Windows and the Kerberos security system for client/server authentication have a long and tortured relationship, especially for systems running older versions of Windows. Kerberos uses secret-key cryptography to augment password security. The solution is more secure because it doesn’t transmit the actual password, but rather a secret key that has the code stored in its memory.

Attacks on Password Security

InfoWorld described some attacks that can easily occur in older Windows systems. These attacks are called Pass-the-Hash and Golden Ticket.

They work because “NT LAN Manager (NTLM) creates secret keys using NTLM’s hash of an inactive user account. The inactive user krbtgt is created when the system is first installed and typically remains untouched on Windows machines for a long time.” This allows cybercriminals to access the hash and then gain the ability to execute certain administrative commands. At this point, they can also create new passwords and download files.

Unfortunately for users, there’s no real way to avoid these attacks. “Mitigation of most of these attacks is not possible, as this is simply how Kerberos works in the Windows environment,” wrote one security expert on his dfir-blog.

Saving Your Bacon

It may well be that organizations can prevent these password security issues by protecting privileged accounts at all costs. Recommended mitigations include using Microsoft’s Credential Guard so that passwords aren’t being stored in memory and relying on the Protected Users group to restrict access to privileged accounts.

InfoWorld referenced a user on Reddit who had some suggestions for organizations worried about their password security. He offered these potential mitigations for the Kerberos problem:

• Don’t give users root/admin rights.
• Don’t log on to other systems as a domain admin.
• Don’t perform interactive logins as an admin except on hardened systems.
• Use modern software.
• White-list applications in your environment.

Additionally, these attacks depend on RC4 being used. InfoWorld noted that the algorithm being exploited is disabled by default in many modern systems, including several recent iterations from Microsoft — from Windows 7 on.

As a result, no newly deployed systems are vulnerable to this attack. Microsoft has been recommending older systems disable this capability for more than a decade as well, so there are options for users.

Best Practices

If an organization is not moving off obsolete software like Windows Server 2003, it opens itself up to this kind of password security issue. Companies using older software would be vulnerable to this attack only because they made poor security decisions and chose not to invest in modern programs and infrastructure.

All of this points to the vital need for organizations to adopt the best practices for security measures and rid themselves of vulnerable points that may have accumulated over the years.