If not redirected, please click here https://www.thesecuritybuddy.com/vulnerabilities/what-is-a-pass-the-hash-attack/
I think many of us are aware of the
term “Pass The Hash” attack. Some of us have heard protocols like
Remote Desktop Protocol are susceptible to attacks like Pass The Hash
attack. Let's understand what this attack actually is.
What is Pass The Hash attack?
Pass The Hash Attack is an attack in which the
attacker hacks a user's password and breaks into the server or service
to steal data or do other malicious activities.
Normally, a user needs to provide for authentication a password, which is converted into a hash using some popular hash algorithm and then is matched with the already stored hashed value in the server. Users passwords are never stored or sent in cleartext format over the wire. Cleartext passwords are never required to complete authentication for a user. And so for an attacker.
Normally, a user needs to provide for authentication a password, which is converted into a hash using some popular hash algorithm and then is matched with the already stored hashed value in the server. Users passwords are never stored or sent in cleartext format over the wire. Cleartext passwords are never required to complete authentication for a user. And so for an attacker.
So, if an attacker can harvest hash values
of passwords and try them to impersonate a user, he can break into
the server. In a Pass The Hash attack, the attacker uses this
mechanism. In this attack, the attacker uses LM or NTLM
authentication, instead of using some brute force mechanism to obtain
the cleartext password from its hash value.
What is LM or NTLM authentication?
LM Hash or LanMan Hash or Lan Manager
Hash is a compromised hash function that was once the primary hash
function for Microsoft Lan Manager or Microsoft Windows version prior
to NT. Support for this proticol continued in later versions of
Windows for backward compatibility, but it was recommended by
Microsoft to turn off the protocol by the administrators. In Windows
Vista the protocol is disabled by default, but in some non-Microsoft
CIFS implementations it continued to be used. NTLM or NT Lan Manager
is the successor for Lan Manager. NTLM is widely deployed even on new
systems, to maintain compatibility with older systems. But, Microsoft
no longer recommends NTLM in applications.
How is LM Hash computed?
The LM Hash is computed using the
methods below:
- A user gives a password which is restricted to fourteen characters.
- The user's password is converted to uppercase.
- The password is encoded in the System OEM code page.
- The password is null padded to 14 bytes.
- The 14 byte null padded password is halved into two 7 bytes.
- Each 7 byte value is used to generate a DES key of 64 bits. Here, one null bit is inserted after every 7 bits, thus generating 64 bits. The null bits are later discarded. Like this two DES keys are generated from two 7 bytes halves.
- Two DES keys thus generated are used to encrypt a constant key “KGS!@#$%”, thus forming two 8 byte ciphertexts.
- These two ciphertexts are concatenated to obtain the 16 byte LM Hash.
How is Pass The Hash Attack perpetrated
But,
does not the attacker need the hash values of the users' passwords to
hack the accounts? How do the attackers perform Pass The Hash
attack?
Before making such attacks, the attacker harvests password hashes of user accounts. There are number of methods which an attacker normally uses to get the password hashes:
Before making such attacks, the attacker harvests password hashes of user accounts. There are number of methods which an attacker normally uses to get the password hashes:
- An attacker may hack the administrator privileges and obtain the cached values of password hashes from the SAM. But, the default behavior of offline usage of cached hashes can be disabled by the adminitrator. So, this method may not always work.
- The attacker sometimes dumps local users account database or SAM to obtain password hashes of local users and later use them with local administrative account password hashes to hack multiple sysems.
- The attacker sometimes sniff the LM or NTLM challenge-response dialogues between the client and server and later brute force the encrypted hash values.
- The attacker may also dump the credentials of authenticated users stored by the Windows Isass.exe process. In this method, the attacker can obtain hash values of user accounts, not only of local users but also of users of security domain that the machine is a member of.
Mitigation
And
now comes the most important question – What is the mitigation?
Actually,
there is no single defense against this attack. But, there are a
couple of precautions that can be taken.
Use of firewalls, intrusion prevention system, 802.1x authentication, IPSec, antivirus software, full disk encryption etc can prevent this attack. A Windows machine can be limited from storing cached values of user credentials. Principle of least privilege is always useful. Windows systems can be configured not to use LM or NTLM protocols. And last but not the least, Restricted Admin Mode is a new security feature for Windows Operating System introduced in 2014 and it is really designed to make the life of attackers more difficult.
Use of firewalls, intrusion prevention system, 802.1x authentication, IPSec, antivirus software, full disk encryption etc can prevent this attack. A Windows machine can be limited from storing cached values of user credentials. Principle of least privilege is always useful. Windows systems can be configured not to use LM or NTLM protocols. And last but not the least, Restricted Admin Mode is a new security feature for Windows Operating System introduced in 2014 and it is really designed to make the life of attackers more difficult.
So,
be informed about all security vulnerabilities, so that you can
prevent your server from attacks in a better way. Stay safe, stay
secure !!
