Security Digest (January 2025)

NTLM (NT LAN Manager) is an authentication protocol developed by Microsoft in the early 1990s. It has been widely used in Windows environments for securing access to network resources and verifying users’ identities. NTLM operates as a ‘challenge-response’ protocol, ensuring that passwords are never sent over the network in plain text.

How NTLM Works

At a high level, NTLM authentication involves the following steps:

• User Authentication Request:
• • When you try to access a resource, the client (e.g., your computer) sends your username to the server. The server knows what your username and password are, and will now ‘challenge’ you to prove your identity.
• Challenge Issued:
  • The server responds with a random number (called a “challenge”).
• Password Hash Response:
  • Your computer uses the challenge and your password to generate a ‘value’ (or a ‘hash’, via a cryptographic function) and sends this response to the server. This value is derived from performing a function of your password and the challenge value sent by the server. The server (which knows your password) will also perform the same function of your password and the challenge value.
• Verification:
  • The server will compare the client’s response with its own calculation. If the values match, authentication succeeds.

This is a critical means of communication and authentication between devices, because the client’s password is never sent directly to or from the server. This eliminates the risk of an intruder listening ‘on the wire’ to intercept passwords.

Despite being an older protocol, NTLM remains in use today for several reasons:

• Backward Compatibility: Many legacy systems and applications still rely on NTLM for authentication.
• Fallback Mechanism: NTLM often acts as a fallback when Kerberos (a more secure protocol) isn’t available.
• Ease of Use: In small or isolated networks, NTLM may be simpler to configure.

While NTLM was effective in its time, modern attackers have developed many ways to exploit its weaknesses. The most common of which is called an NTLM Relay Attack.

The purpose of relay attacks is to redirect authentication from one source to another. An attacker can trick a system (Device A) into authenticating to an attacker-owned machine. Thus, the attacker can relay that authentication to a target system (Device B) and harness (or ‘pass’) the valid credentials to use them on an unintended system.
Though NTLM has undergone upgrades since its LAN Manager origins through NTLMv1 and NTLMv2, these upgrades primarily focused on increased challenge length and tougher hashing algorithms. Inherent design flaws of the challenge-response mechanism are still exploitable with a sophisticated attacker.

In this month’s Patch Tuesday, Microsoft revealed details about a critical vulnerability affecting NTLMv1. CVE-2025-21311 has a CVSS Score of 9.8 out of a possible 10. Most notably, the Attack Vector for this vulnerability is ‘Network’ (meaning the attack can be executed over the internet) the Attack Complexity is ‘Low’ (meaning an attacker does not require significant prior knowledge of the system), and the Privileges required is ‘None’ (meaning the attacker does not need an account associated with the targeted environment).

In the interest of protecting end users, Microsoft has not disclosed details on the exploitation process for this vulnerability. Microsoft has also reported this exploitation has not yet been seen in the wild.

Addressing Inherent Flaws With Kerberos

Kerberos is an authentication protocol developed to address concerns with NTLM. Named after Cerberus, the three-headed dog that guards the entrance to the underworld, Kerberos boasts several new features to secure authentication between local devices.

How Does Kerberos Work?

Logging In (Authentication Request)

• When you log into your computer, your credentials (username and password) are sent to the Authentication Server (AS), which checks if you’re in the Kerberos database.

Receiving a Ticket-Granting Ticket (TGT)

• If your credentials are valid, the AS generates a Ticket-Granting Ticket (TGT) and a temporary encryption key (called a session key).

• The TGT proves your identity and is encrypted, so it’s secure even if intercepted.

Storing the TGT Locally

• Your computer stores the TGT, so you don’t need to keep entering your password when accessing resources.

Requesting Access to a Resource

• When you need to access a network resource (e.g., a shared file or application), your system sends the TGT and a request to the Ticket Granting Server (TGS).

Receiving a Service Ticket

• The TGS validates your TGT, checks your permissions for the requested resource, and issues a Service Ticket.
• The Service Ticket is encrypted and specific to the resource you’re trying to access.

Accessing the Resource

• Your computer sends the Service Ticket to the resource (e.g., a server).
• The server decrypts the ticket, verifies it, and grants access if everything is correct.

Kerberos includes several key advantages over NTLM, including:

Single Sign-On (SSO): Once you log in, you don’t need to re-enter your credentials for each resource.

Encryption: All communication, including tickets, is encrypted to prevent unauthorized access.

Mutual Authentication: Both the user and the server validate each other, reducing the risk of fake servers (man-in-the-middle attacks).

Time Sensitivity: Tickets are time-limited to prevent replay attacks (reusing old tickets to gain unauthorized access).

However, these benefits do not come without key drawbacks:

Management: Configuring and managing a Kerberos environment can be challenging. It requires a dedicated Key Distribution Center (KDC) and careful planning of user and service principals.

Time Synchronization: Kerberos relies on all systems being synchronized within a small time window (typically 5 minutes by default). This is critical to prevent replay attacks, but can break all authentication trust with slight time inconsistencies.

Single Point Of Failure: The Key Distribution Center (KDC) is critical to Kerberos’ operation. If the KDC becomes unavailable, authentication across the entire network can stop functioning.

The journey from NTLM to Kerberos highlights a broader trend in technology: the continuous evolution of protocols to meet growing security, scalability, and usability demands. While NTLM served its purpose in simpler network environments, its limitations became increasingly evident as threats evolved and networks expanded. Kerberos stepped in as a more secure, efficient, and scalable solution, addressing many of NTLM’s shortcomings.

The phasing out of older protocols is not just a story of obsolescence but of progress—an ongoing effort to stay one step ahead in an ever-evolving cybersecurity landscape.