When does log on procedure is critical for System Security the Emmis Gina DL system library is used
for logging in.
This is worth taking note of.
Since there's a rogue version of the file available on the Internet cold for example fake ass Gina got
DSL.
This means that if you replace M-S Gina DSL with fake messaging a DSL or similar files or user will
not be able to tell a difference with a log on the logon screen would look the same but apart from submitting
the log in and password to a security subsystem the default security services provider the credentials
will also be saved to a txt file and forwarded to an attacker.
Remember that log ons are simply a technology and there has to be a file that governs it
by default cryptographic services provider in the newer Windows systems is Kerberos
the services by a large margin the most secure method for approving user identity.
There are in fact no documented attacks targeting Kerberos except for some peculiar cases Kerberos strength
is that it doesn't reuse your password
LAN Manager and LAN Manager both constantly reuse your password hash to encrypt some data network credentials
Kerberos uses a ticket instead a ticket is valid 10 hours by default.
This means in effect that we can change the password every 10 hours.
Unfortunately Kerberos may sometimes be unable to authenticate a user if it can't prove a user identity.
The system will automatically fall back to older cryptographic services provider and the land manager
in Windows Vista and later LAN Manager is disabled by default.
We'll find out that it was high time for that.
If you log on to a local computer your credentials don't leave that computer
even if you're connected to an untrusted network.
There's no way for a would be attacker to eavesdrop on your credentials logon is a protected process
that involves comparing the entered password against the contents of the security account manager database.
The Windows system does contains three important files.
The first is the same file which contains your credentials and passwords and passwords and cached credentials
a local computer knows the credentials and can authenticate you
remote authentication is performed differently.
If you don't work in a domain if there's no central user credentials database an active directory database
the same Sam files will be used to connect one computer to another one a trust relationship has not
been established.
You need to provide account credentials that are valid for your computer.
There's a problem on the horizon already.
How do you send confidential data a password over an untrusted medium and untrusted network.
It turns out that a password is never sent over a network in clear text.
It's used for encrypting other data
the above diagram shows the network principle behind the first version of the end TLM protocol.
There are two versions of NC alone this authentication method involves exchanging challenge in response
messages
the algorithm used for that purpose was considered secure several years ago.
The data encryption standard was developed in the 70s today and the algorithm is anything but secure.
There are devices that crack the ciphertext in real time when they're sent over a network.
The procedure looks as follows.
We a client would like to authenticate in a server a client sends an authentication request the response
to this request is a challenge a pseudo random stream a client encrypts this challenge using a password.
The first version of entail M will always send two responses.
The first will be the same challenge encrypted using an L and password.
The second response is the challenge encrypted using an empty password.
Both messages will use encryption
since the server same database contains our password and at least one of the entier L.M. hashes.
It's enough to decrypt the challenge message and check it against the original message we forwarded.
If they match.
We're sure that the encryption used the correct password is equivalent with successful authentication
theoretically.
This is a great solution.
Passwords won't be thrown into a network and were authenticated remotely.
The problem is in the details as it often is.
In this case the issue lies in the L-N password generating mechanism.
We'll examine this in the next part of the module.
L.N. version 2 is a lot more secure this tightened security is due to not sending a response that is
encrypted using an and password the authentication does not use any L.N. hashes at all other steps in
the procedure are quite similar although there is more randomness.
The second version of TLM supports mut. authentication to a degree
although authenticating to Windows networks using the L-M protocol is feasible.
You shouldn't normally fall back on this under any circumstances.
The second method is an TLM which also shouldn't be the preferred authentication.
Even the oldest versions of Windows use today support the second version of NCM and TLM version 2 does
provide some security during one of the next case studies will show you that the security is very basic
a better way to ensure authentication security is using Kerberos.
Version 5 instead of anti-oil and version 2.
You could ask what makes the L.M. and the TLM protocols so on secure and why they're still used.
The answer to the first question will be answered later will deal with the latter now.
To authenticate using Kerberos you need to be able to reach a key distribution center a domain controller
This functionality is supported only in the active directory domains or user may want to log on to a
computer that is not connected to a network.
If not for A.I.M. version 2 windows Logans would not be possible if a system can't reach any domain
controller.
The price for absolute security would be too high.
So anti-law version 2 is and will continue to be implemented in Windows for some time.