The exploit depends on an attacker inserting a link to an SMB resource (network share) inside an email or a Web page that gets noticed via Outlook. Inside the image tags, the attacker can camouflage the link to his network share. Further, they can put the link to a network share hosted on his own network instead of the proper image link. When a user tries to use the link via Internet Explorer, Edge, or Outlook, their computer even via the Internet will automatically send their login credentials to validate on the criminal’s domain. The reason is due to the way Windows manages authentication for network shares. Even though Microsoft account password is not leaked in cleartext, researchers demonstrated a long time ago that as an NTLM hash, these could be easily cracked. This isn’t even something new, since Microsoft and the researcher community have known about this issue since 1997 and often discussed it at security conferences such as Black Hat. This was not an issue in the past, as Windows accounts were using machine-localized usernames and password. However, Microsoft started to allow users to validate on their computers with Microsoft accounts after it introduced Windows 8 and upwards. By the time, Windows 10 was out; this became the de-facto standard validation method implying that it was used by more users. Microsoft has begun to associate all its online realities with the user’s same Microsoft account in the recent years. This old attack now allows a crook to access credentials for Microsoft accounts, which in turn will also grant them indirect entry to all kinds of services like Skype, OneDrive, Xbox, Bing, MSN, Office 360, Azure, and more, says ValdikSS from ProstoVPN. To make things worse, the user’s VPN credentials get leaked if the user is making use of a VPN connection to load the fraudulent SMB resource. This allows the crook to access the victim’s VPN account. “Microsoft successfully fixed some issues, some other issues were half-fixed, and another ones are not fixed at all and could be exploited up to this day,” ValdikSS explains. “The problem of transmitting account credentials to the SMB server over the internet is one of the not fixed ones.” One can simply protect themselves against such attacks is by obstructing all outgoing SMB connections (port 445) via the Windows firewall, except for local networks, ValdikSS says. However, the best solution against such attack would be to not use your Microsoft account to log into your Windows PC.
