Attackers Continue To Exploit Microsoft Vulnerability, Access Insecurely Stored Passwords

Passwords stored in Microsoft’s Group Policy Preferences may be insecurely stored due to incomplete implementations of Microsoft Security Bulletin MS14-025, the U.S. Computer Emergency Readiness Team said in an alert Friday. U.S.-CERT said that if administrators haven’t cleared previously stored passwords, the system may be vulnerable to exploitation. Attackers “may decrypt these passwords and use them to gain escalated privileges,” the alert said. U.S.-CERT recommends administrators employ the PowerShell script provided in Microsoft Knowledge Base Article 2962486 and follow the instructions to clear all “CPassword” preferences.