Active Directory Threats: Forewarned is Forearmed

In parallel with the development of Internet technologies, hackers are actively improving their tactics today. They are developing their own methods of access to certain services, services, expanding the boundaries of hacking. Today, no website, resource or any other online representation can feel safe. Thus, one of the extremely “tasty” The main target for Internet attackers working in the corporate device sector will be the Active Directory domain service.

In order not to fall into the hands of hackers, not to fall for their tricks, you need to know what methods they use in practice and thereby increase the security of your own system. Yes, there is a lot of work to be done here. In order to identify your weak points, make adjustments and thereby ensure a high level of protection against such attacks, you need to have sufficient knowledge, skills and time. Practice shows that this work can take from several days to several weeks. But you can be sure that all your efforts will justify themselves and pay off in practice.

As part of today's review, we will dwell in more detail on what the Active Directory environment is, what functionality it has. We will highlight a number of key advantages that make it such a popular product in the corporate environment. Get to know in more detail the six main types of attacks that are most often used in practice by attackers to gain access to Active Directory. With this information, you will know how to increase the security of your service, thereby making it minimally vulnerable to hackers.

A brief introduction to Active Directory: features and capabilities

Active Directory is a solution from Microsoft that can be used to combine various objects on a local network into a single system, be it servers, computers, printers, or any other services. In this case, the Active Directory service will act as a database, that is, it will store all the necessary information about personal computers and users, servers and those who have access to them, and all peripheral and network devices.

To implement this solution in practice, a domain controller is used. This is a separate dedicated server that will perform all work related to the authentication of users and corresponding devices on the local network. In parallel with this, it will also be used as a database storage. In practice, it looks like this: a certain user tries to access a server, personal computer or printer connected to a given network. An automatic request is made to Active Directory, which either allows this connection if it sees that all the necessary rights are present, or blocks it if a certain user does not have such access rights.

Among the main functional capabilities that ensure reliable operation of the service. Let's highlight:

• A single authentication point. The domain controller stores all information about the network infrastructure and users in its database. That is, it can be used to provide access to the system. There is a single database here where user logins and passwords are stored. Thanks to this, working with them will be simpler and faster. As soon as the automation process starts, all computers will immediately connect to this database and all the changes that will be made in it will immediately be distributed to other devices provided in this network. Active Directory is also used to distribute access rights. That is, here you can configure which users can connect to which computer, printer, server, and which ones are closed to them. That is, Active Directory allows you to quickly and easily implement a corporate network security policy.
• Policy management. Using Active Directory, your company's system administrator will be able to divide all devices connected to the network into separate work groups, highlighting the so-called "organizational units". By creating such an infrastructure, subsequent work will be significantly simplified. In particular, it will be possible to quickly make changes to the settings of a separate group, which is relevant in the case of their modification, expansion. In this case, the changes you make will automatically be distributed to all devices related to a certain unit. It will also be possible to add a new user directly to a specific group. In this case, this person will immediately receive the access rights that are set for his immediate colleagues. That is, the creation of a new account is significantly accelerated. In the same way, restrictions on the use of operating system capabilities are introduced. Alternatively, you can limit the installation of applications to certain users, shifting such responsibilities exclusively to the administrator.
• Security. The presence of Active Directory in the corporate network allows you to significantly increase the level of its protection from any unauthorized access. The thing is that all accounts will be stored in one database, namely the access controller itself, which will make them protected from external connections. In addition, when connecting to the network, a protocol is used for mutual authentication of the client and server (Kerberos), on the basis of which the server establishes a connection or prohibits it. And here there are already tools that take into account the interception of packets and their modification, which will automatically increase reliability and security. Compared to the authentication used in most workgroups today, this protocol can rightfully be called more advanced and efficient.
• File sharing. Active Directory can easily implement Distributed File System (DFS) technology, designed for file management. It is a distributed network for storing data and files that are actually located on several servers related to the same network. Thanks to this technology, it became possible to easily and quickly scale the existing infrastructure, add new servers to it without making any radical changes to the already operating devices.
• Integration of equipment and services. Using Active Directory services, you can combine all the disparate equipment and services of your company into a single closed system. As an option, there is support for the protocol for accessing the X.500 directory service, namely the LDAP standard. It allows you to organize convenient work with mail services, such as Exchange Server, ISA Server. At the same time, along with direct Microsoft products, the ability to interact with 1C, IP telephony, and remote desktop gateways is also implemented here. There are also tools for organizing Windows Server integration. For this, a special RADIUS protocol is used, which, among other things, allows you to use a VPN connection in cases where it is necessary to organize work remotely, outside the office.

