The advisory promises future 'mitigations and workarounds as our investigation progresses.'įor the moment, the only mitigation for this flaw that Tom's Guide is aware of is outlined below. 'An attacker must have the ability to execute code on a victim system to exploit this vulnerability.' An attacker could then install programs view, change, or delete data or create new accounts with full user rights,' it added. 'An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. 'An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database,' said the advisory. In the hours after we first published this story, Microsoft issued a security advisory for this flaw and issued it the catalogue number CVE-2021-36934. So crafty malware that got onto a PC via a phishing email, pirated software, or a malicious web link would be able to locate the SAM file in the shadow copy, read the user password hashes and probably have a fair chance at cracking the hashes or using them to log onto remote servers.Įven the best Windows 10 antivirus software might not be able to stop all such attacks. Even if it's using a unique file name, it's a predictable file name in a predictable location. For most PCs, that means a new shadow copy every month.Ī shadow copy isn't always that hidden. Your PC creates a shadow copy every time it installs a system update or upgrade. But Lykkegaard found that he, even as an unprivileged user, could access the backed-up version of the SAM file in the 'shadow copy' that most Windows systems create.Ī shadow copy is a backup, hidden on the main drive, of a Windows system's most important files.

It's not easy for any user to access the SAM file while a computer is running. So it's not good when any piece of software or any user on a Windows system can suddenly see the NTLM hashes of all the other users' passwords. The problem is that the NTLM algorithm is pretty weak, and hashes can often be 'cracked,' or reversed to give the original password.Įven worse, some Windows-related functions, such as accessing a networked server, let you log in using the NTLM hash rather than the password itself. As an example, the hash of 'password', using Microsoft's own NTLM algorithm, is '8846F7EAEE8FB117AD06BDD830B7586C'. 'Hashing' passwords means running them through a one-way encryption algorithm that cannot (in theory) be reversed. The SAM file in the Windows Registry contains 'hashed' versions of all the user passwords on a given Windows system, including the passwords of administrative users. See more So what's up with this Windows flaw?

Windows 7 sam file location