6 ms·
Releasing rainbow tables to accelerate Net-NTLMv1 protocol deprecation
- ubuntulover2011 9mo agopretty cool
- postepowanieadm 9mo agoCan't wait for someone to decide one of protocols used by google needs to be deprecated.
- bawolff 9mo agoPlenty of protocols used by google over the years have been deprecated. The difference being that google actually stops using insecure protocols when they are discovered to be insecure instead of trying to sweep things under the rug. Keep in mind we are talking about a protocol from 1987. How many protocols from 1987 is google currently using?
- schmuckonwheels 9mo agoGoogle does whatever is convenient and makes them money. Altruism was never part of the equation.
- bawolff 9mo agoSure. Not being hacked is good for business. Keep in mind that google is primarily a cloud business. That means that they take on a lot more of a risk, as when they are hacked its a them problem vs traditional software where its much more the customer's problem. Security is very much about incentives, and the incentives line up better for google to do the right thing.
- schmuckonwheels 9mo agoIt's more about when Google assumed full control of the cloud, the browser, the OS, and everything in between they self-appointed themselves as the unelected standards board of the Internet, and forced everyone else to follow their whims and timelines. Some of which are completely insane.
- solarkraft 9mo agoAnd you‘re implying making Windows networks less insecure is completely insane?
- Fogest 9mo agoWhat are the policies you view as "completely insane"? I have some I disagree with like how they've handled things like Manifest v3 in the browsers, however there are still alternatives like Firefox anyway. However I think in terms of web standards some of the things they have pushed are also helpful. It's been much nicer having a much more consistent web browsing experience with less things like "You must use Internet Explorer on this site". I feel like web browser and website standards are one of the main areas Google has a lot more control of policies. Is there somewhere else they have much control of for standards?
- lmz 9mo agoRe: the IE thing. Only Apple's insistence on Safari in iOS is stopping sites from basically being chrome only.
- duskdozer 9mo ago>It's been much nicer having a much more consistent web browsing experience with less things like "You must use Internet Explorer on this site". What browser do you use? Because I've definitely run into this but s/ie/chrome/ but with no helpful message. You just have to guess that that's why it's broken
- deleted 9mo ago[deleted]
- fn-mote 9mo agoThis is such a negative reading of the situation. You’re talking about something that has been compromised for TWO DECADES. At least now nobody can pretend. I for one hope that this hastens the demise of every remaining use.
- Retr0id 9mo agoWell, you'll be waiting 20 years or so post-deprecation if you want an equivalent timeline.
- schmuckonwheels 9mo agoGoogle thrives on being the Internet's biggest bully. It turns out when nerds get a billion dollars they like being bullies too.
- RobotToaster 9mo agoGoogle does that every Tuesday
- aunty_helen 9mo ago> under 12 hours using consumer hardware costing less than $600 USD Great, so someone with half a motherboard can break this hash
- RobotToaster 9mo agoOr 1gb of ram, but not both
- schmuckonwheels 9mo ago"To demonstrate how crappy most front door locks are, to boost our company's social media cred we will be leaving drills and a dish of bump keys at the entrance of the neighborhood."
- bigfatkitten 9mo agoNTLMv1 rainbow tables have been available for 15-20 years. The only thing new is that Google are publishing theirs.
- coopreme 9mo agoNTLM is often used for more of the underlying technologies, some more secure than others… nthash, net-ntlmv1, net-ntlmv2. There’s a little more complexity here and this is different than the stuff that was out 15 years ago
- bri3d 9mo ago> this is different than the stuff that was out 15 years ago This stuff was out at least 10-15 years ago. It’s different from the ancient local ntlm hash cracking everyone used to get admin in high school, yes, but it’s not a novel technique. on cursory google, https://github.com/NotMedic/NetNTLMtoSilverTicket/blob/master/Readme.md https://github.com/NotMedic/NetNTLMtoSilverTicket/blob/maste... is 6 years old and was old news when it was committed, and https://crack.sh/netntlm/ https://crack.sh/netntlm/ has been around online for at least 10 and I think more like 15+ years.
- patmorgan23 9mo agoMicrosoft has deprecated NTLM and is actively ripping it out of windows. https://support.microsoft.com/en-us/topic/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025-c0554217-cdbc-420f-b47c-e02b2db49b2e https://support.microsoft.com/en-us/topic/upcoming-changes-t... Windows 11 is probably the last version that will contain NTLM (and hopefully NTLMv2). Going forward everything will be Kerberos or Oauth based.
- observationist 9mo agoThis empowers script kiddies, but not significantly moreso than they already were. Of all the places this is still in use, they've been exposed for years, so this isn't likely to result in a a bunch of new exploitations. However, it's most likely to be used by governments, with legacy servers that are finicky, with filesharing set up that's impacted other computers configured for compatibility, or legacy ancient network gear or printers. I wonder who they're pushing around, and what the motivation is?
