Source: Matt Brown | Windows Central
What you need to know
- A vulnerability in Zoom allows hackers to obtain your Windows login name and password.
- The vulnerability relies on people clicking a link that is actually a Windows networking UNC path.
- If a person clicks the link, Zoom can send the person's login name and NTLM password hash, which can be used to obtain a person's password.
Zoom is having a moment right now. It's become the go-to form of communication for many people during the current health crisis. Unfortunately, a vulnerability within Zoom can allow hackers to obtain people's Windows login name and password. Security researcher and Twitter user Mitch (@_g0dmode) spotted the vulnerability first. BleepingComputer then followed up with its own investigation and testing.
The core of the issue revolves around how Zoom handles URLs. When you send a URL within a Zoom chat, the program converts it into a link. That's handy for websites, but the problem is that Zoom also converts Windows networking UNC paths into links. If someone clicks a link that's a UNC path, Windows will try to connect to the remote site the path goes to using SMB file-sharing protocol. By default, this action will cause Windows to send a person's login name and their NTM password hash. The NTLM password hash can be cracked using free tools, such as Hashcat, and reveal someone's password.
Security researcher Matthew Hickey (@HackerFantastic) tested this process and was able to get NTLM password hashes using the vulnerability. BleepingComputer replicated the process as well. BleepingComputer was able to dehash an "easy password" in just 16 seconds.
In addition to helping hackers obtain people's passwords, the same process can also be used to launch programs on people's computers. Fortunately, Windows will prompt you when this happens and ask if you want to run the program.
How to fix Zoom's Windows 10 user-info and password-leak problems
Hickey spoke to BleepingComputer about how to fix the issue, stating, "Zoom should not render UNC paths as hyperlinks is the fix, I have notified Zoom as I disclosed it on Twitter."
Until Zoom issues a fix, you can prevent NTML credentials from being automatically sent to a remote server when you click a UNC link. This is done with a Group Policy. Bleeping Computer outlines the process and we also have our own guide on how to do it.
Benchmarking the new Surface Book 3 15 with GTX 1660 Ti and 10th Gen i7
Although it's too early for a review, here are some initial benchmarks from the new Surface Book 3 15-inch with a Core i7 and NVIDIA GeForce 1660 Ti (Max-Q) and how it compares to Surface Book 2 and other premium laptops. Spoiler: While the CPU is just OK, that 1660 Ti definitely bumps up the Book 3's potential.
Review: Sabrent's Rocket Q SSDs are fast, well-priced and go up to 4TB
Sabrent has a new SSD range available in the form of the Rocket Q. These new NVMe SSDs use QLC NAND, but offer impressive speeds and storage capacities at affordable prices. Check our full review to see how they compare against other SSDs.
Review: How do I go back to Wi-Fi 5 after using TP-Link's Archer AX6000?
TP-Link's Archer AX6000 is an 802.11ax router designed to take your network into the future. However, it might not be exactly what you're looking for due to its high-end specs and relatively high price. We explain in this review.
The best photo editing apps for Windows 10
Whether you need to remove red eyes, or do heavy duty editing, these are the best photo editing apps for Windows 10.
