Oopsy – Microsoft Forgets to Protect Windows Password Database

The password database on any computer is considered pretty sensitive. For Windows systems, the passwords are stored in the Security Account Manager or SAM. That database is stored in a folder called C:\WINDOWS\SYSTEM32\SAM by default.

Windows stops standard users from accessing this folder and a number of its cousins to stop hackers who compromise a low level account from accessing the password list and hacking it offline using brute force techniques.

Only problem is that Microsoft keeps a copy of these folders in the Shadow Volume Copy, which is used to recover from bad system changes.

Some how, more than two years ago, in Windows 10 version 1809, that was changed and ever since, any authenticated user could access the backup shadow copy of the password database and other important files for nefarious purposes.

This was accidentally discovered as friendly hackers were testing Windows 11 – which also has the same problem.

Also exposed due to this bug are encryption keys and machine account information.

MICROSOFT HAS NOT RELEASED A PATCH AND RECOMMENDS DELETING YOUR BACKUPS. That does not seem like a great solution to me. Hopefully, they will release a patch soon as I am sure that malware that did not already know that it could do that will be swiftly modified to steal that information. Credit: The Record