BR +55 11 3069 3925 | USA +1 469 620 7643

  • HELP ME
  • BLOG
  • Português
  • BR +55 11 3069 3925 | USA +1 469 620 7643
  • Português
logo senhasegura
  • SOLUTIONS
  • PRODUCTS
  • SERVICES AND SUPPORT
  • PARTNERS
  • COMPANY
  • CONTACT
  • DEMO

Compliance

and Audit

Audit

PCI DSS

SOX

ISO 27001

HIPAA

NIST

GDPR

ISA 62443 |

Industry 4.0

Security and

Risk Management

Privilege Abuse

Third Party Access

Privileged Access Recording

Insider Threat

Data Theft Prevention

Hardcoded Passwords

Password Reset

Solutions

By Industry

Energy and Utilities

Financial

Government

Health Care

Legal

Telecoms

Retail

senhasegura

Testimonials

See Testimonials

360º Privilege Platform

Account and

Session

PAM Core

Domum

Remote Access

PAM SaaS

GO Endpoint

Manager

GO Endpoint

Manager Windows

GO Endpoint

Manager Linux

DevOps Secret

Manager

DevOps Secret

Manager

Multi

Cloud

Cloud IAM

Certificate

Manager

Certificate

Manager

Privileged

Infrastructure

PAM Crypto Appliance

PAM Virtual Crypto Appliance

PAM Load Balancer

Delivery : On Cloud (SaaS) | On-premises | Hybrid

Services

and Support

Documentation

Solution Center

Suggestions

Training and Certification

Deployment and Consulting

PAMaturity

PAM 360º

Support Policy

senhasegura

Resources

Rich Materials

Customer Cases

Webinars Calendar

senhasegura Stickers

 BLOG

CONTENT

Is your company really prepared for a cyber attack?

The Pillars of Information Security

7 signs that your company needs to improve the security of sensitive data

See more articles about cybersecurity

Technical

Information

How it works

Product Archicture

Integration

Security

High availability and contingency

Privileged Auditing (Configuration)

Privileged Change Audit

Features and

Functionalities

ITSM Integration

Behavior Analysis

Threat Analysis

Privileged Information Protection

Scan Discovery

Task Management

Session Management (PSM)

Application Identity (AAPM)

SSH Key Management

Affinity Partner

Program

About the Program

Become a Partner

MSSP Affinity Partner Program

Security Alliance Program

Academy | E-learning for Certification

Affinity

Portal

Portal dedicated only for Partners to find commercial, marketing supporting materials and certification program of senhasegura.

Access Partner Portal

Opportunity

Booking

For our Commercial Team to support your sale more effectively, request your opportunity booking here.

Opportunity Booking Request

Find a

Partner

We work together to offer a better solution for your company.

Check all senhasegura partners

About

Company

About us

Why senhasegura

Press

Events

Career

Presence in the World

Terms of Use

End User License Agreement (EULA)

Privacy and Cookie Policy

Certification at senhasegura

senhasegura

Testimonials

See Testimonials

Latest

Reports

Gartner PAM Magic Quadrant 2021 Report

KuppingerCole Leadership Compass: PAM 2021

GigaOm Radar Report 2021

Gartner PAM Magic Quadrant 2020

Gartner Critical Capabilities for PAM 2020

Information Services Group, Inc. (ISG)

KuppingerCole Leadership Compass: PAM 2020

Contact our team

Request a Demonstration

How Do Pass-the-hash Attacks Work?

by senhasegura Blog Team | Oct 12, 2021 | BLOG

Despite being something old, from the 1990s, few people know how pass-the-hash attacks work.

Keep reading the article to find out!

Where Did the Name “Pass-the-hash” Come From?

Pass-the-hash attacks occur when an attacker steals a user’s credential with a hash function.

Without “breaking” this function, the attacker reuses it to trick an authentication system into creating a new authenticated session on the same network.

For those who are not aware of it, a hash function is any algorithm that maps large, variable-sized data to small, fixed-sized data.

Hash functions are widely used in order to verify the integrity of downloads, search for elements in databases, or transmit and store passwords.

Hence the “pass-the-hash” name, which literally means this—exactly what attackers do through this attack.

How Are Pass-the-hash Attacks in Information Technology Classified?

Pass-the-hash attacks are primarily a lateral movement technique.

This means hackers are using the hash to extract additional information and credentials after they have already compromised a device.

By moving “sideways” between devices and accounts, attackers can “pass the hash” to get all the correct credentials from someone else.

With this, they can eventually “scale up” their domain privileges and access more influential systems, like an administrator account on their personal computer, without even needing their password.

Another interesting fact is that most of the movement performed during a pass-the-hash attack uses a remote software program, such as malware.

What Operating Systems Do Pass-the-hash Attacks Work On?

Typically, pass-the-hash attacks target Windows systems.

However, they can also work against other operating systems, in some cases on any authentication protocol such as Kerberos.

Windows is especially vulnerable to these attacks because of its single sign-on function.

This function allows users who, by entering the password only once, can access all the features they want.

The single sign-on function also requires users’ credentials to be cached on the system, making it easier for attackers to access.

That is one of the reasons why it is so important to know the 7 Tips to Prevent Cyberattacks While Remote Working.

How Do Pass-the-hash Attacks Work?

To perform a pass-the-hash attack, the attacker first obtains the hashes of the targeted system using any number of hash dump tools, such as fgdump and pwdump7.

The attacker then uses these tools to place the obtained hashes into a Local Security Authority Subsystem Service (LSASS).

Pass-the-hash attacks are often targeted at Windows machines due to the security vulnerability of NTLM (New Technology Local Area Network Manager) hashes once administrator privileges have been obtained.

