New Windows Vulnerability Raises Concerns: CVE-2024-38030, Here is a quick look

Discovery and Impact

A new vulnerability in Windows, identified as CVE-2024-38030, has raised significant concerns among cybersecurity experts. This flaw affects all versions of Windows from 7 to 11 and allows attackers to capture NTLM authentication hashes, potentially exposing user credentials. Researchers at ACROS Security discovered this vulnerability while working on a patch for an older issue. They reported the flaw to Microsoft, highlighting its potential to enable authentication coercion attacks, where a vulnerable device is tricked into sending NTLM hashes—cryptographic representations of user passwords—to an attacker’s system.

Similarities to Previous Vulnerabilities

CVE-2024-38030 shares similarities with two previous issues, CVE-2024-21320 and another related flaw. Both involved improper handling of file paths in Windows themes, allowing attackers to manipulate these paths to trigger outbound connections that send NTLM hashes to the attacker.

Technical Details

Windows themes files enable users to customize their desktop interface with wallpapers, screensavers, colors, and sounds. The vulnerabilities arise from how these themes handle file paths to image resources. Improper validation allows attackers to manipulate legitimate paths, resulting in Windows sending authenticated requests to the attacker’s device.

Microsoft’s Response

Microsoft has acknowledged the issue and is actively working on a fix. The company previously addressed similar vulnerabilities by adding checks on file paths to ensure they weren’t UNC paths. However, the function used for validation contained bypasses, leading to the discovery of this new vulnerability.

Mitigation and Recommendations

To mitigate the risk, users should disable NTLM where possible, although this may lead to network issues. Regularly updating software and applying security patches promptly can also help protect against such vulnerabilities. Users are encouraged to remain vigilant and follow best practices for cybersecurity to safeguard their credentials.

Conclusion

The recurring nature of this vulnerability underscores the ongoing challenges in securing complex systems like Windows. As attackers continually find new ways to exploit weaknesses, it is crucial for users and organizations to stay informed and proactive in their cybersecurity efforts. Regular updates, strong passwords, and multi-factor authentication are essential steps in protecting sensitive information.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it