Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Live Account Credentials Leaking from Windows 8 and Above

hackaday.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#131

Post by Sami_Lehtinen »

el_duderino wrote: post #41
JBiserkov wrote: post #8

Microsoft should fix this ASAP. You should enable Two-factor Authentication (2FA) on your account. https://support.microsoft.com/en-us/help/12408/microsoft-acc...

The permissions their Android 2FA app requires seems a bit much for its purpose. The app has access to: - Identity - Contacts - SMS - Camera - Device ID & call information - Other https://play.google.com/store/apps/details?id=com.microsoft.... Am I the only one who thinks that?

MS 2FA fails, you can still use IMAP to fetch email and stuff, without 2FA. So it's only partial implementation. Of course it prevents "completely taking over the account", but even if it's enabled you can still do a lot without providing 2FA code.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#132

Post by evilgenius134 »

5350-uiop-1130 wrote: post #115
Nokinside wrote: post #42

As a Linux user I have kept Windows 7 & 8 partitions in my laptop and workstation disks for years because there used to be time where you needed Windows in the work for some programs to work and some documents to open. Windows 10 upgrade push made me to realize that that time passed a long time ago. Last time I booted to Windows for other reason than playing a game was seven years ago. LibreOffice works well with MS…

I don't get the general negativity around Windows. Variety, for me, is a good thing. Every OS has it's strengths, weaknesses and use-cases. I know the argument is often framed as open vs closed source ecosystems but I think and hope that ultimately having more options and more variety is good and interesting for us. Windows, does deservedly get a lot of stick for it's past issues (windows rot etc) and present issues.…

>I'm a Chrome user but I still love to run Opera, Firefox and Edge now

Chrome has never actively tried to uninstall/remove competing browsers or corrupt your ability to reliably run them, I distinctly remember my own install of Windows 10 destroying my bootloaders set up by Linux and uninstalling applications automatically. Although it has show the ability to send as much information as it wants back home.

>If Windows is bad, I hope it improves.

I'm sure people in 2001 were saying the same thing about Microsoft and it appears they are emulating it again.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#133

Post by 5350-uiop-1130 »

evilgenius134 wrote: post #132
5350-uiop-1130 wrote: post #115

Earlier quoted context omitted.

I don't get the general negativity around Windows. Variety, for me, is a good thing. Every OS has it's strengths, weaknesses and use-cases. I know the argument is often framed as open vs closed source ecosystems but I think and hope that ultimately having more options and more variety is good and interesting for us. Windows, does deservedly get a lot of stick for it's past issues (windows rot etc) and present issues.…

>I'm a Chrome user but I still love to run Opera, Firefox and Edge now Chrome has never actively tried to uninstall/remove competing browsers or corrupt your ability to reliably run them, I distinctly remember my own install of Windows 10 destroying my bootloaders set up by Linux and uninstalling applications automatically. Although it has show the ability to send as much information as it wants back home. >If Window…

I was indeed saying the same thing in 2001. Just with more swearing.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#134

Post by dpark »

Sylos wrote: post #29
philjohn wrote: post #22

Earlier quoted context omitted.

Nope. The started with the IE 11 source code and ripped a whole load of stuff dealing with compatibility, and previous rendering engines, out. Once they had completed this step they started adding new features in, but it's still got the legacy of Internet Explorer code in it.

I still don't understand how this myth that they wrote Edge from scratch even came to be. You don't just quickly write a browser from scratch in this day and age. And if you did, it would be so much better than Edge or the other contemporary browsers, because you could start out with a much better architecture...

> And if you did, it would be so much better than Edge or the other contemporary browsers, because you could start out with a much better architecture...

New isn't always better. It's not as if no one on the Chrome/Firefox/IE teams are working on the architecture of the existing browsers. If you had the resources to build a new browser from scratch, you probably would not end up with something better than the existing browsers.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#135

Post by slightlycuban »

5350-uiop-1130 wrote: post #115
Nokinside wrote: post #42

As a Linux user I have kept Windows 7 & 8 partitions in my laptop and workstation disks for years because there used to be time where you needed Windows in the work for some programs to work and some documents to open. Windows 10 upgrade push made me to realize that that time passed a long time ago. Last time I booted to Windows for other reason than playing a game was seven years ago. LibreOffice works well with MS…

I don't get the general negativity around Windows. Variety, for me, is a good thing. Every OS has it's strengths, weaknesses and use-cases. I know the argument is often framed as open vs closed source ecosystems but I think and hope that ultimately having more options and more variety is good and interesting for us. Windows, does deservedly get a lot of stick for it's past issues (windows rot etc) and present issues.…

> I don't get the general negativity around Windows.

For me, it's that the system is completely closed and opaque, and there routinely isn't much I can do about it.

Not saying the other guys are perfect--far from it--but at least I can take a crack at changing things. Windows is the most closed-source OS I run (more so than OSX). When it doesn't do The Right Thing, I can get very negative.

And to your point, I feel I've learned much more from OSes that expose the internals and let me mess with them, than those that don't.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#136

Post by drzaiusapelord »

option_greek wrote: post #18

I thought they started fresh with Edge browser by keeping it away from windows/OS specific stuff. Apparently not.

Edge just passes links it can't handle to its default handler, like it should[1]. So a link to \\server1\share\file.docx will be sent to Explorer which will try to auth using cached credentials. The attacker can sniff out the NTLM exchange and put the hashed password into a cracker. If your password is weak, then it'll be cracked. Voila! He has your MS username/password.

The larger issue is the lack of 2fa by default. I think these kinds of attacks are symptoms of a larger problem that a lot of hosted services have been ignoring.

[1] There's probably a good argument that Edge should ignore network links like these, but I imagine businesses would be upset if suddenly no one can browse the intranet or open html/jpg/gif items on a share.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#137

Post by lucb1e »

scholia wrote: post #128
lucb1e wrote: post #121

Earlier quoted context omitted.

How many people don't even have payment info in their Google or Microsoft account? They can't pay anyway and payment info is not required so clearly that's not it. I'd just like to download apk files from the play store, but that's not possible without an account even though there's no reason for it whatsoever. Moreover, I'd like to contribute to many apps while still not attaching payment info to my account. Current…

I think all the major ecosystems require a log-in: Apple, Amazon, Google, Microsoft. In Windows 10's case, it's only for apps. If you're happy with Win32 programs, you still don't need to use a Microsoft Account.

I'm not, but then that's why I switched to an open platform called Debian.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#138

Post by scholia »

lucb1e wrote: post #137
scholia wrote: post #128

Earlier quoted context omitted.

I think all the major ecosystems require a log-in: Apple, Amazon, Google, Microsoft. In Windows 10's case, it's only for apps. If you're happy with Win32 programs, you still don't need to use a Microsoft Account.

I'm not, but then that's why I switched to an open platform called Debian.

Your choice ;-)

Did you actually use Windows 10 you're complaining about?

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#139

Post by lucb1e »

scholia wrote: post #138
lucb1e wrote: post #137

Earlier quoted context omitted.

I'm not, but then that's why I switched to an open platform called Debian.

Your choice ;-) Did you actually use Windows 10 you're complaining about?

I'm not complaining about Windows 10 in particular.

I'm complaining about walled gardens and application "stores" that require an account in particular, even when they don't require payment information (making them not a store at all, just a walled application garden).

And yes, I have used the Windows Store once or twice, but I don't see how that changes anything.

Re: Microsoft Live Account Credentials Leaking from Windows 8 and Above

#140

Post by ValdikSS »

NKCSS wrote: post #59

This is fun to write for yourself; small SMB client to couple a unique file request to the credentials and website showing the info retrieved via SMB; I think I found my weekend project :)

https://github.com/SpiderLabs/Responder
Post reply on HN