Internet explorer gives your NT password away!

[paul () EIGEN CO UK (Paul Ashton)]

After a previous observation of NT challenge response insecurity and an
email from Craig Rowland suggesting Microsoft exchange as a possible
area of interest, please see http://www.efsl.com/security/ntie for a
demonstration of one of the most insidious holes yet. Internet explorer on
Microsoft NT will attempt to transparently authenticate, using a function
of your NT password, to any web server on the internet that wishes to ask.

If the web server so chooses, you will never even be aware that this
has happenned.

Paul Ashton
paul.ashton () eigen co uk