From: Thor (Hammer of God) (thor@hammerofgod.com)
Date: Sat Sep 24 2005 - 16:11:38 EDT
Well, the moderator apparently didn't like the way I approached my last
post, so let's try this again, focusing on just the technical aspects this
time. (Mod, please let this one through- if he responds, the information
will be *invaluable* to millions of Windows installations all over the
world.)
You postulate: "I still say that Kerberos or IPsec based auth is the best
policy in windows. LanMan, NTLMv1 or V2 are vulnerable."
After I pointed out that "IPsec based auth" is not a basic netlogon
authentication protocol like Kerberos, LM, NTLM and NTLMv2, you said I was
wrong and came back with several posts containing your google results on
"IPSec" and "authentication."
Rather than getting into how the basic client-server authentication netlogon
protocols are vastly different than IPSec channels, please just answer one
of the following questions. I'll try to make them very simple.
Scenario: You've got an XP Pro laptop on the Windows network logged on with
local credentials. A network resource on a Win2k server somewhere is
accessed, requiring new credentials be entered to access the resource.
Please tell us exactly how you force the client and server to use "IPSec
based auth" to authenticate the request as opposed to LM, NTLM, or NTLMv2.
Be specific, and please don't just copy and paste someone else's work from
google.
or:
Scenario: You've got a regular domain user on a domain member accessing a
network share on a remote system. The clock on the PC is 8 minutes off from
the DC. Please tell us exactly how you force the client and server to use
"IPSec based auth" to authenticate the request as opposed to LM, NTLM, or
NTLMv2. Be specific, and please don't just copy and paste someone else's
work from google.
or:
Scenario: You've got a network user accessing a corporate web site that
does not allow anonymous connections. The web site is configured to use
only "Integrated Windows authentication."' The browser allows auto-logon
from local intranet only. Please tell us exactly how you force the client
and server to use "IPSec based auth" to authenticate the request as opposed
to LM, NTLM, or NTLMv2. Be specific, and please don't just copy and paste
someone else's work from google.
or:
Scenario: You've got a remote user who has logged in locally, but VPN'd
into the network using a domain account. They go into outlook, make a SQL
connection via windows integrated authentication, access network shares,
print to a domain printer, etc. Please tell us exactly how you force the
client and server(s) used to use "IPSec based auth" to authenticate the
request as opposed to LM, NTLM, or NTLMv2. Be specific, and please don't
just copy and paste someone else's work from google.
That should be plenty of examples... I've been teaching about IPSec in my
Microsoft Ninjitsu classes for years now, and I never knew it could used as
a netlogon authentication protocol. You can image how excited I am to find
out this information! So please take just a little more time and give us
the specific settings and configurations used that allow us to specify
"IPSec based auth" in place of LM, NTLM, or NTLMV2.
Thanks!
T
----- Original Message -----
From: "Craig Wright" <cwright@bdosyd.com.au>
To: <pen-test@securityfocus.com>
Sent: Thursday, September 22, 2005 8:52 PM
Subject: MSFT Bans insecure hashes - was"Passwords with Lan Manager (LM)
under Windows"
First the quote from the MSFT program manager
"Microsoft is banning certain cryptographic functions from new computer
code, citing increasingly sophisticated attacks that make them less
secure, according to a company executive. The Redmond, Wash., software
company instituted a new policy for all developers that bans functions
using the DES, MD4, MD5 and, in some cases, the SHA1 encryption
algorithm, which is becoming "creaky at the edges," said Michael Howard,
senior security program manager at the company, Howard said."
"All three algorithms show signs of 'extreme weakness' and have been
banned, Howard said. Microsoft is recommending using the Secure Hash
Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption
Standard) cipher instead, he said.
Quote when hearing about this
"It's about time," Bruce Schneier of Counterpane Security Inc "Microsoft
should
have ended use of DES, MD4 and MD5 years ago"
To answer "And I'm not sure where you are getting your info regarding
Microsoft "dropping NTLMv2 for backward compatibility.""...
Don't take my word for it...
http://www.eweek.com/article2/0%2C1895%2C1859751%2C00.asp
http://www.neowin.net/comments.php?id=30463&category=main
http://www.technorati.com/search/md5
http://www.extremetech.com/article2/0,1697,1859953,00.asp
http://it.slashdot.org/article.pl?sid=05/09/16/1211227&from=rss
http://diswww.mit.edu/bloom-picayune/crypto/18482
http://www.codeproject.com/useritems/GoodbyeMD5.asp
http://forums.thetechzone.com/showthread.php?s=&threadid=76038
http://download.microsoft.com/download/b/8/3/b838ee36-41a2-4280-af5c-182
04bb7a581/cryptography_windows_vista_2005_MBR.wmv
Complimentary
http://www.microsoft.com/presspass/features/2002/jan02/01-24secure.mspx
For those who still believe MD5 collisions are just theory
http://www.codeproject.com/useritems/HackingMd5.asp
Craig
PS NTLMv2 uses MD4 and HMAC_MD5 - these are not going to be supported.
MSFT is moving to AES and SHA256 - so I guess it might be time for some
people still on Windows 98 or NT 4.0 to finally move on.
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for
vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers
do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:59 EDT