There’s no denying the fact that Windows is one of the most popular operating systems out there. A wise man once said, the more the popularity, the more will be the blame game and difficulties in life which seems to be the case with Windows 10.
Remember the little nice feeling you get when you change the desktop background after staring and getting bored of the same wallpaper and theme? Well, this little happiness of yours might prove costly as hackers have found a way to trick users into stealing their Windows Login credentials while applying a theme.
Researchers are calling this method “pass-the-hash” which is executed by malicious theme packs, thereby sending the passwords to a remote server. These themes are really easy to create and, at the same time, can easily fool people. So, does that mean every Windows 10 user’s doomed? Not really.
There are protective measures that can be taken. Jimmy Bayne, a Security Researcher in a Tweet said that the files that are important to configure theme packs are being exploited. These Theme files are made up of a lot of components which includes cursors, sounds, images, etc which are encapsulated together in a file with a “.theme” extension.
A popular computer security firm Bleeping Computer said this file can be made easily so that the OS will be told that instead of looking for images that are stored locally, look into a remote server. As Windows tries to load this theme, the users will be asked for their login Password and after they enter it, the hash and the username are transferred to a remote server.
Another solution to this problem is to temporarily stop changing themes/downloading them from unknown sources until Microsoft releases a fix for this.