Security Firm Mandiant Releases Rainbow Table to Crack Weak Admin Passwords in Under 12 Hours
In a move aimed at nudging users who continue to use the deprecated NTLMv1 hashing function, security firm Mandiant has released a rainbow table that can crack weak admin passwords in under 12 hours using consumer hardware costing less than $600 USD.
The database, known as an NTLMv1 rainbow table, is a precomputed table of hash values linked to their corresponding plaintext. This generic table allows hackers to take over accounts by quickly mapping a stolen hash to its password counterpart. The limited keyspace of the NTLMv1 hashing function makes it particularly easy to construct such tables.
Despite being well-known for its weaknesses, NTLMv1 remains in use in some sensitive networks due to inertia and a lack of demonstrated immediate risk. Microsoft only announced plans to deprecate the protocol last August, but Mandiant consultants continue to identify its use in active environments.
The release of the rainbow table is intended to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. While tools to exploit this protocol have existed for years, they often required uploading sensitive data to third-party services or expensive hardware to brute-force keys.
Using the newly released database, defenders and researchers can now recover passwords in under 12 hours using consumer-grade hardware. This move provides added ammunition for security professionals when trying to convince decision-makers to migrate from the insecure function.
Microsoft released NTLMv1 in the 1980s with the release of OS/2 and later exposed its weaknesses through research by cryptanalyst Bruce Schneier and Mudge in 1999. The protocol was eventually replaced by NTLMv2, which fixed the weakness. However, organizations that rely on Windows networking are still vulnerable to trivial credential theft due to inertia and a lack of demonstrated immediate risk.
The tables first assist attackers in providing per-byte hash results with the known plaintext challenge 1122334455667788. This allows them to compromise accounts using single DES with 56 bits of the user's secret key at a time. While NTLMv2 is still weak, it is not subject to rainbow tables due to its response function including 64 bits of random entropy supplied by the client.
Organizations that fail to heed this warning will have only themselves to blame if they get hacked. Mandiant advises organizations to immediately disable the use of Net-NTLMv1 and provide basic steps required to move off of the insecure function, linking to more detailed instructions.
In a move aimed at nudging users who continue to use the deprecated NTLMv1 hashing function, security firm Mandiant has released a rainbow table that can crack weak admin passwords in under 12 hours using consumer hardware costing less than $600 USD.
The database, known as an NTLMv1 rainbow table, is a precomputed table of hash values linked to their corresponding plaintext. This generic table allows hackers to take over accounts by quickly mapping a stolen hash to its password counterpart. The limited keyspace of the NTLMv1 hashing function makes it particularly easy to construct such tables.
Despite being well-known for its weaknesses, NTLMv1 remains in use in some sensitive networks due to inertia and a lack of demonstrated immediate risk. Microsoft only announced plans to deprecate the protocol last August, but Mandiant consultants continue to identify its use in active environments.
The release of the rainbow table is intended to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1. While tools to exploit this protocol have existed for years, they often required uploading sensitive data to third-party services or expensive hardware to brute-force keys.
Using the newly released database, defenders and researchers can now recover passwords in under 12 hours using consumer-grade hardware. This move provides added ammunition for security professionals when trying to convince decision-makers to migrate from the insecure function.
Microsoft released NTLMv1 in the 1980s with the release of OS/2 and later exposed its weaknesses through research by cryptanalyst Bruce Schneier and Mudge in 1999. The protocol was eventually replaced by NTLMv2, which fixed the weakness. However, organizations that rely on Windows networking are still vulnerable to trivial credential theft due to inertia and a lack of demonstrated immediate risk.
The tables first assist attackers in providing per-byte hash results with the known plaintext challenge 1122334455667788. This allows them to compromise accounts using single DES with 56 bits of the user's secret key at a time. While NTLMv2 is still weak, it is not subject to rainbow tables due to its response function including 64 bits of random entropy supplied by the client.
Organizations that fail to heed this warning will have only themselves to blame if they get hacked. Mandiant advises organizations to immediately disable the use of Net-NTLMv1 and provide basic steps required to move off of the insecure function, linking to more detailed instructions.
i mean, think about it, it's just gonna make hacking easier for bad guys... like, what's next? making a list of all the super secure passwords people use on their vacation accounts? 
seriously though, shouldn't we be focusing on creating better security measures instead of just releasing more tools for hackers to exploit? 
I'm not sure I buy this "helpful" move from Mandiant. So, they're releasing a rainbow table that can crack weak admin passwords in under 12 hours using consumer hardware... and suddenly that's supposed to make security professionals all like "Oh no, we need to fix this ASAP"? 
That's still way more than most small businesses or even some home users can afford. Are we supposed to believe that Mandiant is doing us all a favor by making it easier for hackers to crack our passwords? 
NTLMv1 is basically begging to be cracked with its tiny keyspace, and now anyone can do it in under 12 hours using consumer hardware. It's like Microsoft left the door wide open on purpose... 
.
. Let's get serious about security! 
. I feel bad for the folks who are stuck in these insecure networks because of inertia or lack of knowledge. They need to act fast before their accounts get compromised 
.
i mean, NTLMv1 is like the ancient cousin of password hashing functions and it's crazy some organizations still haven't bailed on it yet 
anyway, i hope this release gets ppl to take security seriously and migrate from that insecure function ASAP 
. Mandiant should be trying to help people, not enabling hackers. I mean, what's next? They're gonna release a tool to crack WEP/WPA too? 
. But honestly, if you're still using NTLMv1, you should probably be like, "oh no, I need to fix this ASAP!" 
.
.
And what's with the "oh no, NTLMv1 is insecure" hype? It's not like it's a new protocol or anything... everyone knew about its weaknesses back in 1999. Let's not be too hard on the old tech just because it's been around for decades. 
, I'm literally shaking my head over here! Can't believe some orgs are still rockin' that outdated NTLMv1 
. That's crazy quick! 
. Microsoft has been trying to get rid of it for years but people just don't wanna move on 
. Meanwhile, hackers are having a field day exploiting this weakness 
.
. Maybe now people will listen and start making changes 
.
#NTLMv1 is like a ticking time bomb just waiting to be exploited 
using hardware that's actually accessible to most security teams 
And let's be real, who wants to be the one explaining to the CEO why their network got hacked because they didn't take security seriously enough? 
#SecurityMatters #GetItTogether