Releasing rainbow tables to accelerate Net-NTLMv1 protocol deprecation

https://cloud.google.com/blog/topics/threat-intelligence/net-ntlmv1-deprecation-rainbow-tables

by linolevan • 6 months ago

162 89 6 months ago

cloud.google.com

ubuntulover2011• 6 months ago

pretty cool

postepowanieadm• 6 months ago

Can't wait for someone to decide one of protocols used by google needs to be deprecated.

bawolff3• 6 months ago

Plenty of protocols used by google over the years have been deprecated. The difference being that google actually stops using insecure protocols when they are discovered to be insecure instead of trying to sweep things under the rug.

Keep in mind we are talking about a protocol from 1987. How many protocols from 1987 is google currently using?

schmuckonwheels4• 6 months ago

Google does whatever is convenient and makes them money. Altruism was never part of the equation.

Retr0id2• 6 months ago

Well, you'll be waiting 20 years or so post-deprecation if you want an equivalent timeline.

schmuckonwheels4• 6 months ago

Google thrives on being the Internet's biggest bully.

It turns out when nerds get a billion dollars they like being bullies too.

RobotToaster2• 6 months ago

Google does that every Tuesday

aunty_helen• 6 months ago

under 12 hours using consumer hardware costing less than $600 USD

Great, so someone with half a motherboard can break this hash

RobotToaster2• 6 months ago

Or 1gb of ram, but not both

schmuckonwheels4• 6 months ago

"To demonstrate how crappy most front door locks are, to boost our company's social media cred we will be leaving drills and a dish of bump keys at the entrance of the neighborhood."

bigfatkitten4• 6 months ago

NTLMv1 rainbow tables have been available for 15-20 years. The only thing new is that Google are publishing theirs.

coopreme4• 6 months ago

NTLM is often used for more of the underlying technologies, some more secure than others… nthash, net-ntlmv1, net-ntlmv2. There’s a little more complexity here and this is different than the stuff that was out 15 years ago

reincarnate0x144• 6 months ago

You're not wrong, I just want to point out this is net-lmvm1, which is different and more complex. Not functionally meaningfully more complex to an adversary with a few hundred USD (almost typed LSD) in monies. But technically larger tables. That being said I'm in agreement that this has been known problem for 10+ years, and Google is just saying the horses are so long out of the barn their grandchildren are grazing.

throawayonthe• 6 months ago

you say that like it's a negative analogy

kstrauser• 6 months ago

The bad guys already know you live in a bad neighborhood and have been closing your front door with a plastic combination lock you got in a Happy Meal 40 years ago. They can already come and go at a whim. This is Google letting you know that your crappy lock is pre-broken to encourage you to upgrade to literally anything else.

sequin• 6 months ago

It's certainly morally and legally dubious to facilitate attacks on things that others choose to use in within their own private domains, just because you disagree with that choice. But that's how these people roll.

reincarnate0x144• 6 months ago

It's been 15 years since this was known broken. If you had children when it was not known broken, they'd be almost old enough to drive in most western nations.

At some point the line must be drawn.

observationist• 6 months ago

This empowers script kiddies, but not significantly moreso than they already were. Of all the places this is still in use, they've been exposed for years, so this isn't likely to result in a a bunch of new exploitations.

However, it's most likely to be used by governments, with legacy servers that are finicky, with filesharing set up that's impacted other computers configured for compatibility, or legacy ancient network gear or printers.

I wonder who they're pushing around, and what the motivation is?

bigfatkitten4• 6 months ago

Mandiant is Google's incident response consulting business. Having worked for many years in that field myself (though not for Mandiant), they're probably sick of going to the same old engagements where companies have been getting owned the same way over and over again for the last 15 years.

What releases like this do is give IT ops people the ammunition they need to convince their leadership to actually spend some money on fixing systemic security problems.

alfiedotwtf• 6 months ago

Mandiant is Google's incident response consulting business

Consulting business? I was under the impression (from Google Reader) that if users aren’t in the millions, then they’ll kill the project. How could they also run a high-touch consultancy?!

they're probably sick of going to the same old engagements

Hmm… consultancies love this type of recurring revenue - it’s easy money

Retr0id2• 6 months ago

I suspect Mandiant hears a lot of "this is impractical to exploit so we don't care" from their clients. Now they have a compelling rebuttal to that.

freedomben• 6 months ago

It also empowers IT depts and cybersecurity people to be able to easily build a PoC to show why moving on from the deprecated protocol is important. In many white-hat jobs you can't just grab rainbow tables from a torrent, so a resource like this is helpful. For the grays and black hats, they've had access to rainbow tables like this for a very long time, so no change there.

