Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks

Jeffrey A. Nichols; Benjamin A. Taylor; Laura Curtis

doi:10.1145/2897795.2897800

Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks

Jeffrey A. Nichols, Benjamin A. Taylor, Laura Curtis

Cybersecurity Research

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

3 Scopus citations

Abstract

We investigated the security resilience of the current Windows Active Directory (AD) environments to Pass-the-Hash and Passthe- Ticket, two prominent post-exploitation, credential theft attacks. An operating system's security resilience consists of its native features that allow for containing a detected attack. Postexploitation refers to an attacker's activities subsequent to penetration. Specifically, we discovered a way to trigger the removal of all previously issued authentication credentials for a client, thus preventing its use by attackers. After triggered, the user is forced to contact the domain administrators to reauthenticate to the Domain Controller (DC) to continue. This could become the basis for a response Windows system administrators could use to halt the spread of a detected attack. Operating in a virtualized XenServer environment, we were able to carefully determine and recreate the conditions necessary to cause this response.

Original language	English
Title of host publication	Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016
Publisher	Association for Computing Machinery, Inc
ISBN (Electronic)	9781450337526
DOIs	https://doi.org/10.1145/2897795.2897800
State	Published - Apr 5 2016
Event	11th Annual Cyber and Information Security Research Conference, CISRC 2016 - Oak Ridge, United States Duration: Apr 5 2016 → Apr 7 2016

Publication series

Name	Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016

Conference

Conference	11th Annual Cyber and Information Security Research Conference, CISRC 2016
Country/Territory	United States
City	Oak Ridge
Period	04/5/16 → 04/7/16

Keywords

Microsoft version of kerberos protocol
Pass-the-hash attacks
Pass-the-ticket attacks
Windows 7 authentication
Windows 8.1 authentication
Windows server 2012 authentication

Access to Document

10.1145/2897795.2897800

Cite this

Nichols, J. A., Taylor, B. A., & Curtis, L. (2016). Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks. In Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016 Article 2897800 (Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016). Association for Computing Machinery, Inc. https://doi.org/10.1145/2897795.2897800

Nichols, Jeffrey A. ; Taylor, Benjamin A. ; Curtis, Laura. / Security resilience : Exploring windows domain-level defenses against post-exploitation authentication attacks. Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016. Association for Computing Machinery, Inc, 2016. (Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016).

@inproceedings{597d2fa1349948ec94629e166f3f77fd,

title = "Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks",

abstract = "We investigated the security resilience of the current Windows Active Directory (AD) environments to Pass-the-Hash and Passthe- Ticket, two prominent post-exploitation, credential theft attacks. An operating system's security resilience consists of its native features that allow for containing a detected attack. Postexploitation refers to an attacker's activities subsequent to penetration. Specifically, we discovered a way to trigger the removal of all previously issued authentication credentials for a client, thus preventing its use by attackers. After triggered, the user is forced to contact the domain administrators to reauthenticate to the Domain Controller (DC) to continue. This could become the basis for a response Windows system administrators could use to halt the spread of a detected attack. Operating in a virtualized XenServer environment, we were able to carefully determine and recreate the conditions necessary to cause this response.",

keywords = "Microsoft version of kerberos protocol, Pass-the-hash attacks, Pass-the-ticket attacks, Windows 7 authentication, Windows 8.1 authentication, Windows server 2012 authentication",

author = "Nichols, {Jeffrey A.} and Taylor, {Benjamin A.} and Laura Curtis",

note = "Publisher Copyright: {\textcopyright} 2016 ACM.; 11th Annual Cyber and Information Security Research Conference, CISRC 2016 ; Conference date: 05-04-2016 Through 07-04-2016",

year = "2016",

month = apr,

day = "5",

doi = "10.1145/2897795.2897800",

language = "English",

series = "Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016",

publisher = "Association for Computing Machinery, Inc",

booktitle = "Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016",

}

Nichols, JA, Taylor, BA & Curtis, L 2016, Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks. in Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016., 2897800, Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016, Association for Computing Machinery, Inc, 11th Annual Cyber and Information Security Research Conference, CISRC 2016, Oak Ridge, United States, 04/5/16. https://doi.org/10.1145/2897795.2897800

Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks. / Nichols, Jeffrey A.; Taylor, Benjamin A.; Curtis, Laura.
Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016. Association for Computing Machinery, Inc, 2016. 2897800 (Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Security resilience

T2 - 11th Annual Cyber and Information Security Research Conference, CISRC 2016

AU - Nichols, Jeffrey A.

AU - Taylor, Benjamin A.

AU - Curtis, Laura

PY - 2016/4/5

Y1 - 2016/4/5

N2 - We investigated the security resilience of the current Windows Active Directory (AD) environments to Pass-the-Hash and Passthe- Ticket, two prominent post-exploitation, credential theft attacks. An operating system's security resilience consists of its native features that allow for containing a detected attack. Postexploitation refers to an attacker's activities subsequent to penetration. Specifically, we discovered a way to trigger the removal of all previously issued authentication credentials for a client, thus preventing its use by attackers. After triggered, the user is forced to contact the domain administrators to reauthenticate to the Domain Controller (DC) to continue. This could become the basis for a response Windows system administrators could use to halt the spread of a detected attack. Operating in a virtualized XenServer environment, we were able to carefully determine and recreate the conditions necessary to cause this response.

AB - We investigated the security resilience of the current Windows Active Directory (AD) environments to Pass-the-Hash and Passthe- Ticket, two prominent post-exploitation, credential theft attacks. An operating system's security resilience consists of its native features that allow for containing a detected attack. Postexploitation refers to an attacker's activities subsequent to penetration. Specifically, we discovered a way to trigger the removal of all previously issued authentication credentials for a client, thus preventing its use by attackers. After triggered, the user is forced to contact the domain administrators to reauthenticate to the Domain Controller (DC) to continue. This could become the basis for a response Windows system administrators could use to halt the spread of a detected attack. Operating in a virtualized XenServer environment, we were able to carefully determine and recreate the conditions necessary to cause this response.

KW - Microsoft version of kerberos protocol

KW - Pass-the-hash attacks

KW - Pass-the-ticket attacks

KW - Windows 7 authentication

KW - Windows 8.1 authentication

KW - Windows server 2012 authentication

UR - http://www.scopus.com/inward/record.url?scp=84968546842&partnerID=8YFLogxK

U2 - 10.1145/2897795.2897800

DO - 10.1145/2897795.2897800

M3 - Conference contribution

AN - SCOPUS:84968546842

T3 - Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016

BT - Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016

PB - Association for Computing Machinery, Inc

Y2 - 5 April 2016 through 7 April 2016

ER -

Nichols JA, Taylor BA, Curtis L. Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks. In Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016. Association for Computing Machinery, Inc. 2016. 2897800. (Proceedings of the 11th Annual Cyber and Information Security Research Conference, CISRC 2016). doi: 10.1145/2897795.2897800

Security resilience: Exploring windows domain-level defenses against post-exploitation authentication attacks

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this