According to the article:-
Endpoint security vendor Imperva, who said they've discovered a way to poison Windows folders and gain the access rights of anyone who browses to that folder. The hack involves exploiting a relaying feature in Microsoft NT LAN Manager (NTLM), which is a widely used Windows challenge-response authentication protocol.
Anyone who can be tricked into clicking on a folder containing such a shortcut icon will launch an NTLM relay, which passes their authentication credentials via the compromised PC to Active Directory and then gives the compromised PC the same access rights
Shulman said similar types of attacks can be launched beyond Windows. Other potential targets include Jive, SharePoint, or other collaboration software, especially if it includes the ability to publish small blurbs of information via feeds, together with small images, as these images can used by attackers to point to remote machines and launch NTLM relay attacks.
The link below has more information:-
No comments:
Post a Comment