That is, if we analyze these functions, we can conclude that Active Directory is a fairly convenient tool for any corporate network. Moreover, it is now clear why attackers are so eager to gain access to this service.

How to ensure stable operation of Active Directory

Today, Active Directory is the central node of the infrastructure of a large number of enterprises. And if it happens that it fails, the entire system will be unavailable to users. This is rather a drawback of this system. To minimize system failure, it is worth using the following recommendations:

1. Connect duplicate controllers. In particular, we are talking about deploying several domain controllers at the same time, duplicating each other. In this case, it will be necessary to configure automatic replication of all changes. In this case, if one of the controllers fails, two will immediately start working, having the same settings and storing similar information. That is, this way you will ensure the stability of the corporate network even if one of the controllers fails.
2. Use a backup system. Regular backups can quickly restore the server's functionality. In addition, backup is what will help eliminate downtime even if you use only one controller, not two or more, as we discussed above. In this case, you save not only time on server recovery, but also money. However, to ensure maximum stability, it is recommended to combine both backup and a duplicate controller.
3. Entrust the connection and settings of Active Directory to experienced specialists. This is the only way to ensure maximum reliability of the domain controller and avoid common mistakes that beginners make at this stage. It is also important to pay attention to testing the system before launching it directly into operation.

Now let's move on directly to getting acquainted with the types of attacks that Active Directory is susceptible to.

Main types of attacks on Active Directory

That is, Active Directory is a service that is used to manage identity and access to the corporate environment. Despite the fact that it appeared on the market more than 20 years ago, it has no worthy analogues. Moreover, the technology from Microsoft itself, which is the basis of this service, has not undergone any fundamental changes. Unfortunately, this is known not only to administrators working with Active Directory, but also to hackers. They use these weaknesses when organizing their attacks.

To minimize all possible risks, companies must develop a single reliable approach that allows for the maximum level of protection of their own network infrastructure. The attacks that attackers use when working with Active Directory are based on fairly complex technologies that involve impact from both the internal and external environments. All the tools that are currently used in the field of corporate security are not very effective in this case. And this has already been shown by practice, since the number of successful attacks on Active Directory has recently increased significantly. And one of the difficulties here is that there is no single solution and tools that could prevent such an attack.

To ensure sufficient protection, it is necessary to use separate technologies for each type of attack. In particular, we are talking about the following types of influence:

1. Using weak, compromised passwords.
2. Pass-the-hash attack.
3. Attack on service accounts in domain services, namely the Kerberoasting attack.
4. Imitating the replication process of a domain controller, or DCSync attack.
5. Attack with a golden ticket, that is, Golden Ticket.
6. Targeting vulnerable applications connected to Active Directory.

Let's consider each of these options for influencing Active Directory in more detail and suggest ways to increase protection against them.

Using weak and compromised passwords

Regardless of what system, service in question, weak or compromised passwords are what make it particularly vulnerable. This is also true for Active Directory. This means that attackers can easily decrypt this data or hack it using the same brute force or other similar techniques.

And here the way to prevent such an attack becomes obvious: increasing the reliability of passwords. This can be done by introducing new rules, based on which corporate users will connect to the network. Alternatively, you, as a system administrator, can block the most frequently used terms, sequential entry of symbols on the numeric or alphabetic keyboard. Moreover, you can create special password dictionaries that users of your system can use for themselves.

