Penetration Testing mailing list archives
Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Sat, 24 Sep 2005 13:11:38 -0700
Well, the moderator apparently didn't like the way I approached my last post, so let's try this again, focusing on just the technical aspects this time. (Mod, please let this one through- if he responds, the information will be *invaluable* to millions of Windows installations all over the world.)
You postulate: "I still say that Kerberos or IPsec based auth is the best policy in windows. LanMan, NTLMv1 or V2 are vulnerable."
After I pointed out that "IPsec based auth" is not a basic netlogon authentication protocol like Kerberos, LM, NTLM and NTLMv2, you said I was wrong and came back with several posts containing your google results on "IPSec" and "authentication."
Rather than getting into how the basic client-server authentication netlogon protocols are vastly different than IPSec channels, please just answer one of the following questions. I'll try to make them very simple.
Scenario: You've got an XP Pro laptop on the Windows network logged on with local credentials. A network resource on a Win2k server somewhere is accessed, requiring new credentials be entered to access the resource. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.
or:Scenario: You've got a regular domain user on a domain member accessing a network share on a remote system. The clock on the PC is 8 minutes off from the DC. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.
or:Scenario: You've got a network user accessing a corporate web site that does not allow anonymous connections. The web site is configured to use only "Integrated Windows authentication."' The browser allows auto-logon from local intranet only. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.
or:Scenario: You've got a remote user who has logged in locally, but VPN'd into the network using a domain account. They go into outlook, make a SQL connection via windows integrated authentication, access network shares, print to a domain printer, etc. Please tell us exactly how you force the client and server(s) used to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.
That should be plenty of examples... I've been teaching about IPSec in my Microsoft Ninjitsu classes for years now, and I never knew it could used as a netlogon authentication protocol. You can image how excited I am to find out this information! So please take just a little more time and give us the specific settings and configurations used that allow us to specify "IPSec based auth" in place of LM, NTLM, or NTLMV2.
Thanks! T----- Original Message ----- From: "Craig Wright" <cwright () bdosyd com au>
To: <pen-test () securityfocus com> Sent: Thursday, September 22, 2005 8:52 PMSubject: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"
First the quote from the MSFT program manager "Microsoft is banning certain cryptographic functions from new computer code, citing increasingly sophisticated attacks that make them less secure, according to a company executive. The Redmond, Wash., software company instituted a new policy for all developers that bans functions using the DES, MD4, MD5 and, in some cases, the SHA1 encryption algorithm, which is becoming "creaky at the edges," said Michael Howard, senior security program manager at the company, Howard said." "All three algorithms show signs of 'extreme weakness' and have been banned, Howard said. Microsoft is recommending using the Secure Hash Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption Standard) cipher instead, he said. Quote when hearing about this "It's about time," Bruce Schneier of Counterpane Security Inc "Microsoft should have ended use of DES, MD4 and MD5 years ago" To answer "And I'm not sure where you are getting your info regarding Microsoft "dropping NTLMv2 for backward compatibility.""... Don't take my word for it... http://www.eweek.com/article2/0%2C1895%2C1859751%2C00.asp http://www.neowin.net/comments.php?id=30463&category=main http://www.technorati.com/search/md5 http://www.extremetech.com/article2/0,1697,1859953,00.asp http://it.slashdot.org/article.pl?sid=05/09/16/1211227&from=rss http://diswww.mit.edu/bloom-picayune/crypto/18482 http://www.codeproject.com/useritems/GoodbyeMD5.asp http://forums.thetechzone.com/showthread.php?s=&threadid=76038 http://download.microsoft.com/download/b/8/3/b838ee36-41a2-4280-af5c-182 04bb7a581/cryptography_windows_vista_2005_MBR.wmv Complimentary http://www.microsoft.com/presspass/features/2002/jan02/01-24secure.mspx For those who still believe MD5 collisions are just theory http://www.codeproject.com/useritems/HackingMd5.asp Craig PS NTLMv2 uses MD4 and HMAC_MD5 - these are not going to be supported. MSFT is moving to AES and SHA256 - so I guess it might be time for some people still on Windows 98 or NT 4.0 to finally move on. ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers arefutile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ------------------------------------------------------------------------------- ------------------------------------------------------------------------------Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows" Craig Wright (Sep 23)
- Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows" Thor (Hammer of God) (Sep 24)