The Straight Dope on cracking Windows cached domain credentials

[Bricker]

@si_blakely

My understanding is that it does, but only for across the wire challenge/response authentication. The hash stored in the SAM is still NTLMv1 (MD4). NTLMv2 is hardened against sniffing (really only LanMan authentication was sniffable), but if you can get the SAM, you have something you can attack.

As with anything, physical access to the system in question gives you the ability to do pretty much what you want with it, unless you use full system encryption.

Si

A bigger concern would be the cached local credentials. If I can assume an attacker might gain admin access to a local PC that’s a domain member but not to the server, then I’d be more worried about what he can learn from stored cached domain credentials.

(Of course, he could use the hash by itself, via hash injection, but besides that…)

[si_blakely]

@Bricker

A bigger concern would be the cached local credentials. If I can assume an attacker might gain admin access to a local PC that’s a domain member but not to the server, then I’d be more worried about what he can learn from stored cached domain credentials.

I agree. Particularly for laptops that travel. I actually have a soft spot for well implemented hardware disk encryption (preferably two-factor), but software disk encryption can be good, too. It is just a shame that TrueCrypt does not do multi-user authentication. However, it would not be such a problem if Microsoft broke with NTLM and modified the stored hash format to include salt.

Si