Windows Passwords Everything You Need To Know.ppt

Windows Passwords: Everything You Need To Know Overview How passwords are stored How passwords are used How passwords are attacked Password best practices In the beginning… Password Representations LM “hashes” Old technology used on LAN Manager NT hashes A.k.a., Unicode password or MD4 hash Used for authentication on more recent Windows systems Cached credentials Derivation of NT hash Stored User Names and Passwords Calling application decides on representation LM “Hash” Generation Padded with NULL to 14 characters Converted to upper case Separated into two 7 character strings LM “Hash” Considerations It’s not a hash Limited character set Common alphanumeric set only Case insensitive 142 symbols Padded to exactly 14 characters Actually two seven-character passwords Maximum number of passwords ≈ 6.8*1012 Unsalted… Salting Prevents deriving passwords from password file Stored representation differs Side effect: defeats pre-computed hash attacks NT Hash Generation Hash the password Store it NT Hash Considerations Case preserving 65,535 symbols Maximum length = 127 characters Number of ≤14-character passwords, same char set as LM hash ≈ 4.6*1025 Number of ≤14-character password (full char set) ≈ 2.7*1067 Number of 127-character passwords ≈ 4.9*10611 Unsalted Cached Credentials Generation Stored at logon Managed by LSA Hash of a hash Stored User Names And Passwords Credential Manager Stores specific password-based credentials locally Applications can leverage for password storage Uses DPAPI for storage Authentication (authn) Winlogon passes the authn information to LSASS LSASS determines the authn package Local or remote login? If remote Kerberos MSV1_0 NTLMv2, NTLM, LM The chosen package generates authn data NTLM And LM Authentication On The Wire NTLMv2 Authentication On The Wire LMCompatibilityLevel Kerberos Authentication Authenticates access to domain resources by domain members Uses different operations than NTLM Sensitive data is better protected from eavesdro