Critical Windows Zero-Day Vulnerability: Urgent Advisory from National CERT

In a sobering revelation, the National Computer Emergency Response Team (National CERT) has issued an urgent advisory regarding a critical zero-day vulnerability affecting Microsoft Windows operating systems. This security flaw poses significant risks, as it allows attackers to harvest NTLM credentials simply by previewing a malicious file in Windows Explorer—without any direct action required from the user.

What’s at Stake?​

The vulnerability impacts a wide range of Windows OS versions, spanning from Windows 7 through Windows 11 24H2, including Windows Server 2022. For those who may not be familiar, NTLM, or NT LAN Manager, is a suite of Microsoft security protocols that facilitates authentication, particularly in network environments. However, in this case, the flaw enables attackers to extract not only user login names but also plaintext passwords. With such sensitive information, an attacker can easily lateral-move across networks, escalate privileges, and gain unauthorized access to sensitive data and systems.
The alarming aspect of this vulnerability is its ability to be exploited by merely viewing a malicious file—this could be on USB drives, shared folders, or other locations devoid of user interaction. This loophole raises the stakes significantly, making the requirement for immediate mitigation methods all the more critical.

What Should Users Do?​

To combat this imminent threat, National CERT has outlined several strategic recommendations for Windows users and organizations:

Disable NTLM Authentication​

• Modify Group Policy Settings: Where possible, disable NTLM authentication to avoid the exposure of credentials.
• Outbound Connections Restrictions: Utilize firewalls or similar tools to block outbound NTLM connections to untrusted servers and external networks.

Strengthen Windows Defender Settings​

To bolster system defenses further, consider implementing the following:

• Enable Windows Defender Credential Guard: This feature isolates NTLM credentials, adding an extra layer of protection in enterprise environments.
• Utilize 128-bit encryption for NTLM sessions: This simple encryption method enhances the security of NTLM communications.
• Adopt NTLMv2 Requirements: Modify registry settings to enforce the use of NTLMv2, a more secure version of NTLM, reducing the feasibility of attacks.

In addition, organizations are encouraged to apply Microsoft Defender’s attack surface reduction rules to effectively block NTLM traffic destined for untrusted servers and prevent various credential theft techniques.

Users: Stay Informed and Proactive​

Despite these technical measures, one of the most significant defenses against this vulnerability is user education. It's crucial to strongly inform users about the dangers of engaging with unexpected files—be they from email attachments, USB drives, or shared directories.
Promoting best practices in password security is equally vital. Users should be encouraged to adopt strong, unique passwords and routinely modify them to safeguard against potential breaches. Moreover, organizations should prefer secure file-sharing solutions over potentially risky ones that could funnel malicious files into their networks.

A Long-Term Strategy​

In the long run, National CERT advocates for a transition to more modern authentication methods, such as Kerberos or certificate-based authentication. By gradually phasing out reliance on NTLM, organizations can significantly strengthen their cybersecurity posture and minimize exposure to risks associated with legacy systems.

Conclusion​

With cyber threats becoming increasingly sophisticated, this newly disclosed vulnerability serves as a stark reminder of the necessity for vigilance and proactive measures in cybersecurity. As the holiday season approaches, when the digital landscape is buzzing with activities, Windows users must adopt a robust approach to protect themselves from potential exploits.
While awaiting an official patch from Microsoft, implementing these mitigation strategies can greatly reduce the risk of becoming a victim of this critical vulnerability. For regular Windows users, staying informed and following the guidance provided by cybersecurity experts is the best course of action to ensure a safe computing environment.

---

Source: ProPakistani National CERT Issues Security Alert on New Windows Vulnerability