CWE-201: Information Exposure Through Sent Data

Many software products use HTTP requests for various features such as software update checking. A malicious user can intercept such requests (such as with a MITM proxy) and use HTTP Redirect to redirect the victim a malicious SMB server. If the redirect is a file:// URL and the victim is running Microsoft Windows, Windows will automatically attempt to authenticate to the malicious SMB server by providing the victim's user credentials to the server. These credentials can then be logged by the malicious server. The credentials are encrypted, but may be "brute-forced" to break the encryption.

The following Windows API functions (available via urlmon.dll) have been identified as being affected:

• URLDownloadA
• URLDownloadW
• URLDownloadToCacheFileA
• URLDownloadToCacheFileW
• URLDownloadToFileA
• URLDownloadToFileW
• URLOpenStream
• URLOpenBlockingStream

An attacker exploiting this vulnerability may obtain the victim's user credentials in an encrypted format.

The CERT/CC is currently unaware of a full solution to this problem. However, affected users may consider the following workarounds.

Block outbound SMB

Consider blocking outbound SMB connections (TCP ports 139 and 445) from the local network to the WAN.

Update NTLM group policy

This attack may be mitigated in some circumstances by restricting NTLM via appropriate Group Policy. See reference one and reference two from Microsoft.

Do not use NTLM for authentication by default in applications

Developers should ensure their software complies with appropriate Group Policy and does not use NTLM for authentication by default.

Use a strong password and change passwords frequently

Since the credentials are provided to the attacker in encrypted form, a stronger password may require more time to break the encryption. Changing passwords regularly further deters brute-force attacks against the encryption.