Infrastructure Privacy & Security Microsoft Accounts may leak credentials, says researcher Howard Solomon @HowardITWC Published: August 3rd, 2016A researcher has warned in a blog that a long-known vulnerability in Windows’ single-sign on capability for accessing Office 365, One Drive and other Microsoft products may be more serious than previously thought.A number of security Web sites are picking up the blog — originally written in Russian — which says the problem in the Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, can leak a Microsoft Account user name and hashed password if the access is attempted through Microsoft products like Explorer or Edge browsers or Outlook. Related Articles Citrix says customers of remote PC access service stung by password re-useGood IT security doesn't only mean using technology the right way. It also means employees have to follow safe practices,... June 21st, 2016 Howard Solomon @HowardITWC Most data breaches leverage weak, default or stolen passwords: ReportCyber attackers are well-funded, cunning, ruthless and otherwise mean people But they get a helping hand from their victims, according... April 29th, 2016 Howard Solomon @HowardITWC Briefly, MSPowerusers.com reports the vulnerability could be exploited through a compromised image in a Web page which loads from a SMB network share. The Microsoft product would try and load the network share resource, and and send the active user’s Windows login credentials, username and password to that network share. The username is send in plaintext, and the password as a NTLMv2 hash.Security Week reports the vulnerability was detailed in a paper at last year’s Black Hat security conference but described at the time as a way to attack Windows. The new wrinkle is the possible leak of credentials.One defence is to make sure users have hard to crack passwords because the NTLM hash can be broken. Home or small business users could also set firewalls to block the Server Message Block ports.Would you recommend this article?00 Thanks for taking the time to let us know what you think of this article! We'd love to hear your opinion about this or any other story you read in our publication. Click this link to send me a note →Jim Love, Chief Content Officer, IT World Canada Related Download Sponsor: LG LG Business Solutions New technologies can ease the burden on IT departments while enhancing productivity and satisfaction for the end users they serve. Learn More Infrastructure, Privacy & Security Microsoft, security strategies