i doubt i will, being that they were sent notification almost 6 months ago.

I found this problem a couple years ago. You will notice that when you are part of an MSN Community you have the option to receive forum messages in your inbox. If you do this, you can see the e-mail headers and view your fellow members IP Address. This however is not the potential vulnerability i have found. It is possible to post from any member account under any subject, or new subject. When this happens your IP Information is sent along with the message. This could possibly allow people to attempt some social engineering with other users of the group, namely people of influence such as managers. The vulnerability will also allow you to insert HTML Code into your document before you post, and i have not yet tested the possibility of using unsupported MSN Groups HTML, meaning things such as <Body> tags, and most javascript. I think that this is a vulnerability because it can be done by anyone from anywhere, to anybody that is a member of an MSN Community. Managers, assistant managers, and members alike. It is of course not clear what the impact could be completely since I have yet to hear of anyone else who knows how to exploit this vulnerability, So far I am the only one that i know of who is aware of how to use this.

Possible Actions To Take:

If you worry that someone has done this to your forum or another member, including yourself then i would suggest that you be sure to change your group settings to send any and all Forum messages to your inbox. From there change your e-mail settings to allow you to view the headers of All e-mails so that you can see the IP Address of the person who posted. This could help by possibly determining your group members actual IP address, and/or ISP. This of course wont always help since IP's are not always static, and ISP's can be the same amongst most of your members. However i think that this is a good step to take in helping to be sure who might be taking advantage of your forum. From there you can determine the ISP of the IP Address and report it to their ISP if you deem neccesary. It is recommended you speak with the person who's name was used in the forum though. You should e-mail them personaly or contact them by another e-mail they use to be absolutely sure that it was them and not someone else. Afterall if you used the forum for this, the same person could quickly respond saying everything is okay.

Here is some helpful information on how to receive messages in your inbox from your forum.

Go to Member Tools, or "Manager Tools" and select "Email Settings" Tick the box that reads:"Send all messages immediately to my e-mail inbox." and then click "Save Changes" From then on you should receive e-mail from anyone who has posted on your group forum.

In order to view message headers in your Inbox in "Hotmail" do the following:

Sign into hotmail.

Click "Options" at the top right of the page.
Click the "Mail" button on the left hand margine
Select "Mail Display Settings" Go down to
"Message Settings" and select Advanced
From there click "OK"

now when you view your e-mail messages you can see more information on the sender. The sender's ip is usualy contained after the X-OriginatingIP:

In outlook express, simply rightclick the Message subject and click "Properties", click the Details Tab, and again the IP is usualy located after X-Originating-IP:

I hope this helps anyone who may have been having strange activity on their forums in MSN Groups. I will respond with more information on wether or not you can inject HTML code into your posts that MSN Usualy does not support.

-Rift-

Post by **Tami** » Thu Sep 02, 2004 11:59 am

Would this work in catching the spammers who join forums then post porn links in the discussion boards if new posts are sent to your email? Although I imagine they're smart enough to spoof their information. <img src=\'http://www.killanet.net/forum3/public/s ... isgust.gif\' class=\'bbc_emoticon\' alt=\'(hmph)\' />

Rift · Post by **Rift** » Thu Sep 02, 2004 12:23 pm

you know i hadnt thought about that, that' seems like a good idea, just make a verification form to where they activate their account with a link in the e-mail (cant remember if you do that or not) and then that should help cut down on some of the spoofing as far as typing in random e-mails. then yeah if they post you get the e-mail addy they used, you could at least get that one shut even if it was just one of their little spamm from accounts. everybit helps:P

mobil1_oils · Post by **mobil1_oils** » Thu Sep 02, 2004 2:59 pm

[b][i][color=\"gray\"][font=\"tahoma\"]I know of a group im a member of that were having troubles with people joining and making abusive posts and just mindless posts with no apparant reason than to degrade someone. They now require all applications for membership to be approved by a manager or assistant manager, and if thats not enough work, EVERY post from EVERY member must be checked before it can be posted by a manager or assistant manager.

Since this has been in place, i havnt seen a porno post or anything similar. Its alot of work but if you have a few managers then it shouldn't be too hard to enforce. [/b][/i][/color][/font]