Preventing Pass-the-Hash and Similar Impersonation Attacks in Enterprise Infrastructures

• Main Authors: Oberle, Alexander, Larbig, Pedro, Marx, Ronald, Weber, Frank G., Scheuermann, Dirk, Fages, Daniel, Thomas, Fabien
• Format: Conference Proceeding
• Language: English
• Subjects: APT; Authentication; Business; Companies; Computer information security; Computers; Conferences; Economics; Enterprise security; Infrastructure; Mathematical analysis; mitigation; Networks; Pass-the-Hash; Pass-the-Ticket; password theft; prevention; proof of identity; protection; Protocol (computers); Protocols; Segments; Servers; single sign-on; vulnerability
• ISSN: 1550-445X; 2332-5658
• DOI: 10.1109/AINA.2016.101

Industrial espionage through complex cyber attacks such as Advanced Persistent Threats (APT) is an increasing risk in any business segment. Combining any available attack vector professional attackers infiltrate their targets progressively, e.g. through combining social engineering with technical hacking. The most relevant targets of APT are internal enterprise and production networks providing access to top-secret information. This work focuses on preventing Pass-the-Hash, one of the biggest and most long-standing security flaws present in enterprise domain networks. The introduced approach can be applied further to make password theft pointless for attackers in general, and is capable of extending network protocols, that are unprotected by themselves, with approved security mechanisms. The protocols do not need to be modified and already existing network services can stay untouched when integrating the solution into enterprise infrastructures.