Authentication under Windows: A smouldering security problem

Speaking at the USENIX conference, which ended last week, developer Marsh Ray highlighted an old and known flaw that continues to be underestimated in the Windows world: authentication mechanisms involving NTLMv2 are often insecure. Attackers can potentially intercept the credentials transmitted during log-in and misuse them to log into the servers themselves – without knowing the password. The attackers exploit a weakness in NTLMv2, a protocol which is vulnerable to "replay" and "reflection" attacks although it does transmit the data itself in a secure encrypted form.

While an attacker launching a replay attack can gain access to a server, attacks such as SMB reflection only require the operator of a specially crafted SMB server to send the NTLM log-in credentials of a log-in attempt at the operator's server back to the victim. This allows the attacker to gain access to the victim's PC and execute programs there. Successful attacks do require ports 139 and 445 to be accessible on the victim's machine, which will be the case if, for instance, file sharing and printer sharing are enabled on a local network.