https://www.bleepingcomputer.com/news/microsoft/windows-365-exposes-microsoft-azure-credentials-in-plaintext/ BleepingComputer.com logo * * * [ ] [Login] [Sign up] * * * [ ] [Login] [Sign up] * News + Featured + Latest + Ransomware gang uses PrintNightmare to breach Windows servers Ransomware gang uses PrintNightmare to breach Windows servers + Ukraine shuts down money laundering cryptocurrency exchanges Ukraine shuts down money laundering cryptocurrency exchanges + Notorious AlphaBay darknet market comes back to life Notorious AlphaBay darknet market comes back to life + Microsoft Exchange servers are getting hacked via ProxyShell exploits Microsoft Exchange servers are getting hacked via ProxyShell exploits + Facebook rolls out end-to-end encryption for Messenger calls Facebook rolls out end-to-end encryption for Messenger calls + The Week in Ransomware - August 13th 2021 - The rise of LockBit The Week in Ransomware - August 13th 2021 - The rise of LockBit + Emails from Lithuanian Ministry of Foreign Affairs for sale on data-trading forum Emails from Lithuanian Ministry of Foreign Affairs for sale on data-trading forum + Windows 365 exposes Microsoft Azure credentials in plaintext Windows 365 exposes Microsoft Azure credentials in plaintext * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Virus Removal Guides + Latest + Most Viewed + Ransomware + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove the Smashapps.net Search Redirect Remove the Smashapps.net Search Redirect + Remove the Smashappsearch.com Search Redirect Remove the Smashappsearch.com Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to make the Start menu full screen in Windows 10 How to make the Start menu full screen in Windows 10 + How to install the Microsoft Visual C++ 2015 Runtime How to install the Microsoft Visual C++ 2015 Runtime + How to open an elevated PowerShell Admin prompt in Windows 10 How to open an elevated PowerShell Admin prompt in Windows 10 + How to Translate a Web Page in Google Chrome How to Translate a Web Page in Google Chrome + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + File Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Microsoft * Windows 365 exposes Microsoft Azure credentials in plaintext * * Windows 365 exposes Microsoft Azure credentials in plaintext By Lawrence Abrams * August 13, 2021 * 02:24 PM * 0 Microsoft bug A security researcher has figured out a way to dump a user's unencrypted plaintext Microsoft Azure credentials from Microsoft's new Windows 365 Cloud PC service using Mimikatz. Mimikatz is an open-source cybersecurity project created by Benjamin Delpy that allows researchers to test various credential stealing and impersonation vulnerabilities. "It's well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket, build Golden tickets, play with certificates or private keys, vault, ... maybe make coffee?," explains the project's GitHub page. While created for researchers, due to the power of its various modules, it is commonly used by threat actors to dump plaintext passwords from the memory of the LSASS process or perform pass-the-hash attacks using NTLM hashes. Using this tool, threat actors can spread laterally throughout a network until they control a Windows domain controller, allowing them to take over the Windows domain. Windows 365 credentials can be dumped in plaintext On August 2nd, Microsoft launched their Windows 365 cloud-based desktop service, allowing users to rent Cloud PCs and access them via remote desktop clients or a browser. Microsoft offered free trials of virtual PCs that quickly ran out as people rushed to get their free Cloud PC for two months. Delpy told BleepingComputer that he was one of the lucky few who could get a free trial and began testing the new service's security. He found that the brand new service allows a malicious program to dump the Microsoft Azure plaintext email address and passwords for logged-in users. Would you like to try to dump your #Windows365 Azure passwords in the Web Interface too? A new #mimikatz release is here to test! (Remote Desktop client still work, of course!) > https://t.co/Wzb5GAfWfd cc: @awakecoding @RyMangan pic.twitter.com/hdRvVT9BtG -- Benjamin Delpy (@gentilkiwi) August 7, 2021 The credential dumps are being done through a vulnerability he discovered in May 2021 that allows him to dump the plaintext credentials for users logged into a Terminal Server. While a user's Terminal Server credentials are encrypted when stored in memory, Delpy says he could trick the Terminal Service process into decrypting them for him. "Even better, I asked the terminal server process to decrypt them for me (and technically, terminal server process ask the kernel to decrypt it for itself)," Delpy told BleepingComputer in a conversation about his findings. "Because only the Terminal Server can ask for this kind of own decryption, I had to trick it to decrypt the credentials for me :)," BleepingComputer used a free Cloud PC trial on Windows 365 to test this technique. After connecting through the web browser and launching mimikatz with Administrative privileges, we entered the "ts::logonpasswords" command and mimikatz quickly dumped our login credentials in plaintext, as shown below. Mimikatz listing my Azure account credentials in plaintextMimikatz listing my Azure account credentials in plaintext This works over the web browser as it's still using the Remote Desktop Protocol. So, what's the big deal? You may be wondering what the big deal is if you need to be an Administrator to run mimikatz and you already know your Azure account credentials. In the above scenario, you are right, and it is not a big deal. However, what happens if a threat actor gains access to your Windows PC device to run commands? For example, let's say that you open a phishing email with a malicious attachment on your Windows 365 Cloud PC that sneaks through Microsoft Defender. Once you enable the malicious macros in the document, it can install a remote access program so that a threat actor can access the Cloud PC. From there, it is trivial to gain administrative privileges using a vulnerability like PrintNightmare and then dump your clear-text credentials with mimikatz. Using these credentials, the threat actor can spread laterally through other Microsoft services and potentially a company's internal network. "It's exactly like dumping passwords from a normal session. If I can dump your password in TS sessions I can use it on other systems where you can have more privilege, data, etc," explained Delpy. "It's common for lateral movements and gaining access to more privileged data on others systems. Particularly useful on VDI systems where others users are also logged in." Delpy says he would typically recommend 2FA, smart cards, Windows Hello, and Windows Defender Remote Credential Guard to protect against this method. However, these security features are not currently available in Windows 365. As Windows 365 is geared towards the enterprise, Microsoft will likely add these security features in the future, but for now, it is important to be aware of this technique. Related Articles: Microsoft halts Windows 365 trials after running out of servers Microsoft's Windows 365 Cloud PC service is live - Costs from $24 to $162 Windows 365 - Microsoft's new virtualized Cloud PC service Windows 11 makes TPM Diagnostics tool its first optional feature Microsoft Exchange servers are getting hacked via ProxyShell exploits * Credentials * Microsoft * Mimikatz * Remote Desktop * Terminal Services * Windows 365 * * * * * Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes malware removal and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] [Bleeping_Computer_CIR_2021_03] Popular Stories * accenture Accenture confirms hack after LockBit ransomware data leak threats * Windows Microsoft confirms another Windows print spooler zero-day bug Newsletter Sign Up To receive periodic updates and news from BleepingComputer, please use the form below. [ ] [Submit] Newsletter Sign Up [ ] [Submit] * Follow us: * * * * Main Sections * News * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * File Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement Copyright @ 2003 - 2021 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT