On the night of November 12th, Microsoft Outlook experienced a massive global outage affecting users across 74 countries. For many, the immediate fear was a large-scale cyberattack. While Microsoft officially stated there was no sign of a cyberattack causing the outage—blaming it instead on an overloaded server process—the reality is that a serious security flaw had already been uncovered just two days prior.
And unlike the outage, this security breach happened quietly, without anyone noticing.
The Real Hack: Exploiting a 30-Year-Old System
The vulnerability was discovered in the Windows Outlook app, revealing that hackers were stealing users' Windows login credentials without ever needing their passwords.
How did it work?
- The Trigger: A hacker would send a specially crafted email file.
- The Bypass: As soon as the file was opened, Outlook would connect to the hacker's server without showing its usual security warnings.
- The Core Flaw: This exploit leveraged NTLM (New Technology LAN Manager), a Windows login system that is over 30 years old.
Normally, when a laptop connects to a trusted network folder, Windows uses NTLM to log you in automatically without asking for a password. The server sends a random number, and NTLM responds using a hash of your password—meaning your actual password is never transmitted.
However, due to this bug, that authentication response was routed straight to the hacker's server instead. Hackers could then use this response to crack weak passwords or relay it to log into systems under the user's identity.
Microsoft's Response and the Future of NTLM
Microsoft rolled out a fix for Outlook on November 10th to address the issue. More importantly, Microsoft is finally retiring NTLM, with plans to disable it by default in an upcoming major Windows version.
Despite the severity of the flaw, Microsoft assigned it a moderate rating and has not yet publicly identified the perpetrators behind the exploit.
What You Should Do Right Now
If you use Outlook on Windows, take a moment to secure your app:
- Open Outlook
- Go to File -> Office Account
- Click Update Now
While the global outage caused a visible disruption that caught everyone's attention, the real takeaway is a sobering reminder: the quietest threats are often the most dangerous.
No comments:
Post a Comment