These attacks often trick a Windows-based authentication system into “believing” that the attacker’s endpoint is the legitimate user’s endpoint.

Thus, the system automatically supplies the necessary credentials when the attacker tries to access the targeted system.

And all this can be done, as already said, without the need for the original password.

The key used by attackers to perform these types of attacks is the NTLM hash, which is nothing more than fixed-length mathematical codes derived from passwords.

NTLM hashes allow the attacker to use compromised domain accounts without extracting the password in plain text.

This is because computer operating systems such as Windows never actually send or save user passwords on their network.

Instead, these systems store passwords as encrypted NTLM hashes, which represent the password, but cannot be reverse-engineered.

NTLM hashes can still be used in place of a password to access various accounts and resources on the network.

For an attacker to be able to access LSASS, they must successfully compromise a computer to the point where the malware can run with local administrator rights.

Therefore, this is one of the biggest obstacles to pass-the-hash attacks. And knowing how to securely control your privileged accounts with PEDM is another big obstacle, too.

Once a Windows-based machine is compromised and the deployed malware is given access to local usernames and NTLM hashes, do you know what happens?

The attacker can even choose whether to get more credentials or try to access network resources using privileged user credentials.

By gathering more user credentials, an attacker can retrieve the credentials of users who have separate accounts on the Windows machine, such as a service account, or who still have remote access to the computer with an administrator login, for example.

Remote information technology (IT) administrators connecting to the compromised Windows machine will expose their NTLM username and hash to the now-integrated malware.

An attacker with IT administrator credentials can then move “sideways” across networked devices.

The “lateral movement” is an effective way to search for users with elevated privileges, such as administrative rights to protected resources.

Privilege escalation can be achieved by locating the credentials of an administrator with greater administrative access.

These elevated features can also include access to customer databases and email servers.

What Can Pass-the-hash Attacks Do to My Computer?

Because this type of attack exploits the features and capabilities of the NTLM protocol, the threat can never be completely eliminated.

Once an attacker compromises a computer, pass-the-hash becomes just one of the malicious activities that can be performed.

A 2019 study found that 95% of its 1,000 respondents experienced a direct business effect from pass-the-hash in their organizations.

About 40% of these attacks resulted in lost revenue and 70% incurred increased operational costs.

No wonder that many IT experts consider pass-the-hash attacks to be among the top cybersecurity vulnerabilities in Industry 4.0.

Are you enjoying this post? Join our Newsletter!

14 + 2 =

We will send newsletters and promotional emails. By entering my data, I agree to the Privacy Policy and the Terms of Use.

 

How to Avoid Pass-the-hash Attacks?

Unfortunately, there are many ways for hackers to remotely compromise a computer, and they are constantly evolving.

For this reason, cybersecurity measures will never be 100% effective, which is why multiple mitigation techniques are often used at the same time.

Recognizing that even knowing how pass-the-hash attacks work cannot prevent them all, companies can try to improve their detection strategies as well as their prevention measures.

Workstation logs are one of the most common ways to reliably monitor administrative activities.

These logs can track privilege assignments as well as successful login attempts.

Target server logs and domain controller logs are useful for the same reasons.

To mitigate the threat of pass-the-hash attacks, organizations must also ensure that domain controllers can only be accessed from trusted systems without Internet access.

Two-factor authentication using tokens should also be applied, as well as the principle of least privilege — in that sense, adopting Zero Standing Privileges (ZSP) is an option.

Organizations must closely monitor hosts and traffic on their networks for suspicious activity.

Request a free demo of cybersecurity services right now and stay protected from these types of threats!

—

Source:

https://www.guiadoti.com/2018/04/entendendo-o-ataque-pass-the-hash-ntlm/

https://docs.microsoft.com/pt-br/defender-for-identity/lateral-movement-alerts

← Windows Print Spooler Failure: Why Should I Upgrade Immediately? Ransomware Attack: Should I pay it or not? →

Just-In-Time Privileged Access: Understand this Subject

In this article, we present the concept of just-in-time privileged access, its benefits, and mode of operation, among other extremely important information on the subject. To facilitate your reading, we divided our text into topics. They are: What Is Just-In-Time...
Read More

What are the actions performed during a privileged access

Nowadays, cyber-attacks have become increasingly common and hit more and more companies, of all verticals and sizes. According to the SonicWall 2022 Cyber Threat report, the number of cyberattacks involving data encryption increased by 167% in 2021, reaching 10.4...
Read More

Achieving Sarbanes-Oxley (SOX) Compliance Using Cybersecurity Controls

The Sarbanes-Oxley Act (SOX) is primarily associated with business transparency and the use of accounting and financial controls to protect investors from fraudulent financial reporting. However, it is always important to remember the ever-increasing pivotal role...
Read More

Privileged Access Management (PAM): A Complete Guide

In 2021, there was a 50% increase in the number of attacks on corporate networks compared to the previous year. This is pointed out by Check Point Research (CPR), Check Point's Threat Intelligence division. And many of these attacks involve exploiting this type of...
Read More

What Is the Risk of Hardcoded Passwords For Your Business?

Today's organizations rely on numerous business applications, web services, and custom software solutions to meet business communications and other transaction requirements. Typically, multiple applications frequently require access to databases and other applications...
Read More

Share This!

Copyright 2022 senhasegura | All Rights Reserved | Powered by MT4 Group
By continuing to use this website, you consent to our use of cookies. For more information, please read our cookie policy.AcceptRead Our Privacy and Cookie Statement
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT
Copy link
CopyCopied
Powered by Social Snap