Xirdus• 6 months ago

Out of curiosity, why can't white hats grab rainbow tables from torrents? Is it about seeding?

stackskipton• 6 months ago

Any business that needs convincing to move on from anything labeled NTLM does not care what "nerds" have to say. They are either one of those "I'm not spending money on something that works" or stuck with such legacy technical debt that at this point, removing it from environment is too costly to even consider so executives kick it down the road.

reincarnate0x144• 6 months ago

You've been able to find these for years. In fact it's entirely possible they just grabbed some or all of them out of an existing torrent originally.

It would completely not surprise me if there are automagic attacks on net-ntlmv1 at this point against some cloud hosted storage. This has been doable by anyone since like 2016 if you had the space and weren't prevented from using that protocol version.

TacticalCoder• 6 months ago

Holy smoke. I honestly thought the 90s called and wanted their Windows exploits back (TFA mentions 1999). I do remember talk about this from many moons ago.

But we are in two-thousand-twenty-FUCKING-six.

It's unbelievable. Just plain unbelievable.

1970-01-012• 6 months ago

They're just dumping them out as 2GB blobs onto a cloud? Where is the zippy search UI? Very lazy behavior for the hyper giant Google.

Nerada• 6 months ago

Right? I feel like rainbow tables for NTLM have been around for decades, though at-cost. This seems incredibly low effort on Google's part.

MadnessASAP• 6 months ago

They don't know how to count that low.

https://www.lesswrong.com/posts/koGbEwgbfst2wCbzG/i-don-t-kn...

bawolff3• 6 months ago

Why would you want a search UI for a rainbow table? That makes no sense.

1970-01-012• 6 months ago

That's the most likely use case for anyone. You want the one-offs when cracking, and not a compressed 2GB blob of data that may or may not have your answer.

B. The king of search has held the goal of organizing and making information useful and searchable since dinosaurs roamed the WWW.

https://www.google.com/intl/en_us/search/howsearchworks/our-...

C. It's just lazy and shows that they don't actually care anymore. Making a custom search has been their bread and butter for decades. The last step is the easiest but they could not be bothered.

bflesch• 6 months ago

I wonder how the Mandiant acquisition is regarded within google.

Was it a success? Is Mandiant a cash cow or was it basically an acquihire?

The big "contact mandiant" button next to the post feels a bit like trying to stay relevant and acquire more customers.

warkdarrior• 6 months ago

trying to stay relevant and acquire more customers

Is there any business that does NOT try to do this? Why wouldn't they?

Cantinflas• 6 months ago

Funeral service providers, for obvious reasons.

BrandoElFollito• 6 months ago

This is like reminding that there are CVSes from 2010. Yes there are. And there are plenty of vulnerable systems.

They decided to not fix the vulns (either directly by not patching, or indirectly by not investing in cybersecurity). So exploiting them is somehow an act of mercy. They may not know they have a problem and they have an opportunity to learn.

Let's just hope they will have white or gray-ish hats teaching the lesson

davidkellis• 6 months ago

Didn't l0phtcrack do this like 25 years ago?

rubyfan• 6 months ago

I actually got a job that long ago by using l0phtcrack to expose an admin password for an NT4 network.

coopreme4• 6 months ago

NTLM is not Net-NTLM- l0pht did ntlm

dbetteridge3• 6 months ago

I recall using ntlm rainbow tables to crack windows hashes in high school in like 2008?

Amazing that this is still around and causing someone enough of a headache to justify spending money on.

Also amazing what a teenager with lots of free time and a bootable Linux usb can get up to.

coopreme4• 6 months ago

LM, nthash aka NTLM, net-ntlmv1 aka ntlmv1, net-ntlmv2 aka NTLMv2. Challenge response stuff is different. Naming here is painful.

dbetteridge3• 6 months ago

Ah Microsoft and naming things... Name a better combo

But fair enough, I don't recall which exact version I was mucking with that long ago.

bri3d3• 6 months ago

net-ntlmv1 rainbow tables have been around forever too though, the same attack documented in this blog post has been hosted as a web service at https://crack.sh/netntlm/ for 10+ years

eerikkivistik• 6 months ago

There used to be a joint online project to compute these tables in a SETI like distributed system. Everyone who contributed their CPU cycles, could use the tables. And yeah, around 2005-2008.