- bigfatkitten 9mo agoMandiant is Google's incident response consulting business. Having worked for many years in that field myself (though not for Mandiant), they're probably sick of going to the same old engagements where companies have been getting owned the same way over and over again for the last 15 years. What releases like this do is give IT ops people the ammunition they need to convince their leadership to actually spend some money on fixing systemic security problems.
- alfiedotwtf 9mo ago> Mandiant is Google's incident response consulting business Consulting business? I was under the impression (from Google Reader) that if users aren’t in the millions, then they’ll kill the project. How could they also run a high-touch consultancy?! > they're probably sick of going to the same old engagements Hmm… consultancies love this type of recurring revenue - it’s easy money
- wolpoli 9mo ago> Consulting business? I was under the impression (from Google Reader) that if users aren’t in the millions, then they’ll kill the project. How could they also run a high-touch consultancy?! Google also has the Project Zero which doesn't fit into Google business culture either. I wonder if Mandiant is paying for their payroll.
- 9mo ago
- TacticalCoder 9mo agoHoly smoke. I honestly thought the 90s called and wanted their Windows exploits back (TFA mentions 1999). I do remember talk about this from many moons ago. But we are in two-thousand-twenty-FUCKING-six. It's unbelievable. Just plain unbelievable.
- 1970-01-01 9mo agoThey're just dumping them out as 2GB blobs onto a cloud? Where is the zippy search UI? Very lazy behavior for the hyper giant Google.
- Nerada 9mo agoRight? I feel like rainbow tables for NTLM have been around for decades, though at-cost. This seems incredibly low effort on Google's part.
- MadnessASAP 9mo agoThey don't know how to count that low. https://www.lesswrong.com/posts/koGbEwgbfst2wCbzG/i-don-t-know-how-to-count-that-low https://www.lesswrong.com/posts/koGbEwgbfst2wCbzG/i-don-t-kn...
- bawolff 9mo agoWhy would you want a search UI for a rainbow table? That makes no sense.
- 1970-01-01 9mo agoA. That's the most likely use case for anyone. You want the one-offs when cracking, and not a compressed 2GB blob of data that may or may not have your answer. B. The king of search has held the goal of organizing and making information useful and searchable since dinosaurs roamed the WWW. https://www.google.com/intl/en_us/search/howsearchworks/our-approach/ https://www.google.com/intl/en_us/search/howsearchworks/our-... C. It's just lazy and shows that they don't actually care anymore. Making a custom search has been their bread and butter for decades. The last step is the easiest but they could not be bothered.
- bflesch 9mo agoI wonder how the Mandiant acquisition is regarded within google. Was it a success? Is Mandiant a cash cow or was it basically an acquihire? The big "contact mandiant" button next to the post feels a bit like trying to stay relevant and acquire more customers.
- warkdarrior 9mo ago> trying to stay relevant and acquire more customers Is there any business that does NOT try to do this? Why wouldn't they?
- Cantinflas 9mo agoFuneral service providers, for obvious reasons.
- BrandoElFollito 9mo agoThis is like reminding that there are CVSes from 2010. Yes there are. And there are plenty of vulnerable systems. They decided to not fix the vulns (either directly by not patching, or indirectly by not investing in cybersecurity). So exploiting them is somehow an act of mercy. They may not know they have a problem and they have an opportunity to learn. Let's just hope they will have white or gray-ish hats teaching the lesson
- davidkellis 9mo agoDidn't l0phtcrack do this like 25 years ago?
- dbetteridge 9mo agoI recall using ntlm rainbow tables to crack windows hashes in high school in like 2008? Amazing that this is still around and causing someone enough of a headache to justify spending money on. Also amazing what a teenager with lots of free time and a bootable Linux usb can get up to.
- coopreme 9mo agoLM, nthash aka NTLM, net-ntlmv1 aka ntlmv1, net-ntlmv2 aka NTLMv2. Challenge response stuff is different. Naming here is painful.
- dbetteridge 9mo agoAh Microsoft and naming things... Name a better combo But fair enough, I don't recall which exact version I was mucking with that long ago.
- coopreme 9mo agoYa they just announced they are renaming security algos to copilot!!! story here -> https://dubious-adware-breach-scam@is.gd/WVZvnI?exploit.bat https://dubious-adware-breach-scam@is.gd/WVZvnI?exploit.bat
- phanimahesh 9mo agoLove this. Classic microsoft.
- CableNinja 9mo agoA few years ago i was doing some vm things in azure. Hadnt touched azure before, and spent 10+ minutes of frustration trying to figure out how to get amd64/x86_64 things started, as the only thing i could find was "Azure ARM", and on googling, "arm" here means azure resource manager... ARGH why does microsoft insist on using existing names and acronyms!?!?
