Kerberos Authentication Spoofing: Don’t Bypass the Spec

guest · Aug 18, 2021

Kerberos Authentication Spoofing: Don’t Bypass the Spec
August 18, 2021
https://threatpost.com/kerberos-authentication-spoofing/168767/

Authentication is the front gate to security systems, so if you bypass it, you can pretty much do whatever you want. You can log in as an admin and change configurations, access protected resources and gain control of appliances to steal sensitive data from them.

For these reasons, the authentication protocols used by security systems must be flawless. But in security, there’s no such thing as a flawless system, and implementation errors can lead to hazardous security vulnerabilities.
Click to expand...

And that’s exactly what we discovered when analyzing four different security systems – Cisco ASA, F5 Big-IP, IBM QRadar and Palo Alto Networks PAN-OS. All were vulnerable to bypass exploits because of the way they implemented the Kerberos and LDAP authentication protocols.
Click to expand...

Poor Configuration Can Lead to Attack
The four security systems we mentioned earlier can be configured to use Kerberos without its SSO capabilities. Instead, the user is prompted for a username and password when logging in, and the system asks for the TGT.

The password is verified during the Authentication Service exchange, so that should be enough. This thought process sounds legit, only they forgot the first rule of fight club: Don’t deviate from the spec.
KDC Spoofing Attacks
In fact, this is not legit at all. Some would say it’s even illegitimate. Neglecting the Client/Server exchange can result in a KDC spoofing vulnerability. Let’s look at it from an attacker’s perspective: [...]
Click to expand...

Log in or Sign up

Kerberos Authentication Spoofing: Don’t Bypass the Spec

guest Guest

Log in or Sign up

Kerberos Authentication Spoofing: Don’t Bypass the Spec

guest Guest

Useful Searches