Security News > 2021 > July > Microsoft warns of credential-stealing NTLM relay attacks against Windows domain controllers
To ward off the attack known as PetitPotam, Microsoft advises you to disable NTLM authentication on your Windows domain controller.
Microsoft is sounding an alert about a threat against Windows domain controllers that would allow attackers to capture NTLM credentials and certificates.
Dubbed a classic NTLM relay attack by Microsoft, the process works by abusing a Windows protocol known as MS-EFSRPC, which lets computers work with encrypted data on remote systems, The Record said.
As previously described in a Microsoft support document from 2009, NTLM relay attacks have been around for a number of years.
In a support document, Microsoft explained that your organization is potentially vulnerable to PetitPotam if NTLM authentication is enabled on your domain and you use Active Directory Certificate Services with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.
"To prevent NTLM Relay Attacks on networks with NTLM enabled, domain administrators must ensure that services that permit NTLM authentication make use of protections such as Extended Protection for Authentication or signing features such as SMB signing," Microsoft said.
News URL
Related news
- Exploit released for new Windows Server "WinReg" NTLM Relay attack (source)
- Windows Themes zero-day bug exposes users to NTLM credential theft (source)
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)
- Microsoft Identifies Storm-0501 as Major Threat in Hybrid Cloud Ransomware Attacks (source)
- Microsoft: Windows Recall now can be removed, is more secure (source)
- Recall the Recall recall? Microsoft thinks it can make that Windows feature palatable (source)
- JPCERT shares Windows Event Log tips to detect ransomware attacks (source)
- Free Sniper Dz Phishing Tools Fuel 140,000+ Cyber Attacks Targeting User Credentials (source)
- Microsoft fixes Windows KB5043145 reboot loops, USB and Bluetooth issues (source)
- What Is Inside Microsoft’s Major Windows 11 Update? (source)