- themafia 9mo agoAnd terrorism is just an abstract way of securing underprepared government facilities.
- ruined 9mo agoif you think about it, the united states terrorism risk insurance act distorts the terrorism market by subsidizing terrorism-generating activity https://home.treasury.gov/policy-issues/financial-markets-financial-institutions-and-fiscal-service/federal-insurance-office/terrorism-risk-insurance-program https://home.treasury.gov/policy-issues/financial-markets-fi...
- afn 9mo agoTangent: this link looks like a right-wing propaganda site; I wouldn’t trust any information there without verifying it with trusted sources. > Thanks to the President’s decisive leadership in the face of radical left-wing obstructionism, the Department of the Treasury has now resumed normal operations.
- dijit 9mo agoits an official government website
- Sytten 9mo agoYeah that protocol is very very broken. I recently did an ntlm plugin implementation for Caido [1] and I had to fork our crypto JS module to add back MD4 and 3DES. [1] https://github.com/caido-community/ntlm https://github.com/caido-community/ntlm
- archi42 9mo agoFor those interested: The SHA512 file lists 4096 files. Each file is 2 GiB. That means 8 TiB (or about 8.6 TB) of storage required.
- myself248 9mo agoRule of thumb: Saturating 100Mbps moves roughly 1TB/day.
- londons_explore 9mo agoReally curious how this was discussed with the legal team... "We're releasing hacking tools to allow others to break into poorly secured computer systems... But we are doing it with good intentions so it won't be illegal right??"
- nkrisc 9mo agoIsn’t this more or less a case of “illegal numbers”?
- rainonmoon 9mo agoYes. This is no more pernicious than releasing a multiplication table.
- kotaKat 9mo ago"Educational use only", just like every other skiddie tool you can freely grab on the Internet these days. (The bane of my existence thanks to everyone and their mother releasing ESP32 Wi-Fi/Bluetooth/etc deauther 'tools'...)
- preisschild 9mo agoMaybe actually secure your network then :D 802.11w exists
- londons_explore 9mo agoDoesn't protect against an attacker who just sends RTS + CTS packets every 50 microseconds, preventing all other wifi devices from transmitting anything (inc beacons). As a bonus, even wireshark won't detect anything for debugging, because the RTS+CTS handshake typically can't be sent to the linux kernel+higher layers. An ESP32 is capable of doing that on all wifi channels 'simultaneously' (ie. round robin, but getting back to the start channel within the timeout), effectively blocking all wifi.
- darkamaul 9mo ago
- nubskr 9mo agoMandiant releases rainbow tables for a 25 year old broken protocol because enterprises still won't disable it. It seems like sometimes the best security tool is just making the risk impossible to ignore.
- tialaramex 9mo agoTo be vulnerable to this, what sort of dumb things are end users doing? I couldn't immediately figure out here whether we're talking 0. Microsoft's supported products default enable this worthless "authentication" feature 1. Microsoft's supported products provide such a feature behind a UI that's not clearly marked "Danger: Do not stare into laser with remaining eye" 2: Microsoft does still support this, behind some Registry nonsense most users do not understand and once enabled it doesn't turn on the "I am a toxic waste dump, leave by nearest exit" warning signs on affected machines 3: Microsoft doesn't support this at all but some 3rd party commercial stuff does and customers really do love their crusty archaic 3rd party garbage 4: But this long abandoned SCO machine we've kept on life support for twenty years! 5: What does "supported" mean? Windows NT is scary, we're still on Windows 98 here.
- mr_mitm 9mo agoThis is mostly an issue in active directory networks. Usually the reason people give as to why they still have this enabled is due to some legacy system that can't authenticate via Kerberos or at least NetNTLMv2. Worst case is if they then enable NetNTLMv1 on the domain controllers, even if the DC acts as a client. Using authentication coercion, this is a pretty quick win for an adversary.
- tialaramex 9mo agoOk, so it's a 2 on my list. Microsoft needs to make this forcibly change the UI so that users can see "Oh! I'm using crap low security Windows". That lights a fire under people to actually get it fixed.
- rainonmoon 9mo agoUsing any variant of NTLM is insecure, which is why Microsoft is phasing it out in Windows 11/Server 2025. Which means we should be free of it some time around 2060.
- nolok 9mo agoYou have to actively go out of your way to have this enabled. But large or older companies always have some old machine (can be as dumb a an old but very expensive printer) that isn't updated. Even today the only reason to use samba 2 in 90% of companies where it's enabled are old appliances. At some point device X isn't working, employees complain, IT say they need to buy a new very expensive replacement and after much argumentation they come to the agreement to enable that legacy horror support until the purchase can be made. Which is then never made.