aD

Apr 28, 2016

Windows 8.1 Password Disclosure

"Heh J, have you ever heard of this..." Yesterday, my Tech Lead said they got a ticket were the student saw their password revealed in plaintext on the login screen at one of the lab computers.
I dismissed it saying that maybe the student didn't understand the difference between Windows and our web portal and his web browser must be set to reveal passwords.
All of us techs got up and went to a test computer, Windows 8.1, that was set up like our lab computers. Shockingly, we were able to repeat it.
Now, we tried it on Windows 7 and 10, and we couldn't duplicate it there.
Type in your user name and then your password. Now at the end of your password add a \
Notice the "Logon to" has changed to your password.



***THIS ONLY APPEARS TO WORK IN A DOMAIN***


I did go to Microsoft and they got back to me really quick.

"Hello, 
Thank you for contacting the Microsoft Security Response Center (MSRC).  Upon investigation we have determined that this is not a valid vulnerability. There is no scenario that this would be useful to a malicious attacker as they would need physical access and have the password typed in already."


I agree. This isn't RCE or anything they would really care about, but it is informational disclosure. I can think of a few social engineering ways to do this.
It's a bug, I understand, but still....

What I can see is that the password box treats a \ as a domain switch just like the username box would.

Sep 16, 2015

Why I left cryptocurrency behind

Cryptocurrency is such an amazing thing and has huge benefits and long term ramifications. Sending a form of money that is universally accepted with almost no transaction fees is a way to break free from government's control of a commodity and returns us to a more trade-central idea of exchange between individuals. This is why I got into bitcoin back in late 2010.

At that time I just heard of bitcoin, it was about a year old. It took me a while to figure out how the system worked and how to mine. By early 2011, I had successfully earned 2 BTC. At the time, the lack of systems and goods to trade these items for, resulted in my just giving them away.

Flash forward to 2013. Bitcoin is on the rise, hitting $800+ mark per coin. Man, did I ever regret giving away those coins, but that is the way life goes. Kinda like all those people who wished they had invested in Microsoft and Apple.

As the value took off, I considered buying a Butterfly Labs machine, talked it over with the wife, and were considering the purchase. As I was evaluating pro's and con's, I discovered that the waiting list for devices was extremely long, resulting in close to a one year wait. (Little did I know, I just avoided my first scam). Disappointed, another missed opportunity passed me by, but then I heard of Litecoin. Excited, I dove into the world of scrypt coins and discovering why they were a great alternative to bitcoins. The algorithm was designed to prevent ASIC (Application Specific Integrated Chips) from ever being used, as they were on bitcoins SHA-256d.

I started off with my video card and earned my first Litecoins and I was so excited as more followed. I ended up with about 16 LTC, but then prices dove and I panicked sold. 3 months later, prices were up to $40, when I sold them for $1.60 each. Lesson learned: hold!!!

About this time I heard of a new cryptocurrency, called Dogecoin. I joined three days after announcement and soon had a big stash held up. At this time ASIC for scrypt were announced and I pre-purchased a 1 MH/s device from Zeusminer and was excited when it arrived. It freed up the work on my video card and I was hooked. I ended up with a 28 MH/s unit for free as I did a security analysis on Zeusminers website and gave them the report. They were so thankful that they sent me a free unit. It took me 6 months to get it up and working perfectly, which turned out to be my issue with the power supplies and how I was plugging them in. I ended up with a few more ASIC's along the way. A 14 MH/s unit from Zeusminer, a small Gridseed, and a large 24 MH/s unit from Gridseed.
I have a great wife who let me spend about $100-200 on electricity a month for this as we were hoping to add an alternate form of income while I attended school full-time.

During this time I got involved with GAW Miners cloud mining systems and started racking up numbers with them, figuring I was diversifying my portfolio of crypto. I also had a bit of holding with Zeusminers cloud mining services as well.

GAW announced a new coin called Paycoin, and that it was to be honored by them at $20. I was excited but still a bit cautious and transfered a bit more too them. Rumors of scam started to grow, but I had figured it was the Bitcoin people just trying to make sure their coin was the only one that succeeded. FUD began to show up all over (fear, uncertainty, doubt). I ignored it and plowed on, withdrawing and reinvesting some back in. I soon had hundreds of paycoin (XPY) stacked up and was even more excited when they showed their online store were "beta testers" were making purchases at a honored price of $20 each. I was sold! I exchanged 2,000,000 dogecoin for XPY and was excitedly waiting my turn to get into access as they said they were limiting the amount of acceptances. By this time the FUDers were crying even louder but I ignored it as I could clearly see that we had a store! And then the invite never came....

I also invested in another "energy efficient" ASIC, that to this date, I have yet to receive, from Hashra.

Disappointed, and cries of scam and investigations and legal issues began to arise with Paycoin and GAW Miners, I dumped my XPY and invested into a new cloud mining services I had been hearing about, Scrypt.cc. It had been online for a year and was paying out. My numbers with it slowly grew and I was excited that I was starting to make a decent amount of coin a day. Then there was a "power issue" and then "we got hacked" and then "we have to pay ourselves back so we can support you guys" and then "sorry profits are down a bit more but we'll bring them back up". I watched my money go down the drain and with it my hopes of cryptocurrency.

I have been exposed to too many dishonest people who didnt see the vision of crypto but just saw another way to rip people off. To this day, I estimate I lost somewhere around $800-100 in cryptocurrency and $USD. Disappointed and hearbroken, I have sold all my GPU's (except for one to game with), my ASIC's, dumped almost all my crypto except a million dogecoin and some bitcoin and I'm done.

Done with this crap of a world of crypto.