Finding a Needle in an Encrypted Haystack

Overview: Marina Simakov and Yaron Ziner from Preempt present an offensive evaluation of Active Directory security, uncovering critical vulnerabilities that dismantle all existing defensive mitigations against NTLM relay attacks. While Microsoft has historically introduced Server Signing, Message Integrity Codes (MIC), and Extended Protection for Authentication (EPA / Channel Binding) to secure NTLM, the researchers demonstrate how each mechanism can be completely bypassed. The authors detail three novel zero-day attacks—including the "Drop the MIC" vulnerability—and unveil the first deterministic detection methodology for NTLM relay at the domain controller level.

Key Topics: - Architecture of NTLM relay attacks and historical defensive mitigations (Server Signing, MIC, EPA) - "Your Session Key is My Session Key": generic bypass of NTLM server signing via NetBIOS name stripping - "Drop the MIC" (CVE-2019-1040): bypassing Message Integrity Code verification to achieve cross-protocol relay - Extended Protection for Authentication (EPA) bypass via injected Channel Binding AV pairs and deterministic detection

Technical Details: In an NTLM relay attack, an adversary intercepts an NTLM authentication exchange from a victim and relays it to a target resource (such as an SMB share, LDAP service, or Exchange server) to authenticate as the victim. Over time, Microsoft deployed three mitigations: SMB/LDAP Server Signing (requiring a session signing key negotiated during authentication), Message Integrity Code (MIC, an HMAC-MD5 signature over all three NTLM messages), and Extended Protection for Authentication (EPA / Channel Binding, which cryptographically ties NTLM messages to the target server's TLS certificate).

The researchers exposed flaws that systematically bypass each defense. First, in "Your Session Key is My Session Key," the authors addressed Microsoft's 2015 fix that checked the Netlogon originator against the NetBIOS computer name in NTLM Authenticate AV pairs. The researchers discovered that if an attacker removes the NetBIOS computer name AV pair from the NTLM Challenge, the client generates an Authenticate message lacking the name. The Domain Controller accepts the malformed Netlogon request and issues a valid session key to the attacker. Using modified Impacket tooling, the attacker recalculates the session key, signs SMB traffic, and compromises the domain controller. Second, the authors revealed "Drop the MIC" (CVE-2019-1040). The MIC was introduced to prevent attackers from unsetting the NEGOTIATE_SIGN flag. However, the researchers discovered that if the MIC AV pair is deleted from the NTLM Authenticate message, receiving servers and DCs fail to validate the signature and accept the connection anyway, allowing attackers to strip signing flags and relay SMB sessions into LDAP/LDAPS.

Finally, the authors bypassed EPA and Channel Binding, which validates that the channel_bindings AV pair matches the target's TLS certificate. Because the certificate is public, the authors pre-computed the expected channel binding token and injected it into the NTLM Challenge. When the client processed the challenge, it echoed the injected binding along with a secondary zeroed binding. Target servers evaluated only the first entry, accepted the authentication, and granted access. By combining this with "Drop the MIC", the authors executed relays to EPA-enforced endpoints (ADFS, OWA, and LDAPS).

Key Takeaways: Relying on incremental cryptographic patches for legacy NTLM cannot guarantee enterprise security against relay attacks. Organizations must phase out NTLM across corporate networks in favor of Kerberos with strict PAC validation. Where NTLM cannot be immediately deprecated, administrators must enforce LDAP signing and EPA across all domain controllers, Exchange, and ADFS servers. The authors introduced the first deterministic detection methodology for NTLM relay, which inspects cryptographic timestamps and session discrepancies within domain controller Netlogon telemetry to spot relayed authentication in real time.

(AI summary — Gemini Flash)