{"id":3230,"date":"2025-10-14T18:53:15","date_gmt":"2025-10-14T18:53:15","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/10\/14\/legacy-windows-protocols-still-expose-networks-to-credential-theft\/"},"modified":"2025-10-14T18:53:15","modified_gmt":"2025-10-14T18:53:15","slug":"legacy-windows-protocols-still-expose-networks-to-credential-theft","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2025\/10\/14\/legacy-windows-protocols-still-expose-networks-to-credential-theft\/","title":{"rendered":"Legacy Windows Protocols Still Expose Networks to Credential Theft"},"content":{"rendered":"
\n

A new cybersecurity study has found that legacy Windows communication protocols continue to expose organizations to credential theft, even without exploiting software vulnerabilities.<\/p>\n

The research, published today by Resecurity, warned that attackers can capture login data simply by being on the same local network as their targets.<\/p>\n

Legacy Features Still in Use<\/h2>\n

Link-Local Multicast Name Resolution (LLMNR) and its predecessor, NetBIOS Name Service (NBT-NS), were designed to help Windows systems find other devices when DNS lookups fail. However, these protocols trust any device that responds to their requests \u2013\u00a0an oversight that allows attackers to impersonate legitimate systems.<\/p>\n

By using tools such as Responder, a hacker can intercept these broadcasts and trick a victim machine into sending authentication data. The attacker then captures information including usernames, domain details and encrypted password hashes.<\/p>\n

\u201cThis attack does not rely on exploiting a software vulnerability,\u201d\u00a0the study said.<\/p>\n

\u201cIt takes advantage of default Windows behavior and only requires the attacker to be present on the same local network segment as the victim.\u201d<\/p>\n

Read more on authentication risks: Identity Risk Management: Locking Down Ephemeral Accounts<\/em><\/p>\n

Growing Concern For Organizations<\/h2>\n

Once stolen, the captured data can be cracked offline or reused in what\u2019s known as a relay attack. This can provide direct access to corporate databases, file servers or administrative systems. In some cases, attackers may obtain passwords in cleartext, gaining immediate entry to sensitive data.<\/p>\n

Researchers warned that the consequences extend well beyond a single compromised device. Once attackers obtain valid credentials, they can move laterally across the network, accessing additional systems and resources.<\/p>\n

From there, they may escalate privileges by targeting high-value accounts such as administrators or service users, gaining broader control over the environment.<\/p>\n

This kind of access can lead to widespread data exposure, unauthorized changes to systems and even the disruption of critical business services or operational downtime. In large organizations, the impact can ripple across departments, making containment and recovery more complex.<\/p>\n

Recommended Fixes<\/h2>\n

The study outlined several ways to mitigate the risk. Organizations are urged to:<\/p>\n