Microsoft Accounts may leak credentials, says researcher

A researcher has warned in a blog that a long-known vulnerability in Windows’ single-sign on capability for accessing Office 365, One Drive and other Microsoft products may be more serious than previously thought.

A number of security Web sites are picking up the blog — originally written in Russian — which says the problem in the Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, can leak a Microsoft Account user name and hashed password if the access is attempted through Microsoft products like Explorer or Edge browsers or Outlook.

Related Articles

Citrix says customers of remote PC access service stung by password re-use

Good IT security doesn't only mean using technology the right way. It also means employees have to follow safe practices,...

June 21st, 2016 Howard Solomon @HowardITWC

Most data breaches leverage weak, default or stolen passwords: Report

Cyber attackers are well-funded, cunning, ruthless and otherwise mean people But they get a helping hand from their victims, according...

April 29th, 2016 Howard Solomon @HowardITWC

Briefly, MSPowerusers.com reports the vulnerability could be exploited through a compromised image in a Web page which loads from a SMB network share. The Microsoft product would try and load the network share resource, and and send the active user’s Windows login credentials, username and password to that network share. The username is send in plaintext, and the password as a NTLMv2 hash.

Security Week reports the vulnerability was detailed in a paper at last year’s Black Hat security conference but described at the time as a way to attack Windows. The new wrinkle is the possible leak of credentials.

One defence is to make sure users have hard to crack passwords because the NTLM hash can be broken. Home or small business users could also set firewalls to block the Server Message Block ports.