1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Researchers find way to steal Windows Active Directory credentials from the Internet

Discussion in 'CSO' started by RSS, Aug 7, 2015.

  1. RSS

    RSS New Member Member

    An attack using the SMB file sharing protocol that has been believed to work only within local area networks for over a decade can also be executed over the Internet, two researchers showed at the Black Hat security conference.

    The attack, called an SMB relay, causes a Windows computer that's part of an Active Directory domain to leak the user's credentials to an attacker when visiting a Web page, reading an email in Outlook or opening a video in Windows Media Player.

    Those credentials can then be used by the attacker to authenticate as the user on any Windows servers where the user has an account, including those hosted in the cloud.

    MORE ON CSO: How to spot a phishing email

    In an Active Directory network, Windows computers automatically send their credentials when they want to access different types of services like remote file shares, Microsoft Exchange email servers or SharePoint enterprise collaboration tools. This is done using the NTLM version 2 (NTLMv2) authentication protocol and the credentials that get sent are the computer and user name in plain text and a cryptographic hash derived from the user's password.

    To read this article in full or to leave a comment, please click here

    Continue reading...

Share This Page