New Strategies and Features to Help Organizations Better Protect Against Pass-the-Hash Attacks

The new guidance to help our customers address credential theft, called Mitigating Pass-the-Hash and Other Credential Theft, version 2. The paper encourages IT professionals to “assume breach” to highlight the need for the use of holistic planning strategies and features in Microsoft Windows to become more resilient against credential theft attacks. This paper builds on our previously released guidance and mitigations for Pass-the-Hash (PtH) attacks.

Given that organizations must continue to operate after a breach, it is critical for them to have a plan to minimize the impact of successful attacks on their ongoing operations. Adopting an approach that assumes a breach will occur, ensures that organizations have a holistic plan in place before an attack occurs. A planned approach enables defenders to close the seams that attackers are aiming to exploit.

The guidance also underscores another important point – that technical features alone may not prevent lateral movement and privilege escalation. In order to substantially reduce credential theft attacks, organizations should consider the attacker mindset and use strategies such as identifying key assets, implementing detection mechanisms, and having a breach recovery plan. These strategies can be implemented in combination with Windows features to provide a more effective defensive approach, and are aligned to the well-known National Institute of Standards and Technology (NIST) Cybersecurity Framework.

There are three important points technology leaders should understand about a PtH attack:

• First, an attacker has to get a foothold on your network before a PtH type of attack occurs. This is commonly achieved using tactics such as phishing, taking advantage of weak passwords, or by exploiting unpatched vulnerabilities. 
• Second, once initial administrative rights to a compromised computer are obtained, an attacker captures account login credentials on that computer, and then uses those captured credentials to authenticate to other computers on the network. 
• Third, the ultimate goal of an attacker might be to compromise the domain controller – the central point of control for all computers, corporate identities and credentials – which effectively gives them control and full access to all of the organization’s IT assets. 

Lastly, there is no one silver bullet that solves credential theft attacks such as PtH. The risk of credential theft exists in  any type of single-sign-on implementation, both in open source and commercial  platforms. Microsoft is committed to not only furthering platform enhancements to harden against these attacks, but also to sharing guidance to help strengthen our customers’ infrastructure against these threats.

If you have responsibility for the security of your organization’s IT infrastructure, I strongly encourage you to read and apply the guidance in this whitepaper. Visit http://microsoft.com/pth

KRBTGT Account Password Reset Scripts now available for customers

Credential theft and reuse attacks continue to be top of mind for many of the CISOs I have talked to recently. We have discussed this topic several times in the past:

• New Strategies and Features to Help Organizations Better Protect Against Pass-the-Hash Attacks
• New Guidance to Mitigate Determined Adversaries’ Favorite Attack: Pass-the-Hash
• Targeted Attacks Video Series
• You asked, we answered: #AskPtH Questions and Answers

Although pass-the-hash credential theft and reuse attacks aren’t new, more recently security researchers have been focusing on attack methods for Kerberos authentication. Kerberos authentication is achieved by the use of tickets enciphered with a symmetric key derived from the password of the server or service to which access is requested. To request such a session ticket, a special ticket, called the Ticket Granting Ticket (TGT) must be presented to the Kerberos service. The TGT is enciphered with a key derived from the password of the krbtgt account, which is known only by the Kerberos service[i].

A stolen krbtgt account password can wreak havoc on an organization because it can be used to impersonate authentication throughout the organization thereby giving an attacker access to sensitive data.

One way to help mitigate the risk of a bad actor using a compromised krbtgt key to forge user tickets is by periodically resetting the krbtgt account password. Resetting this password on a regular basis reduces the useful lifetime of krbtgt keys, in case one or more of them is compromised.

Today we are sharing the krbtgt account password reset script and associated guidance that will enable customers to interactively reset and validate replication of the krbtgt account keys on all writable domain controllers in the domain. By providing this script and associated guidance, we hope to help customers perform the reset in a way which reduces the likelihood of authentication errors caused by delayed distribution of the new krbtgt account keys in their environment.

The Reset-KrbtgtKeyInteractive-v1.4 enables customers to:

1. Perform a single reset of the krbtgt account password (it can be run multiple times for subsequent resets).
2. Validate that all writable DC’s in the domain have replicated the keys derived from the new password, so they are able to begin using the new keys.

The krbtgt account password reset script guide includes detailed information on how to use the reset script and its three modes- Informational, Estimation Mode, and Reset and offers:

1. A step-by-step list of tasks associated with performing the krbtgt account password reset.
2. Information for customers wishing to invalidate all existing TGTs by performing a double reset of the krbtgt account secret during a comprehensive Active Directory recovery.

We’ve also provided a detailed guide which helps system administrators understand the required tasks, impact to the organization, schedule and timeline, and other considerations. Together, this combination covers necessary tasks, tests, and validations that should be performed before and after the reset.

It is important to remember that resetting the krbtgt is only one part of a recovery strategy and alone will likely not prevent a previously successful attacker from obtaining unauthorized access to a compromised environment in the future. We strongly advise that customers create a comprehensive recovery plan using guidance found in the Mitigating Pass-the-Hash and Other Credential Theft, version 2.

[i] https://technet.microsoft.com/en-us/library/cc733924(v=ws.10).aspx