I think many of us are aware of the term “Pass The Hash” attack. Some of us might have also heard that protocols like Remote Desktop Protocol are susceptible to attacks like Pass The Hash attack. Let’s understand in more detail what this attack is and how we can prevent it.

What is the pass-the-hash attack?

A pass-the-hash attack is an attack in which the attacker hacks a user’s password and breaks into the server or service to steal data or do other malicious activities.

Normally, a user needs to provide his password for authentication. The password is converted into a hash value using some popular hash algorithm, and then the computed hash value is matched with the hashed value already stored on the server. Users’ passwords are never stored or sent in cleartext format over the wire. Cleartext passwords are never required to complete authentication for a user. Attackers take advantage of that in the Pass the Hash attack.

If an attacker can harvest hash values of passwords and use them to impersonate a user, he can break into the server. In the pass-the-hash attack, the attacker uses this mechanism. In this attack, the attacker uses LM or NTLM authentication instead of using some brute force mechanism to obtain the cleartext password from its hash value.

What is the LM or the NTLM authentication?

LM Hash, LanMan Hash, or Lan Manager Hash is a compromised hash function that was once the primary hash function for Microsoft Lan Manager or Microsoft Windows version prior to NT. Support for this protocol continued in later versions of Windows for backward compatibility, but it was recommended by Microsoft to turn off the protocol. In Windows Vista, the protocol is disabled by default, but in some non-Microsoft CIFS implementations, it continues to be used.

NTLM or NT Lan Manager is the successor for Lan Manager. NTLM is widely deployed even on newer systems to maintain compatibility with older systems. However, Microsoft no longer recommends NTLM in applications. (How does the NTLM authentication work?)

How is the LM Hash computed?

The LM hash is computed using the methods given below:

  • A user gives a password that is restricted to fourteen characters.
  • The user’s password is converted into uppercase.
  • The password is encoded in the System OEM code page.
  • The password is null padded to 14 bytes.
  • The 14-byte null padded password is halved into two 7 bytes.
  • Each 7-byte value is used to generate a DES key of 64 bits. Here, one null bit is inserted after every 7 bits, thus generating 64 bits. The null bits are later discarded. Two DES keys are generated from these two 7-byte halves.
  • Two DES keys thus generated are used to encrypt a constant key “KGS!@#$%”, thus forming two 8-byte ciphertexts.
  • These two ciphertexts are concatenated to obtain the 16-byte LM Hash.

How is the pass-the-hash attack perpetrated?

Facebooktwitterredditpinterestlinkedinmail

Calculate the pseudoinverse of a matrix using Python

What is the pseudoinverse of a matrix? We know that if A is a square matrix with full rank, then A-1 is said to be the inverse of A if the following condition holds: $latex AA^{-1}=A^{-1}A=I $ The pseudoinverse or the Moore-Penrose inverse of a matrix is a...

Cholesky decomposition using Python

What is Cholesky decomposition? A square matrix A is said to have Cholesky decomposition if it can be written as a product of a lower triangular matrix and its conjugate transpose. $latex A=LL^{*} $ If all the entries of A are real numbers, then the conjugate...

Tensor Hadamard Product using Python

In one of our previous articles, we already discussed what the Hadamard product in linear algebra is. We discussed that if A and B are two matrices of size mxn, then the Hadamard product of A and B is another mxn matrix C such that: $latex H_{i,j}=A_{i,j} \times...

Perform tensor addition and subtraction using Python

We can use numpy nd-array to create a tensor in Python. We can use the following Python code to perform tensor addition and subtraction. import numpy A = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) B = numpy.random.randint(low=1, high=10, size=(3, 3, 3)) C =...

How to create a tensor using Python?

What is a tensor? A tensor is a generalization of vectors and matrices. It is easily understood as a multidimensional array. For example, in machine learning, we can organize data in an m-way array and refer it as a data tensor. Data related to images, sounds, movies,...

How to combine NumPy arrays using horizontal stack?

We can use the hstack() function from the numpy module to combine two or more NumPy arrays horizontally. For example, we can use the following Python code to combine three NumPy arrays horizontally. import numpy A = numpy.array([[1, 2, 3], [4, 5, 6], [7, 8, 9]]) B =...

How to combine NumPy arrays using vertical stack?

Let’s say we have two or more NumPy arrays. We can combine these NumPy arrays vertically using the vstack() function from the numpy module. For example, we can use the following Python code to combine three NumPy arrays vertically. import numpy A = numpy.array([[1, 2,...

Singular Value Decomposition (SVD) using Python

What is Singular Value Decomposition (SVD)? Let A be an mxn rectangular matrix. Using Singular Value Decomposition (SVD), we can decompose the matrix A in the following way: $latex A_{m \times n}=U_{m \times m}S_{m \times n}V_{n \times n}^T $ Here, U is an mxm matrix....

Eigen decomposition of a square matrix using Python

Let A be a square matrix. Let’s say A has k eigenvalues λ1, λ2, ... λk. And the corresponding eigenvectors are X1, X2, ... Xk. $latex X_1=\begin{bmatrix} x_{11} \\ x_{21} \\ x_{31} \\ ... \\ x_{k1} \end{bmatrix} \\ X_2=\begin{bmatrix} x_{12} \\ x_{22} \\ x_{32} \\ ......

How to calculate eigenvalues and eigenvectors using Python?

In our previous article, we discussed what eigen values and eigenvectors of a square matrix are and how we can calculate the eigenvalues and eigenvectors of a square matrix mathematically. We discussed that if A is a square matrix, then $latex (A- \lambda I) \vec{u}=0...

Amrita Mitra

Author

Ms. Amrita Mitra is an author, who has authored the books “Cryptography And Public Key Infrastructure“, “Web Application Vulnerabilities And Prevention“, “A Guide To Cyber Security” and “Phishing: Detection, Analysis And Prevention“. She is also the founder of Asigosec Technologies, the company that owns The Security Buddy.

0 Comments

Submit a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Not a premium member yet?

Please follow the link below to buy The Security Buddy Premium Membership.

Featured Posts

Translate »