Overclock.net › Forums › Industry News › Software News › [ZDNet] Microsoft won't fix Windows flaw that lets hackers steal your username and password
New Posts  All Forums:Forum Nav:

[ZDNet] Microsoft won't fix Windows flaw that lets hackers steal your username and password

post #1 of 31
Thread Starter 
Quote:
The flaw is widely known, and it's said to be almost 20 years old. It was allegedly found in 1997 by Aaron Spangler and was most recently resurfaced by researchers in 2015 at Black Hat, an annual security and hacking conference in Las Vegas.
Quote:
The flaw works because Internet Explorer and Edge (on Windows 10) allow a user to access local network shares but don't fully block connections to remote shares.

To exploit this, a hacker has to trick a user into visiting a specially crafted web page in Internet Explorer or Edge (on Windows 10) that points to their own network share. The browser will silently send usernames and hashed passwords to the network share, which can then be scooped up and stolen.
Quote:
There's a simple mitigation, according to the group. Don't use Internet Explorer, Edge, or Microsoft Outlook, and don't log in to Windows with a Microsoft account.

Chrome and Firefox users aren't affected.

A Microsoft spokesperson suggested that the company would not patch the flaw.



Source.


Microsoft gets to deliver Edge recommendations when you're using Chrome or Firefox on Windows 10, I wonder if Firefox and Chrome would ever be allowed to deliver system notifications saying "Did you know that Edge is potentially compromising your security? Click here to read more about the problem and also about Firefox / Chrome."
Edited by tpi2007 - 8/5/16 at 3:43pm
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 1060 6 GB Gaming X 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 2TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
 
Metro 2033 review
Metro 2033
CPUMotherboardGraphicsRAM
Core i7-3820 Asus Sabertooth X79 MSI GTX 1060 6 GB Gaming X 16 GB Corsair DDR3 1866 Mhz Dominator 
Hard DriveOptical DriveCoolingOS
Samsung SSD 830 128GB + WD Caviar Black 2TB Sony Optiarc DVD-RW Corsair A70 + Noiseblocker M12-P Windows 7 Home Premium 64-bit 
MonitorKeyboardPowerCase
BenQ RL2455HM Cooler Master Octane Corsair AX750 Professional Modular 80 Plus Gold Cooler Master HAF 912 Plus 
Mouse
Cooler Master Octane 
  hide details  
Reply
post #2 of 31
I must say that's quite shocking, good thing the first thing i did when i installed W10 was get chrome, and never signed into my MS account with W10 either, always go to the outlook login through its webpage.
Malinka Kalinka
(16 items)
 
  
CPUMotherboardGraphicsRAM
i5 4670k 4.2GHz MSI Z97-G45 Gaming Asus GTX 980 Ti Strix G.SKILL Ripjaws X Series 16GB 1866 
Hard DriveCoolingCoolingOS
Samsung 850 EVO 500GB 6 140mm Fractal Design Case Fans Hyper 212 EVO Windows 10 Pro 
MonitorKeyboardPowerCase
Dell S2417DG CM Storm QuickFire Rapid-i  Cooler Master V750 Fractal Design Arc Midi R2 
MouseAudioAudio
Razer Deathadder Chroma Philips Fidelio X2 Logitech Z623 200 W 2.1 Speaker System 
  hide details  
Reply
Malinka Kalinka
(16 items)
 
  
CPUMotherboardGraphicsRAM
i5 4670k 4.2GHz MSI Z97-G45 Gaming Asus GTX 980 Ti Strix G.SKILL Ripjaws X Series 16GB 1866 
Hard DriveCoolingCoolingOS
Samsung 850 EVO 500GB 6 140mm Fractal Design Case Fans Hyper 212 EVO Windows 10 Pro 
MonitorKeyboardPowerCase
Dell S2417DG CM Storm QuickFire Rapid-i  Cooler Master V750 Fractal Design Arc Midi R2 
MouseAudioAudio
Razer Deathadder Chroma Philips Fidelio X2 Logitech Z623 200 W 2.1 Speaker System 
  hide details  
Reply
post #3 of 31

Keep it for Netflix, but don't use it for anything else.

post #4 of 31
That's slimey that they are able to recommend Edge on Chrome and Firefox. I know W10 users signed a agreement but without a doubt most peoples definition of "free" is "no strings attatched" and not "data mining and other follows".

