NTLM Authentication plays an essential role in cyber security, especially within Windows network environments. As an older authentication protocol, it was designed for Windows networks before the advent of Active Directory and is used to authenticate clients and servers without sending a user’s credentials over the network. Instead, it uses an encrypted challenge-response mechanism to prove knowledge of the password without exposing it.
However, despite its encryption methods, NTLM is widely known to be less secure compared to modern authentication protocols such as Kerberos. NTLM vulnerabilities can be exploited in various cyber attacks, such as the aforementioned replay attacks, and particularly in ‘pass-the-hash’ attacks, wherein an attacker captures the hash of a user’s password and uses it to authenticate without needing the actual password.
Security professionals often recommend disabling NTLM Authentication in favour of more secure protocols, owing to its susceptibility to various types of attacks and the fact that it doesn’t provide mutual authentication or protect against the capture of credentials by monitoring the memory of the LSASS process.
Despite its deprecated status, NTLM remains widespread due to legacy system compatibility, necessitating stringent precautions such as limiting its use, securing relevant hashes, improving account and password policies, and applying appropriate network segmentation and monitoring to counteract potential attacks.
Key Characteristics:
- Utilises a challenge-response mechanism for client-server authentication
- Does not require transferring the user’s password over the network
- Considered less secure compared to more modern authentication protocols like Kerberos
- Still in use due to legacy system compatibility, though it presents certain security risks
Examples:
- Real-World Example: A corporate environment might use NTLM Authentication for accessing older file servers which do not support newer authentication protocols like Kerberos.
- Hypothetical Scenario: An attacker positioned on a corporate network intercepts the NTLM challenge-response of a user logging into an application and uses that response in a ‘pass-the-hash’ attack to access another server that accepts NTLM authentication.
Related Terms:
- Kerberos: A more secure network authentication protocol that uses tickets and mutual authentication, recommended as a replacement for NTLM.
- Replay Attack: An attack method that can exploit NTLM if proper security measures like SMB signing are not enabled.
- Pass-the-Hash Attack: A technique where an attacker uses a password hash to gain access without needing the plaintext password, exploiting vulnerabilities in NTLM Authentication.
- Challenge-Response: An authentication mechanism employed by NTLM where a user proves their identity by responding correctly to a challenge, typically involving a nonce or timestamp.
