when you change your password, it's already stolen

Item: when you change your password, it's already stolen
Rating: 4
Author: PostSingularity Institute

by John Hammond

Applied Sciences & Engineering Computing & Cybersecurity URComputer security URJComputer viruses, Trojans and worms

🎙 John Hammond 👥 2.2M 📅 October 16, 2025 ⏱ 18 min 👁 36K 📄 tutorial 🧭 2026-08-16

Available in: English (current) Français

Keywords

password filterWindowscredential theftpost-exploitationMITRE ATT&CK

Summary

In this video, John Hammond demonstrates a technique to steal passwords every time they are changed on Windows systems. He explains that Windows password filters allow organizations to enforce password policies, but they can also be abused to capture new passwords. The technique, originally documented by Rob Fuller in 2013, involves creating a malicious DLL that implements the password filter functions and registering it in the Windows registry. The video provides a step-by-step tutorial on writing the DLL in C, compiling it with Visual Studio, placing it in System32, and modifying the registry to load it. After a reboot, any password change is logged to a file, demonstrating the attack. The video also mentions that this technique works on modern Windows 11 and can be used on domain controllers to capture domain passwords. The sponsor segment promotes Specops Software for password security. The video is well-structured and informative, with a clear demonstration and references to MITRE ATT&CK technique T1556.002.

159 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable information by demonstrating a real, working attack technique that is often overlooked. The argumentation is solid, as it builds on documented research and shows the attack in a practical environment. The step-by-step code walkthrough is clear and allows viewers to understand the inner workings. The video also contextualizes the technique within the MITRE ATT&CK framework, adding credibility. However, the video does not discuss mitigations in depth, which could be a limitation for defensive purposes.

Scientific Rigor, Source Quality, Title Accuracy

The video cites the original blog post by Rob Fuller and the MITRE ATT&CK technique page, which are authoritative sources. The title accurately reflects the content. The video is a tutorial, and the sources are used appropriately. The sponsor segment is clearly separated and does not affect the technical content. The video does not provide a detailed analysis of the technique’s prevalence or detection, but it is honest about the age of the technique.

167 words

Title / Content Match

The title accurately reflects the content: it demonstrates how passwords can be stolen at the moment of change.

Quality & Reliability

8/10

The video is a practical tutorial demonstrating a well-documented Windows password filter attack. The technique is based on a 2013 blog post by Rob Fuller and is referenced to MITRE ATT&CK. The demonstration is clear and reproducible, and the code is simple. However, the video includes a sponsor segment and the technique is old, though still relevant.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Stealing passwords every time they change — Original blog post by Rob Fuller describing the password filter attack.
MITRE ATT&CK Technique T1556.002 — Documentation of the technique in the MITRE ATT&CK framework.
Carnal0wnage blog post — Alternate link to the blog post, as mentioned in the video.

Concurring Sources

MITRE ATT&CK Technique T1556.002 — Confirms the technique is recognized in the industry.

External References

Contribution & Novelties

The video provides a clear, hands-on demonstration of a relatively obscure but effective credential theft technique. It updates the 2013 technique to modern Windows 11, showing that it still works. The video also highlights the importance of understanding Windows internals for both offensive and defensive security.

Pour aller plus loin :

MITRE ATT&CK T1556.002 — Official documentation of the technique.
Windows Password Filters documentation — Microsoft’s documentation on password filters.
Local Security Authority (LSA) Architecture — Overview of LSA and its role in authentication.

84 words

Radar Profile

The radar profile shows high scores in information quantity, quality, and reliability, with a slightly lower technical level, indicating a well-balanced and accessible tutorial.

Reliability 8/10

💬 No comments were provided for analysis.