Most of these protections are now available in all of Microsoft's supported operating systems. Several other OS changes that make PtH attacks far more difficult to achieve.A new Protected Users group, with member's credentials that can't be used in remote PtH attacks.Allows Remote Desktop Protocol (RDP) connections without putting the user's credentials on the remotely controlled computer.Programs are prevented from leaving credentials in memory after a user logs out.Better methods to restrict local accounts from going over the network.Many processes that once stored credentials in memory no longer do so.Strengthened LSASS to prevent hash dumps.Here's a recap of the new Windows PtH mitigations:
HASHTAB WINDOWS REVIEW WINDOWS 8.1
In Windows 2012 R2 and Windows 8.1 releases, Microsoft released a slew of new features specifically created to stop or minimize PtH attacks, which version 2 of the PtH whitepaper covers in good detail. Learn it and you'll be an AD security expert, too. In particular, the Active Directory white paper contain the "secrets" to maintaining a very low-risk Active Directory environment. Still, they contain useful information you won't find anywhere else, including recommendations you should definitely follow. Mitigating Pass-the-Hash (Pth) Attacks and Other Credential Theft Techniques (version 1.0)īoth version 1.0 of the PtH white paper and "Best Practices for Securing Active Directory" came out before Microsoft had pushed out the new Windows PtH mitigations.Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques (version 2.0).Best Practices for Securing Active Directory.Microsoft rose to the occasion and has released three white papers (I'm an author or contributor on all three) that should be must-reads by any Windows or Active Directory administrator:
HASHTAB WINDOWS REVIEW HOW TO
But that's two sides of the same problem.Ī few years ago, there wasn't a lot of information on how to prevent PtH attacks, and Windows lacked specific mitigations. 1 problem, I slightly disagree I think preventing the initial compromise and preventing the bad guy from obtaining elevated credentials needs to be the top priority. Though many companies consider credential theft attacks their No. This scenario is repeated thousands of times each day and has occurred multiple times in most companies.
HASHTAB WINDOWS REVIEW PATCH
Last Patch Tuesday, Microsoft released security updates that brought some of the pass-the-hash (PtH) mitigations introduced in Windows Server 2012 R2 and Windows 8.1 to Windows Server 2008 R2 and Windows 7.
0 kommentar(er)