Can't Mozilla or Google sue Microsoft for that?
post #5 of 31
Quote:
"We're aware of this information gathering technique, which was previously described in a paper in 2015. Microsoft released guidance to help protect customers and if needed, we'll take additional steps," the spokesperson said.

Anyone have a link to the bulletin or KB article from Microsoft that spokesperson is referring to? That would tell us their side of the story. If they're not patching it, that means there must be really simple config change of some kind that is a permanent fix. The article will explain the whole thing.
Death Star
(21 items)
 
Darksaber
(11 items)
 
 
CPUMotherboardGraphicsRAM
Athlon II x2 245 Asus M3A78 Radeon HD6570 1GB Mushkin Silverline 2GB DDR2  
Hard DriveOptical DriveOSMonitor
OCZ Vertex 2 120GB Samsung Blu-Ray Windows 7 Samsung 46" DLP 
PowerCaseOther
Silverstone Strider Essentials 400W Silverstone Milo ML03B Hauppage WinTV 1250 
  hide details  
Reply
Death Star
(21 items)
 
Darksaber
(11 items)
 
 
CPUMotherboardGraphicsRAM
Athlon II x2 245 Asus M3A78 Radeon HD6570 1GB Mushkin Silverline 2GB DDR2  
Hard DriveOptical DriveOSMonitor
OCZ Vertex 2 120GB Samsung Blu-Ray Windows 7 Samsung 46" DLP 
PowerCaseOther
Silverstone Strider Essentials 400W Silverstone Milo ML03B Hauppage WinTV 1250 
  hide details  
Reply
post #6 of 31
"Don't use Internet Explorer, Edge, or Microsoft Outlook, and don't log in to Windows with a Microsoft account."

Seems to be very solid life advice.
AMD Box
(15 items)
 
  
CPUMotherboardGraphicsRAM
AMD FX-8320E @ 4.6 GHz +0.356250v offset Asus Sabertooth 990FX Rev1 eVGA GTX 970 SC ACX2.0 Patriot Viper Xtreme 2x4 GB 1600LL 8-9-8-24 1T 
Hard DriveHard DriveHard DriveCooling
Samsung 840 EVO WD Black 1 TB 32MB cache FALS WD Blue 1 TB 7200rpm EZEX Corsair H80i 
OSMonitorKeyboardPower
Windows 10 x64 HP LP2475w Logitech Illuminated Corsair TX750  
CaseMouseAudio
You don't want to know Logitech G9x Creative Sound Blaster Z 
  hide details  
Reply
AMD Box
(15 items)
 
  
CPUMotherboardGraphicsRAM
AMD FX-8320E @ 4.6 GHz +0.356250v offset Asus Sabertooth 990FX Rev1 eVGA GTX 970 SC ACX2.0 Patriot Viper Xtreme 2x4 GB 1600LL 8-9-8-24 1T 
Hard DriveHard DriveHard DriveCooling
Samsung 840 EVO WD Black 1 TB 32MB cache FALS WD Blue 1 TB 7200rpm EZEX Corsair H80i 
OSMonitorKeyboardPower
Windows 10 x64 HP LP2475w Logitech Illuminated Corsair TX750  
CaseMouseAudio
You don't want to know Logitech G9x Creative Sound Blaster Z 
  hide details  
Reply
post #7 of 31
Quote:
Originally Posted by umeng2002 View Post

"Don't use Internet Explorer, Edge, or Microsoft Outlook, and don't log in to Windows with a Microsoft account."

