Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Sat, 24 Sep 2005 13:11:38 -0700

Well, the moderator apparently didn't like the way I approached my last post, so let's try this again, focusing on just the technical aspects this time. (Mod, please let this one through- if he responds, the information will be *invaluable* to millions of Windows installations all over the world.)


You postulate: "I still say that Kerberos or IPsec based auth is the best policy in windows. LanMan, NTLMv1 or V2 are vulnerable."

After I pointed out that "IPsec based auth" is not a basic netlogon authentication protocol like Kerberos, LM, NTLM and NTLMv2, you said I was wrong and came back with several posts containing your google results on "IPSec" and "authentication."

Rather than getting into how the basic client-server authentication netlogon protocols are vastly different than IPSec channels, please just answer one of the following questions. I'll try to make them very simple.

Scenario: You've got an XP Pro laptop on the Windows network logged on with local credentials. A network resource on a Win2k server somewhere is accessed, requiring new credentials be entered to access the resource. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.

or:
Scenario: You've got a regular domain user on a domain member accessing a network share on a remote system. The clock on the PC is 8 minutes off from the DC. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.

or:
Scenario: You've got a network user accessing a corporate web site that does not allow anonymous connections. The web site is configured to use only "Integrated Windows authentication."' The browser allows auto-logon from local intranet only. Please tell us exactly how you force the client and server to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.

or:
Scenario: You've got a remote user who has logged in locally, but VPN'd into the network using a domain account. They go into outlook, make a SQL connection via windows integrated authentication, access network shares, print to a domain printer, etc. Please tell us exactly how you force the client and server(s) used to use "IPSec based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste someone else's work from google.

That should be plenty of examples... I've been teaching about IPSec in my Microsoft Ninjitsu classes for years now, and I never knew it could used as a netlogon authentication protocol. You can image how excited I am to find out this information! So please take just a little more time and give us the specific settings and configurations used that allow us to specify "IPSec based auth" in place of LM, NTLM, or NTLMV2.

Thanks!

T




----- Original Message ----- From: "Craig Wright" <cwright () bdosyd com au>
To: <pen-test () securityfocus com>
Sent: Thursday, September 22, 2005 8:52 PM
Subject: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM) under Windows"


First the quote from the MSFT program manager

"Microsoft is banning certain cryptographic functions from new computer
code, citing increasingly sophisticated attacks that make them less
secure, according to a company executive. The Redmond, Wash., software
company instituted a new policy for all developers that bans functions
using the DES, MD4, MD5 and, in some cases, the SHA1 encryption
algorithm, which is becoming "creaky at the edges," said Michael Howard,
senior security program manager at the company, Howard said."

"All three algorithms show signs of 'extreme weakness' and have been
banned, Howard said. Microsoft is recommending using the Secure Hash
Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption
Standard) cipher instead, he said.

Quote when hearing about this
"It's about time," Bruce Schneier of Counterpane Security Inc "Microsoft
should
have ended use of DES, MD4 and MD5 years ago"

To answer "And I'm not sure where you are getting your info regarding
Microsoft "dropping NTLMv2 for backward compatibility.""...
Don't take my word for it...

http://www.eweek.com/article2/0%2C1895%2C1859751%2C00.asp
http://www.neowin.net/comments.php?id=30463&category=main
http://www.technorati.com/search/md5
http://www.extremetech.com/article2/0,1697,1859953,00.asp
http://it.slashdot.org/article.pl?sid=05/09/16/1211227&from=rss
http://diswww.mit.edu/bloom-picayune/crypto/18482
http://www.codeproject.com/useritems/GoodbyeMD5.asp
http://forums.thetechzone.com/showthread.php?s=&threadid=76038

http://download.microsoft.com/download/b/8/3/b838ee36-41a2-4280-af5c-182
04bb7a581/cryptography_windows_vista_2005_MBR.wmv

Complimentary
http://www.microsoft.com/presspass/features/2002/jan02/01-24secure.mspx

For those who still believe MD5 collisions are just theory
http://www.codeproject.com/useritems/HackingMd5.asp

Craig

PS NTLMv2 uses MD4 and HMAC_MD5 - these are not going to be supported.
MSFT is moving to AES and SHA256 - so I guess it might be time for some
people still on Windows 98 or NT 4.0 to finally move on.

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------




------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]