Microsoft Account Passwords, VPN Credentials Leaked Due To Windows Flaw

All Windows versions have a flaw that leak Microsoft account passwords and VPN credentials

If a Microsoft user is using a VPN (virtual private network) to browse the Internet, there are chances that the user’s Microsoft account username and password or VPN credentials could be leaked. The reason behind this is assumed to be the error by Windows in handling its old validation procedures for shared network resources.

The exploit depends on an attacker inserting a link to an SMB resource (network share) inside an email or a Web page that gets noticed via Outlook.

Inside the image tags, the attacker can camouflage the link to his network share. Further, they can put the link to a network share hosted on his own network instead of the proper image link.

When a user tries to use the link via Internet Explorer, Edge, or Outlook, their computer even via the Internet will automatically send their login credentials to validate on the criminal’s domain. The reason is due to the way Windows manages authentication for network shares.

Even though Microsoft account password is not leaked in cleartext, researchers demonstrated a long time ago that as an NTLM hash, these could be easily cracked.

This isn’t even something new, since Microsoft and the researcher community have known about this issue since 1997 and often discussed it at security conferences such as Black Hat.

This was not an issue in the past, as Windows accounts were using machine-localized usernames and password. However, Microsoft started to allow users to validate on their computers with Microsoft accounts after it introduced Windows 8 and upwards. By the time, Windows 10 was out; this became the de-facto standard validation method implying that it was used by more users.

Microsoft has begun to associate all its online realities with the user’s same Microsoft account in the recent years. This old attack now allows a crook to access credentials for Microsoft accounts, which in turn will also grant them indirect entry to all kinds of services like Skype, OneDrive, Xbox, Bing, MSN, Office 360, Azure, and more, says ValdikSS from ProstoVPN.

To make things worse, the user’s VPN credentials get leaked if the user is making use of a VPN connection to load the fraudulent SMB resource. This allows the crook to access the victim’s VPN account.

“Microsoft successfully fixed some issues, some other issues were half-fixed, and another ones are not fixed at all and could be exploited up to this day,” ValdikSS explains. “The problem of transmitting account credentials to the SMB server over the internet is one of the not fixed ones.”

One can simply protect themselves against such attacks is by obstructing all outgoing SMB connections (port 445) via the Windows firewall, except for local networks, ValdikSS says. However, the best solution against such attack would be to not use your Microsoft account to log into your Windows PC.

Kavita Iyer

An individual, optimist, homemaker, foodie, a die hard cricket fan and most importantly one who believes in Being Human

Recent Posts

3 New Ways To Take A ScreenShot On Android Smartphones

Android is possibly the most popular Smartphone OS with more than 2 billion monthly active devices. There might be times…

11 hours ago

What is Mac OS? Pros and Cons | Explanation

"Apple" the most valuable brand in the world produces some of the best Hardware & Software products and Mac OS…

11 hours ago

Google Search is testing ‘Learn To Pronounce’ feature in different speeds and accents

Google Search’s new feature will teach you how to pronounce words in different accents Over a period of time, Google…

14 hours ago

10 Best Free Skype Alternatives For Windows/Android/iOS

Since its advent in 2003, Skype has become an industry standard when it comes to video calling on Windows PC. In…

2 days ago

Sony PlayStation Classic hacked to run games off a USB drive

Hackers crack Sony’s PlayStation Classic shortly after the release Last week, Sony released PlayStation Classic with 20 officially preinstalled games,…

2 days ago

What to Do If Your iPhone or iPad got stuck on Apple logo?

There are situations when people have frozen iPhone and iPad on Apple logo during startup. And, if you are also…

4 days ago