Windows Kerberos Bronze Bit attack gets public exploit, patch now

guest · Dec 10, 2020

Windows Kerberos Bronze Bit attack gets public exploit, patch now
December 10, 2020
https://www.bleepingcomputer.com/ne...nze-bit-attack-gets-public-exploit-patch-now/

Proof-of-concept exploit code and full details on a Windows Kerberos security bypass vulnerability have been published earlier this week by Jake Karnes, the NetSPI security consultant and penetration tester who reported the security bug to Microsoft.

The security bug tracked as CVE-2020-17049 and patched by Microsoft during November 2020's Patch Tuesday can be exploited in what the researcher has named as Kerberos Bronze Bit attacks.
Click to expand...

Karnes provides a high-level summary of the vulnerability and details on how attackers can exploit it to compromised vulnerable Windows systems.
He has also published a low-level overview of the security bug with additional information on the Kerberos protocol, as well as practical exploit scenarios and details about how to implement and use Kerberos Bronze Bit attacks.

The release of the proof-of-concept exploit code by Karnes on Tuesday was prompted by Microsoft publishing the security updates needed to fully mitigate CVE-2020-17049 on vulnerable servers.
Click to expand...

Kerberos security bypass and auth issues
Microsoft is addressing the Bronze Bit vulnerability in a two-phase staged rollout, with the initial deployment phase having started on December 8th (requiring admins to manually enable enforcement) and an automatic enforcement phase starting on February 9th, 2021.
Click to expand...

guest · Oct 11, 2021

Microsoft Defender for Identity to detect Windows Bronze Bit attacks
October 11, 2021
https://www.bleepingcomputer.com/ne...dentity-to-detect-windows-bronze-bit-attacks/

Microsoft is working on adding support for Bronze Bit attacks detection to Microsoft Defender for Identity to make it easier for Security Operations teams to detect attempts to abuse a Windows Kerberos security bypass bug tracked as CVE-2020-17049.

Microsoft Defender for Identity (previously Azure Advanced Threat Protection or Azure ATP) is a cloud-based security solution that leverages on-premises Active Directory signals.
Click to expand...

Landing in two months

"An alert will be triggered when there is evidence of suspicious Kerberos delegation attempts using the BronzeBit method, where a user has attempted to use a ticket to delegate access to a particular resource," Microsoft explains on the Microsoft 365 roadmap.
The flaw (patched by Microsoft during November 2020's Patch Tuesday) can be exploited in what Jake Karnes, the security consultant who discovered, has named Kerberos Bronze Bit attacks.

Microsoft addressed the Bronze Bit vulnerability in a two-phase staged rollout, with the initial deployment phase on December 8 and an automatic enforcement phase on February 9.
Click to expand...

The release of all these additional details and the PoC exploit would probably make it a lot easier to breach Windows servers unpatched against CVE-2020-17049 and was what likely prompted Redmond to add Bronze Bit detection support to Microsoft Defender for Identity.
Click to expand...

Log in or Sign up

Windows Kerberos Bronze Bit attack gets public exploit, patch now

guest Guest

guest Guest

Log in or Sign up

Windows Kerberos Bronze Bit attack gets public exploit, patch now

guest Guest

guest Guest

Useful Searches