Skip to main content

Google Chrome flaw could allow Windows credential theft

Malicious Google Chrome extension collected users' data for third parties
Malicious Google Chrome extension collected users' data for third parties
A bug in Google's popular web browser Chrome could enable bad actors to place a malicious file onto a target PC that could then be used to siphon off Windows credentials and initiate a Server Message Block (SMB) relay attack, according to a post by Bosko Stankovic, an information security engineer at DefenseCode.
Stankovic discovered the vulnerability in the default configuration of Chrome and all Windows versions supporting the browser.
"With its default configuration, Chrome browser will automatically download files that it deems safe without prompting the user for a download location but instead using the preset one," Stankovic wrote. This step, he explained, is not optimal from a security standpoint, but for it to cause any harm a user would still need to manually open and run the file.
The problem is that a Windows Explorer Shell Command File or SCF (.scf) – a text file that launches commands – requires no user action and can be used to trick Windows into an authentication attempt to a remote SMB server, which then gathers victims' usernames and Microsoft LAN Manager (NTLMv2) password hash, Stankovic wrote.
This is enough personal data, he explained, to launch account breaches on Windows systems. For enterprises using Microsoft Exchange and which use NTLM as an authentication strategy, the bug could enable SMB relay attacks, where the bad actors could pose as the victim and thus gain access to networks without a password.
When a number of anti-virus solutions were tested, none captured the downloaded file as suspicious.
To disable automatic downloads in Google Chrome, Stankovic recommended the following preferences be checked: Settings -> Show advanced settings -> Check the Ask where to save each file before downloading option.
"Manually approving each download attempt significantly decreases the risk of NTLMv2 credential theft attacks using SCF files," he explained.
Google is reportedly looking into the vulnerability.

Comments

Popular posts from this blog

fix idm integration on chrome

Chrome Browser Integration I do not see IDM extension in Chrome extensions list. How can I install it?  How to configure IDM extension for Chrome? Please note that all IDM extensions that can be found in Google Store are fake and should not be used. You need to install IDM extension manually from IDM installation folder. Read in step 2 how to do it . 1. Please update IDM to the latest version by using  "IDM Help->Check for updates..."  menu item 2.  I don't see  "IDM Integration module"  extension in the list of extensions in  Chrome . How can I install it? Press on  Chrome  menu ( arrow 1  on the image), select  "Settings"  menu item ( arrow 2  on the image) and then select  "Extensions"  tab ( arrow 3  on the image). After this open IDM installation folder ( "C:\Program Files (x86)\Internet Download Manager"  by default,  arrow 4  on the image) and drag and drop  "IDMGCExt.crx"  ( arrow 5  on the image) file int

sxhkd volume andbrightness config for dwm on void

xbps-install  sxhkd ------------ mkdir .config/sxhkd cd .config/sxhkd nano/vim sxhkdrc -------------------------------- XF86AudioRaiseVolume         amixer -c 1 -- sset Master 2db+ XF86AudioLowerVolume         amixer -c 1 -- sset Master 2db- XF86AudioMute         amixer -c 1 -- sset Master toggle alt + shift + Escape         pkill -USR1 -x sxhkd XF86MonBrightnessUp          xbacklight -inc 20 XF86MonBrightnessDown          xbacklight -dec 20 ------------------------------------------------------------- amixer -c card_no -- sset Interface volume run alsamixer to find card no and interface names xbps-install -S git git clone https://git.suckless.org/dwm xbps-install -S base-devel libX11-devel libXft-devel libXinerama-devel  vim config.mk # FREETYPEINC = ${X11INC}/freetype2 #comment for non-bsd make clean install   cp config.def.h config.h vim config.h xbps-install -S font-symbola #for emoji on statusbar support     void audio config xbps-i

Hidden Wiki

Welcome to The Hidden Wiki New hidden wiki url 2015 http://zqktlwi4fecvo6ri.onion Add it to bookmarks and spread it!!! Editor's picks Bored? Pick a random page from the article index and replace one of these slots with it. The Matrix - Very nice to read. How to Exit the Matrix - Learn how to Protect yourself and your rights, online and off. Verifying PGP signatures - A short and simple how-to guide. In Praise Of Hawala - Anonymous informal value transfer system. Volunteer Here are five different things that you can help us out with. Plunder other hidden service lists for links and place them here! File the SnapBBSIndex links wherever they go. Set external links to HTTPS where available, good certificate, and same content. Care to start recording onionland's history? Check out Onionland's Museum Perform Dead Services Duties. Introduction Points Ahmia.fi - Clearnet search engine for Tor Hidden Services (allows you