4 ms·

MSFT here. Thank you your report. I have escalated your issue to the Windows Update team. Microsoft is committed to your security and the loophole will promptly

by qb45 10y ago

MSFT here. Thank you your report. I have escalated your issue to the Windows Update team. Microsoft is committed to your security and the loophole will promptly be closed by another forced update. Resistance is futile.

eitland 10y ago
Know you are joking but still want to mention: A while ago I reported that the pw field in W10 gave away a lot of entropy easily (basically ctrl+arrow keys stopped between every character class so if your password was: newr..!VYIV you could in five seconds conclude that the password contains of 4 chars of something, then 3 chars of something else, then 4 characters of something other than the second group.) Whoever handled it concluded that it was absolutely "interesting" but not a security issue so no bounty for me :-/
- tmzt 10y ago
  Hmm, combine that with a USB stick-like device and you could probably implement a brute-forcer that doesn't actually attempt most passwords, since key based editing of the original password would probably work. This of course assumes the entered password is still on the screen.
  - eitland 10y ago
    Didn't think so far as a USB stick. That said, once you can leave a usb stick attached to targets computer I'd say all bets are off since at that point we can be reasonable secure that the target won't notice a USB or PS2 keyboard sniffer either, giving you plaintext passwords.
    - tmzt 10y ago
      Was your original issue dealing with an already typed password? The stick would emulate a USB keyboard using something like a tiny and wouldn't be left attached. It would perform edits to the password and try to determine which charecters were special, the apply a simplified dictionary attack to the contiguous groupings of characters of the same class. The goal would be to reduce the space of the attempted guess. I don't see how it would be a practical attack though.
      - qb45 10y ago
        IIRC Windows has pretty strong rate limiting on login attempts. You don't really need a USB stick to execute them as fast as possible.
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]

by qb45 10y ago

eitland 10y ago

Know you are joking but still want to mention: A while ago I reported that the pw field in W10 gave away a lot of entropy easily (basically ctrl+arrow keys stopped between every character class so if your password was: newr..!VYIV you could in five seconds conclude that the password contains of 4 chars of something, then 3 chars of something else, then 4 characters of something other than the second group.) Whoever handled it concluded that it was absolutely "interesting" but not a security issue so no bounty for me :-/

tmzt 10y ago
Hmm, combine that with a USB stick-like device and you could probably implement a brute-forcer that doesn't actually attempt most passwords, since key based editing of the original password would probably work. This of course assumes the entered password is still on the screen.
- eitland 10y ago
  Didn't think so far as a USB stick. That said, once you can leave a usb stick attached to targets computer I'd say all bets are off since at that point we can be reasonable secure that the target won't notice a USB or PS2 keyboard sniffer either, giving you plaintext passwords.
  - tmzt 10y ago
    Was your original issue dealing with an already typed password? The stick would emulate a USB keyboard using something like a tiny and wouldn't be left attached. It would perform edits to the password and try to determine which charecters were special, the apply a simplified dictionary attack to the contiguous groupings of characters of the same class. The goal would be to reduce the space of the attempted guess. I don't see how it would be a practical attack though.
    - qb45 10y ago
      IIRC Windows has pretty strong rate limiting on login attempts. You don't really need a USB stick to execute them as fast as possible.
- deleted 10y ago
  [deleted]
- deleted 10y ago
  [deleted]