[forbes] 18-Year-Old Security Flaw.. steal credentials from Windows

[VirtualLarry]

http://www.forbes.com/sites/katevin...als-from-all-versions-of-windows/?ss=Security

 

[cabri]

From the article; it seems as if a legitimate request for update gets intercepted and redirected to a bogus server.

Can someone explain how does the intercept happen if the original request was going to a legit update server.
how does the man-in-the-middle generate the detour

 

[Fardringle]

"Imagine if a person was in a coffee shop browsing the internet on a Windows laptop using free, unsecured wifi, explains Cylance senior researcher Brian Wallace, who discovered the vulnerability. If an attacker was able to gain access to the device through a man-in-the-middle attack, the attacker could use the vulnerability to get user credentials for a number of vulnerable apps."

In other words, the attacker would implement the hack on a compromised network and from there gain the credentials of people connecting to that network.

 

[cabri]

"Imagine if a person was in a coffee shop browsing the internet on a Windows laptop using free, unsecured wifi, explains Cylance senior researcher Brian Wallace, who discovered the vulnerability. If an attacker was able to gain access to the device through a man-in-the-middle attack, the attacker could use the vulnerability to get user credentials for a number of vulnerable apps."

In other words, the attacker would implement the hack on a compromised network and from there gain the credentials of people connecting to that network.

Domino theory then - thanks for clarification

 

[Dude111]

This is only possible I believe if you have a network setup.. Otherwise you will get 'NETWORK NOT ACCESSIBLE' alerts....