Ever imagined sneaking into like a high security event with a fake ticket?
Oh, yeah.
That's kind of what we're talking about today.
Oh, wow.
We're going deep into Kerberos exploitation attacks.
Yeah, that's a pretty good analogy, actually.
Because Kerberos is basically like the gatekeeper to all the valuable resources on a network.
So it makes sure that only the right people are getting in.
Yeah, like a digital bouncer, you could say.
OK, got it.
But why are we so worried about people exploiting it?
Well, if you can trick Kerberos,
then you can get access to all sorts of sensitive data.
You can maybe control critical systems, cause all kinds of havoc.
So naturally, a lot of attackers are trying to find ways to get past it.
That's scary.
And I heard that our guide for this deep dive is the work of Krishna Kumar Mahadev,
also known as MKK.
That's right.
And he's a cybersecurity legend with over 28 years of experience.
MKK, yeah.
He's been in the trenches of cybersecurity for decades.
And this document he wrote on Kerberos attacks is like a gold mine.
Wow.
OK, let's get into it.
So first, can you just give us a little crash course on how Kerberos actually works?
I'm a little fuzzy on the details.
Sure.
So at its core, Kerberos is basically a system for verifying identities
and then granting access to different resources on a network.
So you can think of it as like a three-way handshake.
A three-way handshake.
Between the user, the resource they want access.
Yeah.
And then a trusted third party that's called the Key Distribution Center,
or KDC for short.
It sounds more like a digital dance than a security system.
Yeah, it might sound kind of complicated at first,
but it's actually pretty elegant once you break it down.
So let's say you want to access a file server on your company's network.
You send a request to the KDC and you're basically saying,
hey, it's me.
I want to access this file server.
So you're proving your identity to the KDC.
Right.
And here's where the ticket part comes in.
The KDC will verify your identity.
And then it issues you what's called a ticket granting ticket or a TGT.
Think of it like your temporary ID card.
It doesn't give you access to the file server directly,
but it proves that you're a legitimate user.
Oh, so it's kind of like getting pre-approved.
Exactly.
And then with your TGT, you can request access to the specific resource,
in this case, the file server.
You present your TGT to the server and the server,
because it trusts the KDC, will then grant you access.
So it's kind of like a backstage pass that lets you request access
to different things.
Yeah, that's a great way to put it.
And what's really cool about this system
is that your actual password never travels across the network.
Everything is encrypted and authenticated using special keys.
So it makes it way more secure than traditional password-based authentication.
OK, that's starting to make sense.
I can see why it's so widely used,
especially in these bigger enterprise environments.
Which, speaking of enterprise, I know Kerberos has used a lot
in Microsoft Active Directory, right?
Absolutely.
Active Directory is like a core component of a lot of corporate networks.
And it really relies on Kerberos for authentication and authorization.
So if you've ever worked in like a corporate environment,
you've probably interacted with Kerberos without even realizing it.
Wow, that's fascinating.
OK, so now let's get back to the dark side.
Those Kerberos exploitation attacks.
Knowing now how Kerberos works, how do these attackers actually bypass it?
Well, they've come up with a whole bunch of different techniques.
And each of them targets different vulnerabilities within the Kerberos system.
One common way is just to try to exploit weaknesses in password security.
Like using brute force attacks to crack user credentials.
Ah, good old brute force.
So they just keep guessing passwords until they find one that works.
Exactly.
There are even tools like Kerroot.py and Rubyus
that are made specifically to target Kerberos SDE systems
and they just systematically guess passwords until they get in.
Oh, wow.
So strong and unique passwords are super important.
What else do they do?
Another thing they do is something called overpass the hash or PTH for short.
This one is interesting because it actually targets a common security measure,
which is disabling NTLM.
NTLM, what was that again?
NTLM stands for NT LAN manager.
It's an older authentication protocol.
And it's known to be vulnerable to certain attacks.
So a lot of organizations disable it and they switch to more secure protocols like Kerberos.
OK, that makes sense.
So how does overpass the hash work with that?
Well, even when NTLM is disabled, systems often still create and store
what's called an NTLM hash of the user's password.
And attackers can take advantage of this by getting a hold of that hash
and then they can use it to request a TGT from the QCC.
Wait, so they're not cracking the password?
Nope.
They're just using the hash as a substitute?
Exactly.
And because the KDC doesn't necessarily know that NTLM has been disabled,
it might just grant the TGT based on the hash alone.
