
Edit Story

18-Year-Old Security Flaw Allows Hackers To Steal Credentials From All Versions Of Windows

Kate Vinton
This article is more than 5 years old.

In 1997, researcher Aaron Spangler discovered a bug in Internet Explorer that allowed an attacker to steal credentials using a protocol known as Windows Server Message Block (SMB). Eighteen years later, a researcher on the Cylance SPEAR research team testing a messaging app with that bug in mind discovered a much larger vulnerability that affects at least 31 applications including Adobe Reader, iTunes, Box , and Symantec Norton Security Scan on all versions of Windows.

This new vulnerability, called “Redirect to SMB,” allows user login credentials to be leaked from a variety of Windows applications by tricking the apps into authenticating with a rogue server. Redirect to SMB allows to hackers to execute a man-in-the-middle attack on a Windows device, sending communications to a malicious SMB server, which can then produce the user's username and encrypted password.  After that, an attacker can decrypt the password and gain access to a variety of vulnerable applications. Cylance refers to it as a “forever-day” vulnerability, because the original bug has been an ongoing threat since its discovery in 1997. While Spangler's bug was limited to Internet Explorer, the Redirect to SMB vulnerability affects a number of applications on all versions of Windows.

What does this mean for a Windows user? Imagine if a person was in a coffee shop browsing the internet on a Windows laptop using free, unsecured wifi, explains Cylance senior researcher Brian Wallace, who discovered the vulnerability. If an attacker was able to gain access to the device through a man-in-the-middle attack, the attacker could use the vulnerability to get user credentials for a number of vulnerable apps. For example, if iTunes checked for an update or Symantec Norton anti-virus ran a scan, the hacker would be able to access those credentials. If the user synced the files on their computer to Box, the user's Box login could be compromised giving the attacker access to the user's files. Gaining access to corporate files is a particularly concerning possibility, as stolen Windows domain credentials were used in the Sony attacks.

The potential impact of this vulnerability became clear to Wallace as he first looked into the messaging app he was testing and then expanded out to test other applications. "At first, I was happy I was able to discover an issue with the chat messenger,” Wallace explained. “It was a mixed feeling of excitement and fear. That feeling built over time to the disclosure.”

Once Wallace realized how wide-reaching the "Redirect to SMB" vulnerability was, his team decided to disclose it to Carnegie Mellon University CERT. Carnegie Mellon reached out to and worked with all affected applications to patch the vulnerability before publicly disclosing the vulnerability today.  Wallace hopes that the security community will work together to discover other applications that need patched.

So far, the vulnerability has not been seen in the wild. The 31 vulnerable applications Cylance found are: Adobe Reader, Apple QuickTime, Apple Software Update (which handles the updating for iTunes), Internet Explorer, Windows Media Player, Excel 2010,  Symantec’s Norton Security Scan, AVG Free, BitDefender Free, Comodo Antivirus, .NET Reflector, Maltego CE, Box Sync, TeamViewer, Github for Windows, PyCharm, IntelliJ IDEA, PHP Storm, and JDK 8u31’s installer.

Follow me on Twitter or LinkedInSend me a secure tip

I track the world’s wealthiest people as part of the Forbes wealth team. Before joining the wealth team, I was the producer for the Forbes technology channel and reported…

I track the world’s wealthiest people as part of the Forbes wealth team. Before joining the wealth team, I was the producer for the Forbes technology channel and reported on cybersecurity. As a local crime reporter at the Victor Valley Daily Press in Southern California, I covered crimes ranging from murders to armed robberies at Taco Bell and the Dollar Store. I graduated from Harvard with a degree in History and Literature and grew up in a remote village in the Democratic Republic of Congo. Email me at and follow me on twitter @kate_vinton.