rootsudo• 6 months ago

yep, that and also can use cain and abel even back then... hardest part was putting whatever network card in promiscious mode.

dbetteridge3• 6 months ago

Yes!! That was the software, thanks for the memory trigger

themafia• 6 months ago

And terrorism is just an abstract way of securing underprepared government facilities.

ruined• 6 months ago

if you think about it, the united states terrorism risk insurance act distorts the terrorism market by subsidizing terrorism-generating activity

https://home.treasury.gov/policy-issues/financial-markets-fi...

afn• 6 months ago

Tangent: this link looks like a right-wing propaganda site; I wouldn’t trust any information there without verifying it with trusted sources.

Thanks to the President’s decisive leadership in the face of radical left-wing obstructionism, the Department of the Treasury has now resumed normal operations.

Sytten• 6 months ago

Yeah that protocol is very very broken. I recently did an ntlm plugin implementation for Caido [1] and I had to fork our crypto JS module to add back MD4 and 3DES.

[1] https://github.com/caido-community/ntlm

archi42• 6 months ago

For those interested: The SHA512 file lists 4096 files. Each file is 2 GiB. That means 8 TiB (or about 8.6 TB) of storage required.

myself248• 6 months ago

Rule of thumb: Saturating 100Mbps moves roughly 1TB/day.

londons_explore2• 6 months ago

Really curious how this was discussed with the legal team...

"We're releasing hacking tools to allow others to break into poorly secured computer systems... But we are doing it with good intentions so it won't be illegal right??"

nkrisc• 6 months ago

Isn’t this more or less a case of “illegal numbers”?

rainonmoon2• 6 months ago

Yes. This is no more pernicious than releasing a multiplication table.

kotaKat• 6 months ago

"Educational use only", just like every other skiddie tool you can freely grab on the Internet these days.

(The bane of my existence thanks to everyone and their mother releasing ESP32 Wi-Fi/Bluetooth/etc deauther 'tools'...)

preisschild• 6 months ago

Maybe actually secure your network then :D

802.11w exists

darkamaul• 6 months ago

Second this.

I didn't expect Google (Mandiant) to release rainbow tables ever. Curious what changed internally to make that acceptable now.

nubskr• 6 months ago

Mandiant releases rainbow tables for a 25 year old broken protocol because enterprises still won't disable it. It seems like sometimes the best security tool is just making the risk impossible to ignore.

tialaramex2• 6 months ago

To be vulnerable to this, what sort of dumb things are end users doing?

I couldn't immediately figure out here whether we're talking

0. Microsoft's supported products default enable this worthless "authentication" feature

1. Microsoft's supported products provide such a feature behind a UI that's not clearly marked "Danger: Do not stare into laser with remaining eye"

2: Microsoft does still support this, behind some Registry nonsense most users do not understand and once enabled it doesn't turn on the "I am a toxic waste dump, leave by nearest exit" warning signs on affected machines

3: Microsoft doesn't support this at all but some 3rd party commercial stuff does and customers really do love their crusty archaic 3rd party garbage

4: But this long abandoned SCO machine we've kept on life support for twenty years!

5: What does "supported" mean? Windows NT is scary, we're still on Windows 98 here.

mr_mitm• 6 months ago

This is mostly an issue in active directory networks. Usually the reason people give as to why they still have this enabled is due to some legacy system that can't authenticate via Kerberos or at least NetNTLMv2. Worst case is if they then enable NetNTLMv1 on the domain controllers, even if the DC acts as a client. Using authentication coercion, this is a pretty quick win for an adversary.

tialaramex2• 6 months ago

Ok, so it's a 2 on my list.

Microsoft needs to make this forcibly change the UI so that users can see "Oh! I'm using crap low security Windows". That lights a fire under people to actually get it fixed.

nolok• 6 months ago

You have to actively go out of your way to have this enabled. But large or older companies always have some old machine (can be as dumb a an old but very expensive printer) that isn't updated.

Even today the only reason to use samba 2 in 90% of companies where it's enabled are old appliances.

At some point device X isn't working, employees complain, IT say they need to buy a new very expensive replacement and after much argumentation they come to the agreement to enable that legacy horror support until the purchase can be made. Which is then never made.

Releasing rainbow tables to accelerate Net-NTLMv1 protocol deprecation

Related Stories