Windows Live

Um, and, uh, And then I worked on a bunch of other Microsoft products, but I always kind of had accessibility as a side job.

And then sometime, I'm trying to remember exactly when, like 2008 or so, I went full-time to run accessibility for Windows Live.

And then I went to the central accessibility team that was at the time called Trustworthy Computing under Rob Sinclair, who you probably know.

Yeah.

So it does mean if you do identify something suspicious in a user agent, it can be used to link campaigns and tools, even where the IP address and the infrastructure used is rotated.

Back in September, we identified a spike in brute force detections targeting an application called Windows Live Custom Domains.

This is a legacy service that allowed domain owners to use services like Outlook with their own domains.

The graph here shows the sudden spike in sign-in attempts against the application, which happened between the 20th and 30th of September.

Sure.

So we've looked at the client ID spoofing and Now, what are the benefits of doing this? The first is that, as we've seen, no application name is recorded.

This means that if you have detections that look for a surge in activity against a specific application, like we saw with the Custom Cloak campaign that targeted Windows Live custom domains, you might miss the activity entirely because the app name field is blank.

And in the case that a completely invalid client ID is sent, then the client ID field itself will be blank as well.

You know what really makes it interesting, though? They say it has to be someone of a certain age because if you look through the history of Hotmail, a majority of the Hotmail addresses were issued in the late 90s and early 2000s.

In 2007, the service was rebranded to Windows Live.

That didn't last very long.

Then it shifted back to Hotmail in 2011.