Windows NT LAN Manager tokens could be exposed in a new attack leveraging forced authentication through a custom Microsoft Access file, The Hacker News reports.
Threat actors could conduct the intrusion by exploiting Access' linked table feature by adding an .accdb file containing a remote SQL Server database link to a Microsoft Word document, a report from Check Point revealed. Opening the file and clicking the linked table would then trigger the authentication process, with the valid response delivered to the NTLM server.
"This feature can be abused by attackers to automatically leak the Windows user's NTLM tokens to any attacker-controlled server, via any TCP port, such as port 80. The attack can be launched as long as the victim opens an .accdb or .mdb file. In fact, any more-common Office file type (such as a .rtf ) can work as well," said researcher Haifei Li.
Such an attack has emerged after Microsoft revealed plans to use Kerberos in favor of NTLM in Windows 11 in a bid to strengthen security.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.