NewsJuly 14, 2017 @ 6:40 AM

IT Managers Must Patch Security Vulnerabilities in Microsoft Windows

Two security vulnerabilities have been uncovered in Microsoft Windows, and they could put businesses at risk of credential forwarding and password cracking.

Security vendor Preempt discovered the bugs in the security protocols of Microsoft Windows NT LAN Manager (NTLM). Researchers at the firm suggested that the vulnerabilities were caused by improper handling of NTLM by system protocols.

Microsoft addressed the vulnerabilities in its recent Patch Tuesday update. IT and network managers should pay attention to these updates and consider other precautionary steps, including avoiding the use of NTML altogether.

Breaking Down the Vulnerabilities

According to ZDNet, the first vulnerability, known as CVE-2017-8563, highlights how Lightweight Directory Access Protocol (LDAP) is not protected from NTLM relay. A security flaw in the protocol means that it does not always protect the user from credential forwarding.

An attacker with system privileges can use an incoming NTML session to perform LDAP operations on behalf of the user. Attackers can subsequently establish a domain admin account and take control of the network.

The second vulnerability covers remote desktop protocol (RDP) Restricted-Admin Mode, which enables individuals to connect to a remote machine without entering a password. Attackers could potentially exploit this mode to perform password cracking or credential relaying attacks with NTLM.

These two vulnerabilities are important because an attacker could potentially create new domain administrator accounts despite the use of network controls, wrote researcher Yaron Zinar in a post on Preempt’s blog.

Relay attacks, which rely on a user connecting to an infected computer, have been known to exist for more than 10 years, Bleeping Computer reported. The computer is usually infected with malware, takes NTLM credentials, and then relays them to a third party or performs malicious actions without the user’s knowledge.

Microsoft acknowledged both issues and released a fix for CVE-2017-8563 in its security update for July. The technology giant claimed that the second concern is a known issue and network configuration can help keep users safe from malicious NTLM relays.

Managing Security Vulnerabilities

Preempt noted that using NTLM puts businesses at risk of credential forwarding and password cracking. In fact, Zinar advised IT managers to avoid using NTLM in their networks, if possible.

For firms that continue to use it, Zinar suggested several precautionary steps, such as installing the CVE-2017-8563 patch on all domain controllers, monitoring NTLM traffic across the network and withholding domain admin privileges from help desk personnel.

Experts recognize that managing security vulnerabilities can be tough, especially when the risk of infection is high and technology budgets are constrained. Precautionary steps, such as those outlined by Zinar above, can help. Other best practice techniques include vulnerability scanning through analytics technologies. Above all else, IT and network managers should play close attention to updates from technology partners.

Share this Article:
Mark Samuels

Tech Journalist

Mark Samuels is an experienced business technology journalist with an outstanding track record in research. He specializes in the role of chief information officers (CIOs) and is adept at helping executives understand the business benefits of complex technologies. Key areas of interest include innovation, digital transformation, cloud computing, mobility, information security, ecommerce and big data. Mark has written articles for national newspapers, including The Guardian, The Times and The Sunday Times. He has also produced features and columns for a range of IT trade publications, such as Computer Weekly, ZDNet, Tech Republic, IT Pro, Channel Pro, CBR and The Register.