Lecture

Zerologon Vulnerability in Netlogon Protocol

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

In course

COM-506: Seminar on applied cryptography

This seminar introduces the participants to the current trends, problems, and methods in the area of communication security. ...

Description

This lecture covers the Zerologon vulnerability in the Microsoft Netlogon Protocol, allowing attackers to authenticate as arbitrary users or devices without their password. It explains the Netlogon Protocol, session key establishment, flags in NetrServerAuthenticate, and exploiting the vulnerability to send requests. The lecture also delves into changing Active Directory passwords, exploiting the vulnerability to gain domain admin access, and the implications of NTLM hashes. It discusses previous Netlogon vulnerabilities, patches released by Microsoft, and the timeline of events related to Zerologon. References to related whitepapers and scripts are provided, along with insights on the severity of the vulnerability.

Instructor

Serge Vaudenay

Serge Vaudenay entered at the Ecole Normale Supérieure in 1989 with a major in mathematics. He earned his agrégation (secondary teaching degree) in mathematics in 1992, then a PhD in Computer Science at the University of Paris 7 - Denis Diderot in 1995. He subsequently became a senior research fellow at the CNRS, prior to being granted his habilitation à diriger des recherches (a postdoctoral degree authorizing the recipient to supervise doctoral students). In 1999, he was appointed as a Professor at the EPFL, where he created the Security and Cryptography Laboratory.

Official source

Related concepts (32)

Authentication

Authentication (from αὐθεντικός authentikos, "real, genuine", from αὐθέντης authentes, "author") is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicating a person or thing's identity, authentication is the process of verifying that identity. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate, determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.

Microsoft

Microsoft Corporation is an American multinational technology corporation headquartered in Redmond, Washington. Microsoft's best-known software products are the Windows line of operating systems, the Microsoft 365 suite of productivity applications, and the Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface lineup of touchscreen personal computers. Microsoft ranked No.

Multi-factor authentication

Multi-factor authentication (MFA; two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism. MFA protects personal data—which may include personal identification or financial assets—from being accessed by an unauthorized third party that may have been able to discover, for example, a single password.

Samba (software)

Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell. Samba provides and print services for various Microsoft Windows clients and can integrate with a Microsoft Windows Server domain, either as a Domain Controller (DC) or as a domain member. As of version 4, it supports Active Directory and Microsoft Windows NT domains. Samba runs on most Unix-like systems, such as Linux, Solaris, AIX and the BSD variants, including Apple's macOS Server, and macOS client (Mac OS X 10.

Directory service

In computing, a directory service or name service maps the names of network resources to their respective network addresses. It is a shared information infrastructure for locating, managing, administering and organizing everyday items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is a critical component of a network operating system. A directory server or name server is a server which provides such a service.

Related lectures (57)

Commitment Scheme and PRNG

Explores the commitment scheme, key derivation function, and pseudorandom generator in cryptographic protocols, emphasizing their role in ensuring data integrity and authentication.

Secure Communications: TLS and Security Protocols

Explores TLS, security protocols, synchronization, fair termination, and secure communication applications.

Introduction to Cryptography: Fundamentals and Applications

Covers the fundamentals of cryptography, including symmetric encryption, digital signatures, and secure communication standards.

Public-Key Cryptography: Post-Quantum and Access Control

Explores public-key cryptography, post-quantum systems, and access control mechanisms in depth.

Authentication - Tokens