4 ms·

To be vulnerable to this, what sort of dumb things are end users doing? I couldn't immediately figure out here whether we're talking 0. Microsoft's supported

To be vulnerable to this, what sort of dumb things are end users doing? I couldn't immediately figure out here whether we're talking 0. Microsoft's supported products default enable this worthless "authentication" feature 1. Microsoft's supported products provide such a feature behind a UI that's not clearly marked "Danger: Do not stare into laser with remaining eye" 2: Microsoft does still support this, behind some Registry nonsense most users do not understand and once enabled it doesn't turn on the "I am a toxic waste dump, leave by nearest exit" warning signs on affected machines 3: Microsoft doesn't support this at all but some 3rd party commercial stuff does and customers really do love their crusty archaic 3rd party garbage 4: But this long abandoned SCO machine we've kept on life support for twenty years! 5: What does "supported" mean? Windows NT is scary, we're still on Windows 98 here.

mr_mitm 10mo ago
This is mostly an issue in active directory networks. Usually the reason people give as to why they still have this enabled is due to some legacy system that can't authenticate via Kerberos or at least NetNTLMv2. Worst case is if they then enable NetNTLMv1 on the domain controllers, even if the DC acts as a client. Using authentication coercion, this is a pretty quick win for an adversary.
- tialaramex 10mo ago
  Ok, so it's a 2 on my list. Microsoft needs to make this forcibly change the UI so that users can see "Oh! I'm using crap low security Windows". That lights a fire under people to actually get it fixed.
  - rainonmoon 10mo ago
    Using any variant of NTLM is insecure, which is why Microsoft is phasing it out in Windows 11/Server 2025. Which means we should be free of it some time around 2060.
nolok 10mo ago
You have to actively go out of your way to have this enabled. But large or older companies always have some old machine (can be as dumb a an old but very expensive printer) that isn't updated. Even today the only reason to use samba 2 in 90% of companies where it's enabled are old appliances. At some point device X isn't working, employees complain, IT say they need to buy a new very expensive replacement and after much argumentation they come to the agreement to enable that legacy horror support until the purchase can be made. Which is then never made.

mr_mitm 10mo ago

This is mostly an issue in active directory networks. Usually the reason people give as to why they still have this enabled is due to some legacy system that can't authenticate via Kerberos or at least NetNTLMv2. Worst case is if they then enable NetNTLMv1 on the domain controllers, even if the DC acts as a client. Using authentication coercion, this is a pretty quick win for an adversary.

tialaramex 10mo ago
Ok, so it's a 2 on my list. Microsoft needs to make this forcibly change the UI so that users can see "Oh! I'm using crap low security Windows". That lights a fire under people to actually get it fixed.
- rainonmoon 10mo ago
  Using any variant of NTLM is insecure, which is why Microsoft is phasing it out in Windows 11/Server 2025. Which means we should be free of it some time around 2060.

nolok 10mo ago

You have to actively go out of your way to have this enabled. But large or older companies always have some old machine (can be as dumb a an old but very expensive printer) that isn't updated. Even today the only reason to use samba 2 in 90% of companies where it's enabled are old appliances. At some point device X isn't working, employees complain, IT say they need to buy a new very expensive replacement and after much argumentation they come to the agreement to enable that legacy horror support until the purchase can be made. Which is then never made.