- Jun 9, 2013
- 6,720
What would you say if I told you that an almost two decade old vulnerability in Windows may leak your Microsoft Account credentials when you visit a website, read an email, or use VPN over IPSec?
A bug, that goes all the way back to Windows 95 is causing major issues on Windows 8 and Windows 10.
Basically, what happens is the following: Microsoft Edge, Internet Explorer, Outlook and other Microsoft products allow connections to local network shares. What the default settings don't prevent on top of that is connections to remote shares.
An attacker could exploit this by creating a website or email with an embedded image or other content that is been loaded from a network share.
Microsoft products like Edge, Outlook or Internet Explorer try to load the network share resource, and send the active user's Windows login credentials, username and password to that network share.
The username is submitted in plaintext, the password as a NTLMv2 hash.
Microsoft Account Credentials Leak vulnerability
Full Article. Microsoft Account Credentials Leak vulnerability - gHacks Tech News
A bug, that goes all the way back to Windows 95 is causing major issues on Windows 8 and Windows 10.
Basically, what happens is the following: Microsoft Edge, Internet Explorer, Outlook and other Microsoft products allow connections to local network shares. What the default settings don't prevent on top of that is connections to remote shares.
An attacker could exploit this by creating a website or email with an embedded image or other content that is been loaded from a network share.
Microsoft products like Edge, Outlook or Internet Explorer try to load the network share resource, and send the active user's Windows login credentials, username and password to that network share.
The username is submitted in plaintext, the password as a NTLMv2 hash.
Microsoft Account Credentials Leak vulnerability
Full Article. Microsoft Account Credentials Leak vulnerability - gHacks Tech News
