Number: IRCNE2014072259
Date: 2014-07-20
According to “techworld”, Microsoft's widely used software for brokering network access has a critical design flaw, an Israeli security firm said, but Microsoft contends the issue has been long-known and defenses are in place.
The company's research focuses on NTLM, an authentication protocol that Microsoft has been trying to phase out for years. All Windows versions older than Windows XP SP3 used NTLM as a default, and newer Windows versions are compatible with it in combination with its successor, Kerberos.
NTLM is vulnerable to a so-called "pass-the-hash" attack in which an attacker obtains the login credentials for a computer and can use the mathematical representation of those credentials -- called a hash -- to access other services or computers.
The pass-the-hash attack is a long-known weakness around single sign-on systems (SSO) since the hash must be stored somewhere on a system for some amount of time. Other operating systems that accommodate SSO are also affected by the threat.
Disabling SSO would solve the problem, but it would also mean that users on a network would have to repeatedly enter their password in order to access other systems, which is inconvenient.
Although some enterprises try to limit the use of the NTLM protocol in favor of Kerberos, an attacker can force a client to authenticate to Active Directory using a weaker encryption protocol, RC4-HMAC, that uses the NTLM hash. That NTLM hash is then accepted by Kerberos, which issues a fresh authentication ticket.
Microsoft implemented Kerberos in order to move away from some of NTLM's security issues, but Kerberos works with RC4-HMAC to allow for compatibility with older systems.
The company couldn't immediately be reached for comment, but it acknowledged weaknesses in NTLM in a 2012 technical paper.
In May, Microsoft released a patch which contained improvements that make it harder to steal NTLM hashes. The company has also suggested that organizations use smart cards or disable Kerberos RC4-HMAC support on all domain controllers, but it is possible that could break some functionality.
- 3