That is, if it turns out that the system identifies a person's password as weak, it will send him a notification asking him to change it the next time he connects, choosing an option that meets the established rules. If the user ignores this request, he will no longer be able to connect to the system with his old password.

By and large, everything is clear with this. But what to do with compromised passwords? We are talking about data that the attackers have already managed to steal earlier. This happens mainly because the same characters are used to access different services or accounts. Therefore, to prevent the use of compromised passwords, it is necessary to scan Active Directory periodically, identifying problematic data and informing its owners about the need to change it.

Pass-the-hash attack

Pass-the-hash attack, or as it is often called, involves searching for a cryptographic, that is, hashed form of a password. The fact is that the operating system installed on client user devices usually stores these parameters in its memory. To do this, attackers throw malware onto the device, which will get into the computer's memory and extract the encrypted password from there. This is how hackers gain access to Active Directory memory, meaning they don't even have to try passwords to find the right one.

One of the easiest ways to prevent such an attack is for administrators to encourage users to set longer and more complex passwords, at least 15 characters long. At the same time, they will be stored in a secure Windows NT hash format. If you use shorter passwords, they simply won't be allowed into this storage and will automatically end up in the LAN Manager hash, where the encryption level is much lower. By the way, the latest versions of Active Directory no longer have the LAN Manager hash. It can still be seen in older generations, where it is already enabled initially. That is, you need to go into it manually and disable it. Unfortunately, such a solution will not provide complete protection, since even with the hash disabled, other systems can still cache the LAN manager hash, which will leave an open loophole for intruders.

That is, one of the most effective ways to prevent such a hacker attack is to run complex passwords longer than 15 characters on all user devices connected to the system. But it is also very important to make sure that they are not repeated anywhere. In principle, you can use additional security tools. Overcoming the prohibitions will require more time and effort from hackers. In some cases, such a solution will force them to abandon their idea altogether. Alternatively, you can use multi-factor authentication MFA, which can provide an additional level of protection if the password is hacked. But this cannot be called a panacea for a hacker attack.

Also in this case, it is important to increase the security of each end user point, in particular to protect it from malware. Alternatively, in modern Windows operating systems virtualization-based tools are already actively used, in particular Virtualization-Based Security, VBS.

Attack on service accounts in domain services

Such an attack is called Kerberoasting. Its essence lies in the fact that in this case, attackers target service accounts available in Active Directory domain services. It turns out that initially the hacker gains access to the network itself. To do this, it will be enough for him to get the data of accounts with the lowest access privileges. Then he connects to the KDC (Key Distribution Center) of Active Directory itself with a request to provide a service ticket, but for accounts of a particular service related to the highest level.

In response to this, the key distribution center issues a ticket for the service account, but it will be encrypted with a password. This will be enough for the hacker to extract this ticket from the memory of the local machine that he managed to hack. After that, the received ticket is transferred to offline mode and then the process of cracking its passwords is launched by elementary brute force using the appropriate software. The effectiveness of such an attack in practice turns out to be quite high, since all accounts belonging to services are often granted high permissions and, accordingly, privileges. And if the hackers carry out the attack itself in offline mode, the probability of its detection by the system will be quite low.

So how can you protect yourself from a Kerberoasting attack? Here are some fairly simple recommendations:

• Take the use of exclusively strong passwords as a basis for your corporate network. This is especially true for service accounts. In addition, they must be constantly monitored for hacking.
• Monitor the network, in particular all requests that will involve registering a service account. It is important to understand how your system works in normal mode. This way, you will be able to easily notice abnormal deviations, in particular in registration requests.
• Do not use the same password for service accounts for a long time. Make it a rule to change it at regular intervals. This will help prevent the use of outdated passwords, which may already be accessible to intruders.
• Make sure that current password policies are applied not only to privileged accounts and those that will be actively used in practice, but also to outdated ones, including those that are no longer used. Most of the time, this is what attackers are targeting.