So it's like they're sneaking in through a back door even though the front door is locked?
Perfect analogy.
And that's what makes PTH so dangerous.
It bypasses a security measure that a lot of organizations rely on.
Wow, that's sneaky.
What other tricks do they have?
Another one is called pass the ticket or PTT.
And this involves actually stealing legitimate tickets from memory
and then reusing those tickets to impersonate a legitimate user.
So it's literally like snatching someone's concert ticket and sneaking into the show?
Exactly.
But instead of missing a concert, the consequences here could be much worse.
Imagine an attacker gets access to like your CEO's account.
Oh my gosh.
Okay, so that one's pretty straightforward.
Now we also have silver ticket and golden ticket attacks.
Are these some kind of VIP access?
You could say that.
Let's start with the silver ticket.
You can think of it like a forged ticket to access a specific service on the network.
Attackers create these by using a compromised service account's hash.
So it's more targeted but still really powerful.
What kind of services are we talking about here?
It could be anything from file servers to email servers, even databases.
It really just depends on the service that's being targeted
and the level of access that the compromised account has.
Yeah, and the impact could be huge if it's a really important service.
What about the golden ticket, the holy grail?
The golden ticket.
That grants like unrestricted access to the entire network.
It's like having the master key to every door.
Attackers can create these using the KRBTGT account's hash.
KRBTGT, what is that? Some Lord of the Rings thing?
It might sound like it, but it's actually a real account.
A very important account in the Kerberos world.
The KRBTGT account is basically like the master key holder.
It's the ultimate authority for issuing all the tickets.
Wow, so if they have a golden ticket, they can access anything.
Pretty much.
How is that even possible?
Well, it comes down to that hash.
If an attacker can compromise the KRBTGT account
and they get its hash, they can forge any ticket they want.
And because the KRBTGT password doesn't change very often,
this access can last for a really long time.
That's like a nightmare for a network admin.
Yeah, it is.
Like a ghost in the system that can get into anything.
And what's even worse is these ticket-based attacks are really hard to detect.
Because they're using tickets that look totally legitimate.
So it's really hard for security systems to figure out that they're forged.
So we've got brute force overpass the hash pass, the take the silver ticket,
and the dreaded golden ticket.
That's a lot of tricks.
What else?
There are a couple more that we haven't talked about yet.
One is called ASREP Roasting.
And it goes after the lack of something called pre-authentication.
That happens in some Kerberos setups.
Okay, before we go any further, I want to make sure that we're all on the same page here.
What is pre-authentication?
You can think of pre-authentication as like an extra layer of security, like at the front door.
It requires users to prove who they are before they even get a ticket from the KDC.
It's like a challenge response system where the user has to give some specific information that only they should know.
So without pre-authentication, it's easier for those attackers to impersonate users.
Exactly.
They can send authentication requests to the KDC.
And if pre-authentication isn't turned on, they can use the response they get back to try and crack the user's password offline.
That's like leaving the key under the door map.
Yeah, pretty much.
Enabling pre-authentication is a really simple but effective way to make it a lot harder for attackers to exploit that vulnerability.
Right. Always lock your doors.
Yeah.
Okay, what about that last technique you mentioned?
The last one is called Kerberoasting.
And it targets service accounts, which usually have elevated privileges on the network.
Service accounts, those are the ones that are used by applications and services, right?
Right. Not actual human users.
Okay.
These accounts are used to manage different tasks and services on the network.
And they typically have more permissions than a regular user account.
Kerberoasting involves gathering encrypted TGS tickets, those are the ones that we talked about earlier,
that give access to specific services, and then they try to crack them offline.
So it's a slower attack?
Yeah.
But it could be really rewarding for attackers if they can crack those service account credentials.
Exactly.
And it's interesting because each of these attacks targets a different part of the Kerberos system.
Some focus on taking advantage of weak passwords, while others go after vulnerabilities in the whole ticket granting process.
So they're basically looking for any weak point.
That's a good way to put it.
That's why it's so important to have a multi-layered security approach when it comes to Kerberos.
Absolutely.
Now, thinking about your own work environment, what are some of the key things we've talked about that stand out to you as either really relevant or concerning?
That's a really good question.
It's easy to get kind of lost in all the technical details, but it's important to stop and think about how these vulnerabilities could be exploited in a real scenario,
especially in your own environment.
