A researcher has warned in a blog that a long-known vulnerability in Windows’ single-sign on capability for accessing Office 365, One Drive and other Microsoft products may be more serious than previously thought.
A number of security Web sites are picking up the blog — originally written in Russian — which says the problem in the Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, can leak a Microsoft Account user name and hashed password if the access is attempted through Microsoft products like Explorer or Edge browsers or Outlook.
Briefly, MSPowerusers.com reports the vulnerability could be exploited through a compromised image in a Web page which loads from a SMB network share. The Microsoft product would try and load the network share resource, and and send the active user’s Windows login credentials, username and password to that network share. The username is send in plaintext, and the password as a NTLMv2 hash.
Security Week reports the vulnerability was detailed in a paper at last year’s Black Hat security conference but described at the time as a way to attack Windows. The new wrinkle is the possible leak of credentials.
One defence is to make sure users have hard to crack passwords because the NTLM hash can be broken. Home or small business users could also set firewalls to block the Server Message Block ports.