Security News > 2021 > July > Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC
Microsoft was quick to respond with a fix to an attack dubbed "PetitPotam" that could force remote Windows systems to reveal password hashes that could then be easily cracked.
The PetitPotam PoC is a form of manipulator-in-the-middle attack against Microsoft's NTLM authentication system.
According to Lionel, this similar scenario can be played out with a PetitPotam attack.
He demonstrated how a PetitPotam attack can be chained to an exploit targeting Windows Active Directory Certificate Services, which provides public key infrastructure functionality.
"To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication or signing features such as SMB signing," wrote Microsoft.
Microsoft also added that companies are vulnerable to a PetitPotam attack if NTLM authentication is enabled in their domains and/or they're using AD CS with the services "Certificate Authority Web Enrollment" and "Certificate Enrollment Web Service."
News URL
https://threatpost.com/microsoft-petitpotam-poc/168163/
Related news
- DOJ, Microsoft seize 107 domains used in Russia's Star Blizzard phishing attacks (source)
- Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (source)
- Microsoft issues 117 patches – some for flaws already under attack (source)
- Microsoft Detects Growing Use of File Hosting Services in Business Email Compromise Attacks (source)
- Microsoft: Ransomware Attacks Growing More Dangerous, Complex (source)
- VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware (source)
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)