All right let's talk.
L m and r mitigation.
So the best defense here is to actually disable l m and r you have to disable not only L M and R but
also FBT and S because remember if DNS fails it goes to element R F Elam and our fails it goes to empty
DNS just cutting out element R isn't enough so to fully disable this you have to disable both.
Here is how you kind of do it.
This is just a copy paste of what I would actually send to a client or put on a report for a client
as to how to disable this if they are not able to disable element R or they just refuse to.
Then the second option is to tell them to enable network access control which if you're not familiar
with what that means network access control means that hey I can't just go and plug into any port on
your network and gain access.
It's going to look for a MAC address and say Does this MAC address belong and should we allow it.
And a lot of the times it doesn't belong or it's not allowed.
You're actually going to shut that port down or otherwise it's just not going to let you on the network.
So there are bypasses in network access control but I think again that this is an internal.
And you just want to make it as hard as possible for somebody to get into your network and that would
prevent this attack from even happening or at least stall the attack from happening.
The other thing here is to require the strong user passwords so 14 characters or longer you know 40
character passwords probably the past to the long sentence whatever however long you want to make it
but it should be long and the 14 characters and that's really what you want to harp on your your policies
to your clients is you want to tell them like yeah you can have your minimum but you should stress how
easy it is to crack these passwords.
The longer the password the harder it is to crack.
And it goes from like seven or eight characters being you know a couple hours to or even seconds to
hours you know from 14 characters 15 characters being years to crack and a brute force attempt so just
that difference in a few extra characters and just making a little bit longer really doesn't make a
difference and it makes it really hard on us as an attacker to be successful so hopefully that makes
a little bit more sense.
And when you're an interview you can talk through elem and R talk about disabling it for best case scenarios
and talk about other mitigations to prevent these sorts of attacks as well.
So from here we're going to move on and talk about how we can utilize elem in our poisoning to our advantage
in other ways and not just capture a hash and crack it but actually use that hash to our advantage and
gain access to a machine.
So let's go ahead and take a look at that.