Seems to be very solid life advice.
yup
Clyde
(13 items)
 
11.5L of Doom
(8 items)
 
 
CPUMotherboardGraphicsRAM
Athlon X2 5600+ ASUS M2V Sapphire 5670 2GB Dual Channel 
Hard DriveOptical DriveOSPower
WD 500GB Caviar Blue ASUS DVD burner. Windows 7 Ultimate 32-bit Gigabyte 460w 
Case
The desk, no case. 
CPUMotherboardGraphicsRAM
Intel Xeon E3-1231v3 Asus Z97I-Plus Mini ITX EVGA GTX970 ACX2.0 PNY XLR8 2x8GB 1866 9-10-9-28 
Hard DriveCoolingOSPower
Samsung 850 EVO 250GB Corsair h80i Windows 8.1 Pro 64bit Silverstone ST60F-PB 600w 
  hide details  
Reply
Clyde
(13 items)
 
11.5L of Doom
(8 items)
 
 
CPUMotherboardGraphicsRAM
Athlon X2 5600+ ASUS M2V Sapphire 5670 2GB Dual Channel 
Hard DriveOptical DriveOSPower
WD 500GB Caviar Blue ASUS DVD burner. Windows 7 Ultimate 32-bit Gigabyte 460w 
Case
The desk, no case. 
CPUMotherboardGraphicsRAM
Intel Xeon E3-1231v3 Asus Z97I-Plus Mini ITX EVGA GTX970 ACX2.0 PNY XLR8 2x8GB 1866 9-10-9-28 
Hard DriveCoolingOSPower
Samsung 850 EVO 250GB Corsair h80i Windows 8.1 Pro 64bit Silverstone ST60F-PB 600w 
  hide details  
Reply
post #8 of 31
Quote:
Originally Posted by wedge View Post

Anyone have a link to the bulletin or KB article from Microsoft that spokesperson is referring to? That would tell us their side of the story. If they're not patching it, that means there must be really simple config change of some kind that is a permanent fix. The article will explain the whole thing.

The one voice of reason in a sea of me too haters. I applaud you sir.
Project Taco
(17 items)
 
  
CPUMotherboardGraphicsGraphics
i7 4770k Z87 G1 Sniper 5 EVGA 780 TI Classified EVGA 780 TI Classified 
RAMHard DriveCoolingCooling
Avexir Core Series 4x4GB White Samsung 840 EVO Corsair H100i Noiseblocker eLoops 
OSMonitorMonitorKeyboard
Windows 8.1 QNIX QX2710 QNIX QX2710 KBT Pure MX Whites 
PowerCaseMouseAudio
EVGA Supernova 1000W Gold NZXT H440 Func MS-3 O2/ODAC 
Audio
MrSpeakers Mad Dogs (Fostex T50RP Mod) 
  hide details  
Reply
Project Taco
(17 items)
 
  
CPUMotherboardGraphicsGraphics
i7 4770k Z87 G1 Sniper 5 EVGA 780 TI Classified EVGA 780 TI Classified 
RAMHard DriveCoolingCooling
Avexir Core Series 4x4GB White Samsung 840 EVO Corsair H100i Noiseblocker eLoops 
OSMonitorMonitorKeyboard
Windows 8.1 QNIX QX2710 QNIX QX2710 KBT Pure MX Whites 
PowerCaseMouseAudio
EVGA Supernova 1000W Gold NZXT H440 Func MS-3 O2/ODAC 
Audio
MrSpeakers Mad Dogs (Fostex T50RP Mod) 
  hide details  
Reply
post #9 of 31
Quote:
Originally Posted by PhantomTaco View Post

The one voice of reason in a sea of me too haters. I applaud you sir.

Sure thing mate. Anything negative critic of Microsoft or their products is an act of hate, we all know.
However gladden yourself by how much less Microsoft browsers drain your batteries compared to other browsers.
Living room comp
(25 items)
 