Exactly.
So now let's switch gears a little bit and talk about what we can actually do about these threats.
Knowing about the enemy is one thing, but defending ourselves is a whole other story.
You're absolutely right.
Knowledge is power, but action is key.
And luckily, there are a lot of really effective ways to reduce these Kerberos risks,
like we were saying before, strong password security is like the foundation.
Right. Brute forcing those passwords seems to be one of the first things the attackers try.
So what are some of the best practices for making those passwords really strong?
It starts with the basics.
Enforcing strong password policies, making sure that passwords are long enough that they're complex,
that they include upper and lower case letters, numbers, and special characters.
Okay, so that's the usual advice.
Yeah. But beyond that, you need to make sure people are changing their passwords regularly.
And don't underestimate multi-factor authentication.
Adding that extra layer of verification makes it way harder for attackers to compromise accounts,
even if they do manage to get their hands on a password.
Right. It's like a double lock on your door.
But what about those ticket-based attacks?
Is there any way to actually stop someone from stealing or sorting those Kerberos tickets?
They seem like they're pretty hard to catch.
There are definitely ways to make it a lot harder for them.
One thing is to limit the ticket lifetime.
The shorter the lifespan of a ticket, the less useful it is to an attacker.
Oh, that makes sense. It's like an expiration date on access.
Exactly. If someone manages to steal a ticket, it's only going to be good for a short period of time.
Another thing you can do is restrict the privileges of those service accounts.
Remember how we talked about silver tickets and golden tickets?
Those usually rely on a compromised service account.
Right. The ones that have more access than regular users.
Exactly. So by limiting what those accounts can actually do and what resources they can access,
you're basically reducing the potential damage if an attacker does manage to compromise them.
It's like containing the blast radius.
That's a great way to think about it.
And of course, keeping all your systems patched and up-to-date is really important.
A lot of these attacks take advantage of known vulnerability.
Patching those holes is like locking your windows and doors.
Right. So it's a combination of good security hygiene, proactive measures,
and making the system itself stronger.
Exactly. And don't forget about monitoring.
You need to have systems in place to be able to detect any suspicious activity related to Kerberos.
Unusual longing attempts, failed authentications, ticket requests that are coming from weird places.
Those are all red flags that you need to look into.
It's not enough to just set up defenses. You have to actively watch what's going on
and make sure everything is working properly.
It's like having security cameras and guards patrolling the perimeter.
That's a great analogy. You need to be vigilant and proactive, always looking out for potential threats.
Now, I'm curious. From what you've seen, what's the biggest mistake that organizations make when it comes to Kerberos security?
Is there a common blind spot?
Today, the most common mistake is underestimating the importance of configuration and maintenance.
Kerberos can be pretty complicated, and it's easy to misconfigure things or to let security practices kind of slip over time,
but those small oversights can be exactly what attackers are hoping for.
Right. So it's not something you can just set up and forget about.
Nope.
You have to constantly stay on top of it and follow the best practices.
Security is a journey, not a destination.
You always have to be adapting and evolving your defenses to stay ahead of the bad guys.
Well said. Speaking of journeys, MKK himself has been on quite a journey in the cybersecurity world.
I'd love to hear more about him and his work.
Can you tell us a little bit about his background and his expertise?
Sure. Krishna Kumar Mahadevan, or MKK, as he's known in the community, is really a legend in the cybersecurity world.
He has over 28 years of experience.
He's consulted for so many organizations, helping them figure out cloud transformation and security.
He even wrote a whole book about Kerberos exploitation, which is actually where we're getting all this great information from.
Wow, that's amazing. He clearly knows what he's talking about.
And I understand he's a big advocate for sharing knowledge and helping other people learn about cybersecurity.
Absolutely. He really believes that the more people understand these threats, the better we'll all be at protecting ourselves.
And we definitely support that mission.
So for any of our listeners who want to learn more about Kerberos attacks and how to protect themselves, what resources would you recommend?
Well, MKK's book is definitely a must read for anyone who wants to really dive deep into Kerberos security.
He also has a fantastic website, mkkpro.com, where he shares tons of information on all sorts of cybersecurity topics.
And don't forget MITREATT and CK. It's a knowledge base of all these different adversary tactics and techniques.
And they have a whole section on Kerberos exploitation.
It's a great way to see real world examples of how these attacks are actually being used.
