Security researchers say they have uncovered a new variation of an old weakness in the Windows operating system that could allow attackers to steal login credentials from hundreds of millions of PCs.
The vulnerability, named 'Redirect to SMB' by security firm Cylance, is similar to one found in the late 1990s that took advantage of a weakness in Windows and Microsoft's Internet Explorer browser which made it possible for attackers to trick Windows into signing on to a server controlled by hackers.
According to Cylance, if a hacker can get a Windows user to click on a bad link in an email or on a website, it can essentially hijack communications and steal sensitive information once the user's computer has logged on to the controlled sever.
In the latest variation of the technique, Cylance said users could be hacked without even clicking on a link, if attackers intercept automated requests to log on to a remote server issued by applications running in the background of a typical Windows machine, for example to check for software updates.
The attack takes advantage of features in Windows Server Message Block, commonly known as SMB. The new variation, discovered by Cylance researcher Brian Wallace, has so far only been recreated in a lab and has not been seen on computers in the outside world.
Cylance said the flaw affected all versions of Windows - including the yet-to-be-released Windows 10 operating system - as well as software from at least 31 companies including Adobe, Apple, Box, Microsoft, Oracle and Symantec.
Microsoft said the threat posed by the purported weakness was not as great as Cylance supposed.
"Several factors would need to converge for a 'man-in-the-middle' cyberattack to occur. Our guidance was updated in a .. blog in 2009, to help address potential threats of this nature," said Microsoft in a statement.
"There are also features in Windows, such as Extended Protection for Authentication, which enhances existing defenses for handling network connection credentials."
The CERT unit of the Software Engineering Institute at Carnegie Mellon University, a federally funded body which tracks computer bugs and internet security issues, issued a warning about the vulnerability.
It said it was unaware of a full solution to the problem, but suggested several ways of minimising the vulnerability. It suggested blocking outbound SMB connections, changing passwords frequently, and not using NTLM for authenticaion by default in applications.