   
CPUMotherboardGraphicsRAM
Intel i3-7100 Gigabyte H270N MSI GTX 1060 Aero 3G OC Corsair 8GB (1x8GB) DDR4 2400MHz CL16 Vengeance 
Hard DriveHard DriveOptical DriveCooling
Toshiba/OCZ TL100 2TB Harddrive from 2010 (Forgot to check maker ... ASUS slim drive BR-read/DVD-write Noctua NH-D9L 
CoolingCoolingOSMonitor
Noctua NF-A8 x2 Noctua NF-P12 120mm PWM x3 Win7 Home premium ASUS VP228 
MonitorKeyboardPowerCase
Samsung S32F351H Logitech K360 Fractal Design Integra 450W modular Fractal Design Node 605 
MouseMouse PadAudioAudio
Logitech M525 Inet Gaming Musmatta Yamaha A-S301 Dynavoice Magic S-4 v.2 
AudioAudioOtherOther
Deltaco Prime Optisk Toslink kabel - 1 meter Dynavoice Clear Cable 1,04 mm2 Deltaco HDMI cable 10m  Deltaco HDMI cable 1,5m  
Other
Netgear WNA1100 
CPUMotherboardGraphicsRAM
Intel i5-6600K ASUS Maximus VIII Gene MSI GTX 970 OC Kingston 8GB (2x4GB) DDR4 2666MHz Fury Black 
Hard DriveHard DriveHard DriveOptical Drive
OCZ ARC100 WD Green 240GB SSD Samsung 740 EVO 250GB ASUS internal DVD burner. bought between 2010-2013 
CoolingOSOSOS
Master Cooler 212 EVO Ubuntu Studio 16.04 64-bit Linux Mint 18.1 Mate 64-bit  Windows 7 HP 64-bit 
MonitorKeyboardPowerCase
asus vc239h Logitech K360 Fractal Design Integra M 550W 80+ Bronze Fractal Design Core 1300 
MouseMouse PadAudioAudio
Logitech M325  Inet Musmatta Gaming OPI T-amp gen.2 Dynavoice C1 Comet 
  hide details  
Reply
Living room comp
(25 items)
 
   
CPUMotherboardGraphicsRAM
Intel i3-7100 Gigabyte H270N MSI GTX 1060 Aero 3G OC Corsair 8GB (1x8GB) DDR4 2400MHz CL16 Vengeance 
Hard DriveHard DriveOptical DriveCooling
Toshiba/OCZ TL100 2TB Harddrive from 2010 (Forgot to check maker ... ASUS slim drive BR-read/DVD-write Noctua NH-D9L 
CoolingCoolingOSMonitor
Noctua NF-A8 x2 Noctua NF-P12 120mm PWM x3 Win7 Home premium ASUS VP228 
MonitorKeyboardPowerCase
Samsung S32F351H Logitech K360 Fractal Design Integra 450W modular Fractal Design Node 605 
MouseMouse PadAudioAudio
Logitech M525 Inet Gaming Musmatta Yamaha A-S301 Dynavoice Magic S-4 v.2 
AudioAudioOtherOther
Deltaco Prime Optisk Toslink kabel - 1 meter Dynavoice Clear Cable 1,04 mm2 Deltaco HDMI cable 10m  Deltaco HDMI cable 1,5m  
Other
Netgear WNA1100 
CPUMotherboardGraphicsRAM
Intel i5-6600K ASUS Maximus VIII Gene MSI GTX 970 OC Kingston 8GB (2x4GB) DDR4 2666MHz Fury Black 
Hard DriveHard DriveHard DriveOptical Drive
OCZ ARC100 WD Green 240GB SSD Samsung 740 EVO 250GB ASUS internal DVD burner. bought between 2010-2013 
CoolingOSOSOS
Master Cooler 212 EVO Ubuntu Studio 16.04 64-bit Linux Mint 18.1 Mate 64-bit  Windows 7 HP 64-bit 
MonitorKeyboardPowerCase
asus vc239h Logitech K360 Fractal Design Integra M 550W 80+ Bronze Fractal Design Core 1300 
MouseMouse PadAudioAudio
Logitech M325  Inet Musmatta Gaming OPI T-amp gen.2 Dynavoice C1 Comet 
  hide details  
Reply
post #10 of 31
How else would then US spy agencies log into your machine?

---

Fix? Don't use the browsers. Block them in firewall. Don't use or click on network shared resources. That whole MS local area network sharing has caused not one issue over the years. I even had to deal with network admin because of it as his silly too strict DDOS detection was tripping on it when a single PC was replying to 100+ other PCs on local network at once.
Edited by JackCY - 8/6/16 at 4:47am
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Software News
Overclock.net › Forums › Industry News › Software News › [ZDNet] Microsoft won't fix Windows flaw that lets hackers steal your username and password