A yet-to-be discovered vulnerability in Windows Themes is causing alarm among security experts and Windows users. A zero-day vulnerability in Windows allows attackers to steal users’ NTLM credentials. from a distance As a result, sensitive data is at risk. As a result, users can now secure their free patches until the official patch is issued by using a free unofficial patch.
What is the Windows Themes NTLM Vulnerability?
NTLM vulnerabilities on Windows involve NTLM forwarding and pass-the-hash attacks. Both of which make use of hashed password data. An attacker can obtain the NTLM hash via a malicious file contained in the Windows theme, which can be authenticated as a compromised user. access network sensitive files and even administrative level controls.
This vulnerability was discovered by ACROS security researchers while they were developing a patch for CVE-2024-38030 This vulnerability can be exploited by the Windows Themes system to leak user credentials. They found that the vulnerability still exists in fully updated versions of Windows. Including after Microsoft’s latest patch, Windows 11 24h2.
How Does This Zero-Day Threat Work?
To exploit this flaw for attackers. Users must be convinced to download or open a corrupted Windows theme file. Once the malicious file is uploaded, Windows sends an NTLM authentication request to the remote server. This will display the hashed user credentials. According to Microsoft’s advisory, attackers may lure victims through emails, instant messages, or other file-sharing means, hoping they interact with the corrupted theme file without directly clicking or opening it.
Microsoft has taken steps to address this, releasing several patches over the past year. But according to Mitja Kolsek, CEO of ACROS Security, vulnerabilities in Windows Themes still exist even if these updates provide a partial solution.
Protecting Your System: Micropatches and More
While Microsoft is working on an official fix, ACROS Security has come forward. Unofficial and free micropatches via 0patch service. The company’s micropatch secures Windows versions from Windows 7 to Windows 11 without requiring a restart. Users can download the 0patch agent, create a 0patch account, and have the micropatch applied automatically.
The micropatch, however, is only available for Windows Workstation systems, as Windows Themes is incompatible with Windows Server unless the Desktop Experience feature is installed. ACROS security states that users ought to double-click on and execute the header report for the vulnerability to work. If the header report is examine, the file will not show in Windows Explorer.
Microsoft’s Official Response and Future Patches
Although Microsoft is privy to this vulnerability, But an legitimate timeline for the patch has now not however been released. According to the Microsoft Security Response Center, they may be running on a recuperation and will notify users as quickly as it’s far available. In the meantime, customers need to Use mitigation measures, together with configuring Group Policy to dam NTLM authentication requests.
Enhancing Windows Theme Security with Additional Safeguards
In addition to the patch Users also can increase gadget security by managing Windows problems and averting downloading from untrusted resources. Custom Windows themes, specifically topics that include icons, sounds, or wallpapers from untrusted websites, are allowed. This may put the system at risk. Users searching for individual themes such as Download Windows Themes, Windows Themes with Sound, Anime Windows Themes should source them from the official Microsoft Store or reputable websites. other.
By staying informed and applying micropatches or following Microsoft’s mitigation steps, Windows users can help protect themselves against NTLM credential theft until an official update is released.
Read More:
