Security firm Mandiant has released a database that can crack weak admin passwords protected by Microsoft's NTLM.v1 hash algorithm in under 12 hours, using consumer hardware costing less than $600 USD. This "rainbow table" allows hackers to take over accounts by quickly mapping a stolen hash to its password counterpart.
The database works against Net-NTLMv1 passwords, which are used in network authentication for accessing resources such as SMB network sharing. Despite being widely recognized as vulnerable due to its limited keyspace, NTLM.v1 remains in use in some sensitive networks due to inertia and the high cost of migration.
Mandiant's release aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. The company notes that tools to exploit this protocol have existed for years but often required expensive hardware or uploading sensitive data to third-party services.
The database allows attackers to recover passwords using a known plaintext attack, providing them with an easy way to crack NTLM.v1 hashes. This move is likely to provide added ammunition for security professionals when trying to convince decision-makers to migrate away from the insecure function.
Organizations that fail to disable the use of Net-NTLMv1 are advised to do so immediately, as they will have only themselves to blame if their systems are hacked due to this vulnerability. The release comes as a reminder that some legacy protocols can leave organizations vulnerable to trivial credential theft, and that it is essential to prioritize security and invest in modernizing outdated systems.
The move has been applauded by researchers and admins on social media, who see the release of the rainbow table as a valuable resource for demonstrating the insecurity of NTLM.v1 and making the case for its migration. As Mandiant's consultants continue to identify the use of NTLM.v1 in active environments, it is clear that this legacy protocol remains a significant vulnerability that organizations must address urgently.
The database works against Net-NTLMv1 passwords, which are used in network authentication for accessing resources such as SMB network sharing. Despite being widely recognized as vulnerable due to its limited keyspace, NTLM.v1 remains in use in some sensitive networks due to inertia and the high cost of migration.
Mandiant's release aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. The company notes that tools to exploit this protocol have existed for years but often required expensive hardware or uploading sensitive data to third-party services.
The database allows attackers to recover passwords using a known plaintext attack, providing them with an easy way to crack NTLM.v1 hashes. This move is likely to provide added ammunition for security professionals when trying to convince decision-makers to migrate away from the insecure function.
Organizations that fail to disable the use of Net-NTLMv1 are advised to do so immediately, as they will have only themselves to blame if their systems are hacked due to this vulnerability. The release comes as a reminder that some legacy protocols can leave organizations vulnerable to trivial credential theft, and that it is essential to prioritize security and invest in modernizing outdated systems.
The move has been applauded by researchers and admins on social media, who see the release of the rainbow table as a valuable resource for demonstrating the insecurity of NTLM.v1 and making the case for its migration. As Mandiant's consultants continue to identify the use of NTLM.v1 in active environments, it is clear that this legacy protocol remains a significant vulnerability that organizations must address urgently.
, just thinking about how easily hackers can crack those weak admin passwords with just $600 hardware is giving me the chills 
! The fact that Mandiant released a rainbow table to show everyone how insecure Net-NTLMv1 really is is actually super helpful for security pros trying to get decision-makers on board with migrating away from it. 
But seriously, organizations gotta take action ASAP and disable NTLM.v1, 'cause this vulnerability is like an open door for hackers 
!
. I mean, what's next? A database to crack every other security measure and we'll all be sleeping with one eye open 
.
. The fact that decision-makers are still using this stuff is just laughable - it's not like they haven't had enough warnings 
.
. I guess what I'm trying to say is, let's just take a deep breath and upgrade our security measures already... this "rainbow table" business is not exactly reassuring 
.
. It's like they're just begging for hackers to take over their accounts 
. They should've migrated already 
.
I mean, Mandiant's just giving security pros a way to show just how weak this protocol is. It's not rocket science, folks! A $600 GPU and some basic software can crack those passwords in under 12 hours. That's like finding a needle in a haystack, but the haystack is on fire 
.
they're basically begging to be hacked. NTLM.v1 has been vulnerable for years, and it's time to face facts. It's not that hard to migrate to a newer protocol. You just need the will to do so. 
Let's get those legacy protocols updated already! 
I mean, it's not like it's gonna break the bank or anything. And what about all the people who are still using these systems because they're just too lazy to update? 
.
just think about how easy it is to crack these old passwords 
$600 for a super powerful machine now is like buying a laptop 5 yrs ago 
and with all these rainbow tables online, its just a matter of time before someone does use this weakness to gain access into lots of systems 
.
, but come on, can't they just update already? 
That's like, super scary stuff 
!
. It's so easy to crack with just one of these rainbow tables 
. Organizations gotta take action ASAP 
! It's crazy that some folks are still using Net-NTLMv1 
after all this time 
. We should be using more secure stuff like two-factor authentication 
, or even just stronger passwords 
. Let's get these old systems upgraded already 
$600 usd might seem expensive for some people but trust me it's still super affordable 
organizations need to step up their game and disable this protocol ASAP, anyone who doesn't is basically asking for a breach 
. I feel like, come on guys! You know this stuff is ancient history by now