Microsoft Patches Critical Zero-Day Flaw in Windows Security Protocol

Researchers at Preempt uncovered two critical vulnerabilities in the Windows NTLM security protocols, one of which Microsoft patched today.

Microsoft today issued a patch for a newly revealed critical vulnerability affecting its Windows NT LAN Manager (NTLM) security protocols.
Researchers at Preempt uncovered two zero-day vulnerabilities within the Windows NTLM, both of which handle the protocol improperly and could allow attackers to create domain administrator accounts. One flaw was fixed as part of Patch Tuesday; the other was not.
NTLM is a suite of protocols enabling authentication, and could put users at risk of unauthorized credential use and password cracking if the flaws are exploited.
The first NTLM flaw, which Microsoft patched in
CVE-2017-8563
, is probably the best kept widely known secret of the hacking world, according to Preempt. It allows an NTLM relay attack, where an attacker can create a parallel session with a target server, leverage a users encrypted password hash to authenticate via NTLM, and infect a target system with malware.
Windows Lightweight Directory Access Protocol (LDAP) is not protected from NTLM relay attacks, even with its built-in LDAP signing defensive measure, which protects against man-in-the-middle (MitM) attacks but not credential forwarding. So an attacker with system privileges could relay credentials to the domain controller, where they can create a domain account and take over the entire network.
Microsofts patch fixes this vulnerability by incorporating enhancements to authentication protocols designed to mitigate authentication attacks, the company explains. To make LDAP authentication over SSL/TLS more secure, it also advises administrators to create a
LdapEnforceChannelBinding
registry on a domain controller.
There are many ways hackers can access privileged credentials, from phishing to physical device access. Every connection to an infected machine (SMB, WMI, SQL, HTTP) with a domain admin could result in a full network attack. All versions of Windows Server are vulnerable.
Once an administrator connects to your machine, he can use those credentials and create a new domain administrator, explains Preempt senior researcher Yaron Ziner. Once you have that one machine, you pretty much own the entire network.
Preempts analysis revealed 50- to 60% of all networks have a high-privilege agent connecting to all machines. A device does not necessarily need to have domain administrator credentials to be used by an attacker to conduct a full network takeover. Anyone with enough privilege to create an account could enable this level of attack.
Shades of WannaCry, Petya
Ziner says the privileged escalation vulnerability is a serious threat and has similarities to the WannaCry and Petya threats, which wreaked havoc across the globe over the past couple of months. Once one device was infected with either attack, it spread rapidly in the network.
The second NTLM flaw Preempt discovered is considered a design flaw and affects Remote Desktop Protocol (RDP) Restricted-Admin mode. RDP Restricted-Admin mode lets users connect to a remote machine without giving their password to the remote machine. It could also let attackers connect to remote machines using techniques like pass-the-hash, according to Preempt.
Preempt researchers discovered that RDP Restricted-Admin lets authentication systems downgrade to NTLM. This meant attacks possible with NTLM, such as credential relaying and password-cracking, can be used against RDP Restricted-Admin - risking the credentials of anyone using elevated privileges to access remote machines.
In this sense, the first NTLM vulnerability makes the second vulnerability more dangerous, says Zilner. When combined with the LDAP relay problem, the RDP flaw means each time an admin connects with Restricted-Admin, an attacker can make a fake domain admin account.
If you dont patch the first one, you definitely shouldnt use restricted admin, he notes. Its not safe at all.
Ziner says Microsoft told Preempt that this was a known issue when the security firm shared both vulnerabilities with the software giant in April 2017. They did acknowledge the issue and said its by design, he notes, and they will not be providing a patch for it.
That said, he continues, simply applying patches is not enough to protect against either threat. If companies want to be completely safe, they should stop using NTLM or use it in a very restricted manner. They should also keep tabs on privileged accounts; namely, when they were created, who created them, and whether they should actually be privileged.
Regarding todays full Microsoft Patch Tuesday release, Qualys director of product management Jimmy Graham advises businesses prioritize
CVE-2017-8589
, a flaw in the Windows Search service that could be exploited remotely via SMB to assume control of a system, and Windows Explorer vulnerability
CVE-2017-8463
.
Related Content:
How Code Vulnerabilities Can Lead to Bad Accidents
NotPetya: How to Prep and Respond if Youre Hit
IoT Devices Plagued by Lesser-Known Security Hole
New Google Security Controls Tighten Third-Party Data Access

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Patches Critical Zero-Day Flaw in Windows Security Protocol