Preempt Shows How to Sidestep EPA Authentication

Security firm Preempt issued an advisory that showed how to conceptually bypass the Enhanced Protection for Authentication (EPA) that prevents attackers from performing a relay of NT Lan Manager (NTLM) messages to top-level security (TLS) sessions. Attackers could use NTLM to enable their own fake sessions. Since a relay attack is the most common one used against the proprietary NTLM, EPA was put there to stop them.

Preempt says that their "bypass allows attackers to modify NTLM messages to generate legitimate channel binding information. This can allow attackers to connect to various web servers using the attacked user's privileges and perform operations such as: read the user's emails (by relaying to Outlook Web Access (OWA) servers) or even connect to cloud resources (by relaying to Active Directory Federation Services (ADFS) servers)."

Also, the Message Integrity Code (MIC) is not tampered with. Instead, it is just cut out. The advisory says, "bypass allows attackers to remove the 'MIC' protection and modify various fields in the NTLM authentication flow, such as signing negotiation."

But wait, one more.

Server Message Block (SMB) Session Signing was to prevent attackers from relaying NTLM authentication messages to establish SMB and other sessions. It's the same relay attack, but the defense tool was adapted for this specific situation.

The researchers went on, "The bypass we discovered enables attackers to relay NTLM authentication requests to any server in the domain, including domain controllers, while establishing a signed session to perform remote code execution. If the relayed authentication is of a privileged user, this means full domain compromise."

Boy Howdy, that's a #fail.

They patched the bypass in the June Patch Tuesday. But just the patching alone is not sufficient to deal with this and other problems.

Preempt says that configuration changes should be done to the network. Because it's NTLM, you know?

Some really relevant network options are:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.