From: Thor (Hammer of God) (thor@hammerofgod.com)
Date: Thu Feb 15 2007 - 11:51:59 EST
Not necessarily. Windows has SSP's for Kerberos, NTLM, and Schannel. While
Windows will try to use the "most secure" (Kerberos) first, there are any
number of circumstances where NT(LM) will be used instead, such as remote
access to a resource where both systems are not members of the same domain
or trusted domains, time synchronization is off by more than five minutes,
or when the remote resource simply requests a particular type of
authentication.
That's why you should specify to only send NTLMv2 and to refuse LM and NTLM
in your local windows security policy.
t
On 2/14/07 9:07 AM, "McCarty, Eric C." <emccarty@er.ucsd.edu> spoketh to
all:
> "However over the network there is no option to avoid sending current
> users creds automatically"
>
> First off, I don't know the type of environment you are working in but
> windows uses Kerberos for authentication purposes:
>
> Kerberos differs from username/password authentication methods because
> instead of authenticating each user to each network service, it uses
> symmetric encryption and a trusted third party - known as the Key
> Distribution Center (KDC) - to authenticate users to a suite of network
> services. Once a user authenticates to the KDC, it sends a ticket
> specific to that session back the user's machine and any kerberized
> services look for the ticket on the user's machine rather than asking
> the user to authenticate using a password.
>
> As a result you are not really sending uname/pword over the wire.
> However I see your point in wanting to avoid using Kerberos, the easiest
> way is to specify a guest user when mapping
>
> Net use \\server\share /USER:Guest
>
> You can also disable Kerberos using a registry change :
>
> To disable Kerberos, Microsoft provides a registry hack (the hack is
> available from Windows 2000 Service Pack 2 onward). The hack is called
> NT4Emulator (REG_DWORD) and should be added to the
> HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Netlogon/
> Parameters registry key of the Windows 2000 SP2 or later DC and set to
> value 1.
>
>
> Eric
>
>
> -----Original Message-----
> From: Shenk, Jerry A [mailto:jshenk@decommunications.com]
> Sent: Tuesday, February 13, 2007 3:00 PM
> To: Umil; pen-test@securityfocus.com
> Subject: RE: Avoid sending current credentials automatically over the
> network
>
> I would recommend blocking those ports (135, 137, 139 and 445) at the
> edge router so that at least they aren't sent over the internet. For
> some machines, perhaps you want a host firewall to block them from
> leaving the box at all.
>
> -----Original Message-----
> From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
> On Behalf Of Umil
> Sent: Tuesday, February 13, 2007 10:21 AM
> To: pen-test@securityfocus.com
> Subject: Avoid sending current credentials automatically over the
> network
>
> Hi all
>
>
> When mapping a network share without any credentials parameter or when
> clicking in a link for a internal app Windows and IE automatically send
> the
> current users credentials automatically. Aparently for IE you can
> configure
> to send anonymous creds (guest account) and then ask for creds.
> However over the network there is no option to avoid sending current
> users
> creds automatically. I tried smb signing but it didn't work.
> Does anyone know a solution for it?
> Thanks
> Uno
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
> 00000008bOW
> ------------------------------------------------------------------------
>
>
>
>
> **DISCLAIMER
> This e-mail message and any files transmitted with it are intended for
> the use of the individual or entity to which they are addressed and may
> contain information that is privileged, proprietary and confidential. If
> you are not the intended recipient, you may not use, copy or disclose to
> anyone the message or any information contained in the message. If you
> have received this communication in error, please notify the sender and
> delete this e-mail message. The contents do not represent the opinion of
> D&E except to the extent that it relates to their official business.
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
> 00000008bOW
> ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016000000
> 08bOW
> ------------------------------------------------------------------------
>
>
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:35 EDT