At the Black Hat USA 2015 conference held in Las Vegas, a team of security experts led by Jonathan Brossard presented a vulnerability in Microsoft's Server Message Block (SMB) protocol used for file sharing on local networks.
The vulnerability presented at Black Hat USA affects all versions of Windows, including Windows 10, and can be exploited over the Internet, something the researchers had considered unlikely.
SMB is a 21-year-old protocol created by IBM, and allows for file and printer sharing within a network.
Since its development, it has reached version 3.0, which works with most Windows applications.
The protocol is most often used in enterprise networks, in conjunction with the NTLMv2 authentication algorithm, which allows users to authenticate to Windows servers.
The vulnerability discovered by Mr. Brossard's team allows hackers to extract a user's credentials from a Windows network using a technique called SMB relay (a basic man-in-the-middle attack for SMB data).
The attack is the first to affect Microsoft's new browser, Edge. But the applications affected by the vulnerability are endless!
As Mr. Brossard stated at the Black Hat USA 2015 conference, all versions of IE are vulnerable. In addition, other vulnerable applications are: Windows Media Player, Adobe Reader, Apple QuickTime, Excel 2010, Norton Security Scan Symantec, AVG Free, BitDefender free, Comodo Antivirus, IntelliJ IDEA, Box Sync, GitHub for Windows, TeamViewer, and many many more!
