Windows 10 themes can be abused to steal Windows accounts

guest · Sep 7, 2020

Windows 10 themes can be abused to steal Windows accounts
September 7, 2020
https://www.bleepingcomputer.com/ne...emes-can-be-abused-to-steal-windows-accounts/

Specially crafted Windows 10 themes and theme packs can be used in 'Pass-the-Hash' attacks to steal Windows account credentials from unsuspecting users.
Custom themes can be used to steal Windows passwords
This weekend security researcher Jimmy Bayne (@bohops) revealed that specially crafted Windows themes could be used to perform Pass-the-Hash attacks.

Pass-the-Hash attacks are used to steal Windows login names and password hashes by tricking a user into accessing a remote SMB share that requires authentication.
When trying to access the remote resource, Windows will automatically try to login to the remote system by sending the Windows user's login name and an NTLM hash of their password.
Click to expand...

In the new method discovered by Bayne, an attacker can create a specially crafted .theme file and change the desktop wallpaper setting to use a remote authentication-required resource, such as the one below.

Since Microsoft moving away from local Windows 10 accounts and towards Microsoft accounts, remote attackers can use this attack to more easily access a myriad of remote services offered by Microsoft.
Bayne stated that he disclosed this attack to Microsoft earlier this year, but was told it would not be fixed as it is a "feature by design."
Click to expand...

Protecting against malicious theme files
To protect against malicious theme files, Bayne advised that you block or re-associate the .theme, .themepack, and .desktopthemepackfile extensions to a different program.
Doing so, though, will break the Windows 10 Themes feature, so only use it if you do not need to switch to another theme.
Click to expand...

[Credential Harvesting Trick] Using a Windows .theme file, the Wallpaper key can be configured to point to a remote auth-required http/s resource. When a user activates the theme file (e.g. opened from a link/attachment), a Windows cred prompt is displayed to the user 1/4 pic.twitter.com/rgR3a9KP6Q
— bohops (@bohops) September 5, 2020
Click to expand...

Log in or Sign up

Windows 10 themes can be abused to steal Windows accounts

guest Guest

Log in or Sign up

Windows 10 themes can be abused to steal Windows accounts

guest Guest

Useful Searches