Mandiant Unveils Tool to Break Weak Admin Passwords in 12 Hours
Mandiant has introduced a new tool designed to expose the vulnerabilities associated with weak admin passwords in a mere 12 hours. The tool leverages historical weaknesses inherent in the NTLMv1 protocol, which has been criticized for years.
Background on NTLMv1
Microsoft developed NTLMv1 during the release of OS/2 in the 1980s. Despite its implementation, cryptanalyst Bruce Schneier and Mudge flagged significant weaknesses in 1999. Their research laid the foundation for future exploits, culminating in notable demonstrations by security researchers at the Defcon 20 conference in 2012. These researchers showed how vulnerable the protocol was, allowing attackers to escalate privileges from a guest network to admin status in just 60 seconds.
The Transition to NTLMv2
Microsoft released NTLMv2 alongside Windows NT SP4 in 1998. This updated version addressed many vulnerabilities found in its predecessor. However, even though Microsoft announced intentions to phase out NTLMv1 in August 2022, many organizations continue to use this outdated protocol.
Continued Usage Despite Risks
- Mandiant reports ongoing usage of NTLMv1 in active environments.
- This legacy protocol exposes organizations to significant risks of credential theft.
- The persistence of NTLMv1 is attributed to organizational inertia and ignorance of immediate threats.
New Tool and its Implications
The new Mandiant tool employs a known plaintext attack, utilizing a challenge such as 1122334455667788 during the authentication process. Once the challenge is cracked, the attacker can access the Net-NTLMv1 hash, which can then be swiftly defeated using the created rainbow table. Existing tools like Responder, PetitPotam, and DFSCoerce are typically part of this process.
Responses from Security Professionals
The release of this tool has garnered attention among cybersecurity professionals. Many have expressed that it will serve as a crucial argument for organizations struggling to transition away from insecure protocols. One respondent mentioned their experience with demonstrating system weaknesses, highlighting the dramatic impact of showing a compromised password.
Recommendations for Organizations
Mandiant urges organizations to take immediate action. They recommend disabling the use of Net-NTLMv1 as a critical step toward improving security. Failure to act could result in severe consequences for organizations that choose to ignore these risks.
For detailed instructions on transitioning away from NTLMv1, Mandiant offers further resources on their platform. Organizations that are breach victims due to outdated protocols will only have themselves to blame.
