Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/11/2017
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Microsoft Patches Critical Zero-Day Flaw in Windows Security Protocol

Researchers at Preempt uncovered two critical vulnerabilities in the Windows NTLM security protocols, one of which Microsoft patched today.

Microsoft today issued a patch for a newly revealed critical vulnerability affecting its Windows NT LAN Manager (NTLM) security protocols.

Researchers at Preempt uncovered two zero-day vulnerabilities within the Windows NTLM, both of which handle the protocol improperly and could allow attackers to create domain administrator accounts. One flaw was fixed as part of Patch Tuesday; the other was not.

NTLM is a suite of protocols enabling authentication, and could put users at risk of unauthorized credential use and password cracking if the flaws are exploited.

The first NTLM flaw, which Microsoft patched in CVE-2017-8563, is "probably the best kept widely known secret of the hacking world," according to Preempt. It allows an NTLM relay attack, where an attacker can create a parallel session with a target server, leverage a user's encrypted password hash to authenticate via NTLM, and infect a target system with malware.

Windows' Lightweight Directory Access Protocol (LDAP) is not protected from NTLM relay attacks, even with its built-in LDAP signing defensive measure, which protects against man-in-the-middle (MitM) attacks but not credential forwarding. So an attacker with system privileges could relay credentials to the domain controller, where they can create a domain account and take over the entire network.

Microsoft's patch fixes this vulnerability "by incorporating enhancements to authentication protocols designed to mitigate authentication attacks," the company explains. To make LDAP authentication over SSL/TLS more secure, it also advises administrators to create a LdapEnforceChannelBinding registry on a domain controller.

There are many ways hackers can access privileged credentials, from phishing to physical device access. Every connection to an infected machine (SMB, WMI, SQL, HTTP) with a domain admin could result in a full network attack. All versions of Windows Server are vulnerable.

"Once an administrator connects to your machine, he can use those credentials and create a new domain administrator," explains Preempt senior researcher Yaron Ziner. "Once you have that one machine, you pretty much own the entire network."

Preempt's analysis revealed 50- to 60% of all networks have a high-privilege agent connecting to all machines. A device does not necessarily need to have domain administrator credentials to be used by an attacker to conduct a full network takeover. Anyone with enough privilege to create an account could enable this level of attack.

Shades of WannaCry, Petya

Ziner says the privileged escalation vulnerability is a serious threat and has similarities to the WannaCry and Petya threats, which wreaked havoc across the globe over the past couple of months. Once one device was infected with either attack, it spread rapidly in the network.

The second NTLM flaw Preempt discovered is considered a design flaw and affects Remote Desktop Protocol (RDP) Restricted-Admin mode. RDP Restricted-Admin mode lets users connect to a remote machine without giving their password to the remote machine. It could also let attackers connect to remote machines using techniques like pass-the-hash, according to Preempt.

Preempt researchers discovered that RDP Restricted-Admin lets authentication systems downgrade to NTLM. This meant attacks possible with NTLM, such as credential relaying and password-cracking, can be used against RDP Restricted-Admin - risking the credentials of anyone using elevated privileges to access remote machines.

In this sense, the first NTLM vulnerability makes the second vulnerability more dangerous, says Zilner. When combined with the LDAP relay problem, the RDP flaw means each time an admin connects with Restricted-Admin, an attacker can make a fake domain admin account.

"If you don't patch the first one, you definitely shouldn't use restricted admin," he notes. "It's not safe at all."

Ziner says Microsoft told Preempt that this was a known issue when the security firm shared both vulnerabilities with the software giant in April 2017. "They did acknowledge the issue and said it's by design," he notes, and they will not be providing a patch for it.

That said, he continues, simply applying patches is not enough to protect against either threat. If companies want to be completely safe, they should stop using NTLM or use it in a very restricted manner. They should also keep tabs on privileged accounts; namely, when they were created, who created them, and whether they should actually be privileged.

Regarding today's full Microsoft Patch Tuesday release, Qualys director of product management Jimmy Graham advises businesses prioritize CVE-2017-8589, a flaw in the Windows Search service that could be exploited remotely via SMB to assume control of a system, and Windows Explorer vulnerability CVE-2017-8463.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
mikelemire
50%
50%
mikelemire,
User Rank: Author
7/12/2017 | 3:28:53 PM
Re: Correction
Its no longer a zero day flaw when a patch is released
LordC623
50%
50%
LordC623,
User Rank: Strategist
7/11/2017 | 8:05:13 PM
Correction
Misspelled in the title - "NTML"
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-1231
PUBLISHED: 2021-02-24
A vulnerability in the Link Layer Discovery Protocol (LLDP) for Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an unauthenticated, adjacent attacker to disable switching on a small form-factor pluggable (SFP) interface. This vulnerability is due to inc...
CVE-2021-1361
PUBLISHED: 2021-02-24
A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attacker to create, delete, or overwrite arbitr...
CVE-2021-1367
PUBLISHED: 2021-02-24
A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this...
CVE-2021-1368
PUBLISHED: 2021-02-24
A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. This vuln...
CVE-2021-1387
PUBLISHED: 2021-02-24
A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability exists because the software improperly releases resources when it processes certain IPv6 packets that ar...