Network managers have been urged to review their own web security practices after Microsoft's Hotmail service became subject to one of the highest-profile internet hacks in the web's history.

The 'hole' in Hotmail's security meant that full access to more than 40 million Hotmail subscribers' accounts could be gained by simply entering a special URL.

A previously unknown group, Hackers Unite, has claimed responsibility for the attack.

The crackers modified freeware code to allow entry to Hotmail accounts, via a URL, without the need to provide passwords.

Details of the exploit were posted on a website in Sweden last week and were quickly copied to a number of other sites in the UK and US.

Microsoft, which was forced to take down the Hotmail service for two hours, has posted an apology and stated that its engineers have solved the problem.

Ex-hacker Mathew Bevan, now a consultant at Tiger Security, speculated that the exploit may have relied on an intentional 'backdoor' left open by Microsoft.

"This was either an oversight or an inside job," said Bevan, who added that, bad as the breach was, exploits against Microsoft's applications present a far more serious problem.

David Butler, a security analyst at Axent Technologies, said the breach is serious because many companies use web-based email services, such as Hotmail.

"It seems that a script existed and was left on a server without protection, so it could be read and exploited," said Butler.

Butler said test scripts carelessly left on web servers constituted a common class of vulnerability, and advised regular housekeeping.

HOW HOTMAIL WAS HACKED

The code needed to exploit the Hotmail breach required only five lines of Common Gateway Interface (CGI) HTML script. This is applied to a common Hotmail gateway http://wya-pop.hotmail.com/cgi-bin/start.

This skeleton 'key' code looks like: http://207.82.250.251/cgi-bin/start?curmbox= ACTIVE&js=no&login=username&passwd=eh

All that was needed was to cut and paste the above code in a web browser and replace 'username' with someone's Hotmail user name.