That's right. MITOE, ATT and CK is a fantastic resource for understanding the tactics and techniques that real attackers are using.
It can really help you understand the connection between the technical details and the impact of these attacks.
Awesome. The more you know, the better prepared you'll be to defend your own systems.
But before we move on, I have a thought-provoking question for our listeners.
If you were an attacker, which Kerberos exploit would you be most likely to use and why?
Put yourself in their shoes for a minute.
That's a great question. It really makes you think like an attacker.
And consider which vulnerabilities would be most appealing.
Exactly. It helps you understand their motivations and their tactics.
And hopefully it encourages you to strengthen your own defenses.
Now, that's a valuable takeaway.
So we've explored the world of Kerberos exploitation.
We've tried to understand how the attackers think, and we've learned some ways to make our system stronger.
But before we wrap up, I want to take a moment to appreciate how complex this whole Kerberos system really is.
It really is an amazing protocol. Just think about it.
It's designed to securely authenticate users and grant access to resources across a huge network.
All while preventing things like eavesdropping and replay attacks.
It's a pretty remarkable feat of engineering.
Yeah, it is. And like any complex system, it has its vulnerabilities, which is what makes it so fascinating.
But also a little bit scary from a security perspective.
Definitely. And I think what's especially interesting about these attacks that we've been talking about
is that they really highlight different aspects of the Kerberos architecture.
Some of them, like pass the ticket or golden ticket, take advantage of the ticket granting process itself.
While others like ASREP roasting or Kerber roasting target the encryption and hashing mechanisms.
It's like the attackers are playing a game of chess, trying to outmaneuver the Kerberos system.
That's a great analogy.
And as defenders, we need to be thinking a few steps ahead,
anticipating what they might do and making sure our defenses are strong enough.
MKK talks a lot about the importance of understanding not just how these attacks work, but also WHY.
Why do you think that is?
Knowing the technical details is important.
But understanding the motivations and the goals behind these attacks can actually help us do a better job of predicting and preventing them.
Exactly. It's like profiling a criminal.
The more you know about how they think and what they're after, the better chance you have of stopping them.
Right. For example, if you understand why an attacker might go after a specific service account,
or why they might choose one type of attack over another, that can give you valuable insights into their strategy.
It's about connecting the dots and seeing the big picture.
And I think that's a really important takeaway for everyone listening.
Don't just get stuck on the technical details.
Try to understand what the attackers are trying to achieve and what methods they're likely to use.
It's all about thinking like the adversary.
Which can actually be a really helpful tool in your security toolkit.
So we were talking about how attackers are using these readily available tools.
Yeah, like Mimicat's Kerbute Rubius.
Exactly. And that anyone can download and use them.
Yeah. It's kind of scary how easy it is to get your hands on them.
Right. So it's not just nation-state hackers that we need to worry about anymore.
It could be anyone with a little bit of technical knowledge.
Pretty much anyone, yeah.
That's why it's so important for organizations of all sizes to be really serious about Kerberos security.
Don't just assume that it won't happen to you.
Right. No one is immune to these attacks.
Complacency is not going to fly in the cybersecurity world.
Definitely not.
Attackers will go after any weakness they can find.
It doesn't matter what industry you're in or how big your company is.
So it's not a matter of if you'll get targeted, it's WNN.
Yeah. That's the reality, unfortunately.
But the good news is that we have the tools and the knowledge to defend ourselves.
Love that. We're not powerless.
Nope. We've talked about so many different things.
Strengthening passwords, limiting ticket lifetimes, restricting privileges, hatching systems, monitoring everything closely.
Those are all things that we can do to make our networks more secure.
Absolutely. And one of the most important things you can do is just keep learning.
The threats are always changing.
So we have to stay ahead of the curve.
That's why resources like MKK's website, MITRE, ATT and CK, all these cybersecurity platforms, they're so valuable.
Yeah. They keep us up to date on the latest threats.
And they help us connect with other security professionals so we can all share knowledge and support each other.
Right. That community is so important.
Well, we've covered a lot of ground today.
Yeah.
But I think the big takeaway here is that we don't have to be afraid of these Kerberos attacks.
If we understand how they work and we take steps to protect ourselves, we can make it much harder for the attackers to succeed.
I agree. Knowledge is power and action is key.
That's a great way to put it.
Thanks for joining us on this deep dive into Kerberos exploitation.
Until next time, stay curious, stay vigilant and stay secure.