Simulating the domain controller replication process

This attack is called DCSync. It involves artificially simulating the replication process of the domain controller, which hosts the Active Directory domain services. That is, replication is what synchronizes all changes in the services, making them relevant on all devices. To implement this attack, the GetNCChanges request is used. With its help, hashes of the credentials from the primary controller of your domain are collected. Such an attack can be carried out quite easily and simply thanks to the so-called opensource tools, such as Mimikatz. Such solutions are now freely available on the network and can be used by anyone. At least those who understand all the nuances.

In order to protect yourself from such an attack, you should regularly monitor the security rules established for each domain controller. In turn, this also applies to the use of strong passwords that can ensure high security indicators for important accounts. It is also recommended to regularly clean the Active Directory system from those profiles that are no longer used or are outdated. This applies not only to accounts from the "important" category, but even to those used to provide services. That is, it is important to constantly monitor changes in domain groups and all the actions associated with them. A multi-level approach is used to implement this task. As an option, the implementation of advanced security protocols when working with a domain controller, performing a comprehensive Active Directory audit. This way you can identify all the accounts at your disposal, including those that are rarely used in practice or are no longer used at all.

Golden Ticket Attack

An attack using a method such as a golden ticket or Golden Ticket is is a process by which an attacker manages to obtain the NTLM hash of the Active Directory Key Distribution Service Account (KRBTGT). Once this data is in the hands of a hacker, he can create service tickets himself or transfer these rights to other people. Such an attack is quite difficult to detect. In addition, it can compromise your corporate network for a fairly long period of time.

To ensure protection against the Golden Ticket attack, it is worth:

• Update the KRBTGT account frequently, in particular the password. It is recommended to do this at least once every six months.
• Follow the policy of using strong passwords. This will minimize the chances of attackers penetrating your environment and gaining a foothold in it.
• Implement the least privilege policy directly in the Active Directory settings and constantly keep it up to date. In this case, even people with the least privileges will be able to gain access only after going through several stages. Yes, for people it is long and problematic, but effective from a security point of view.

Targeting vulnerable applications connected to Active Directory

This is the last attack on Active Directory that we will consider in our review. It is based on outdated and vulnerable applications that are integrated into this service. We are talking about software that uses weak encryption, hard-coded credentials, weak network security protocols, and a number of other software architecture elements that have vulnerabilities. Using such loopholes, attackers can easily hack Active Directory.

Preventing such a problem is possible only by fixing outdated, but at the same time critical applications for your business. Unfortunately, this work can take a lot of time and effort, up to several months. This is the only way to successfully implement a decent level of protection. In some cases, refactoring of applications can be used, or even their complete replacement, which will most likely cause certain difficulties in practice. In this case, it is very important to have a good understanding of the software landscape, constantly conduct a comprehensive security audit. And here it is also necessary to determine the importance of performing such work. In particular, it is necessary to understand whether all your activities aimed at preventing the risks associated with targeting vulnerable applications will justify rewriting or refactoring these same programs. If it turns out that such work is impractical, then it will be necessary to provide additional security measures that can minimize the risks.

General recommendations for ensuring Active Directory security

Above, we have already considered the most common attack options that hackers resort to in order to gain access to your Active Directory system, as well as those recommendations that will help minimize the success of attacks. But in parallel with this, over the years of the existence of this product on the market, Microsoft has already offered many solutions designed to ensure the security of this system. But the problem here is that before the company has time to release a new solution, hackers immediately find ways to bypass such restrictions. But the only tool that works well enough today is group policy. Despite the fact that it appeared quite a long time ago, it remains relevant today. In many ways, this is ensured by constant improvement over several years. In particular, it takes into account the parameters of the group policy, settings, extended ADM/ADMX audit policy.

But in parallel with this, the basic security structure remains relevant:

1. Regularly perform audits and extended audits.
2. Using the security configuration wizard.
3. Using the desired state configuration.
4. Connecting the security compliance manager.
5. Organizing a group of protected users.
6. Using a local administration password.

Each of these solutions has one common problem. It is associated with the inability to provide a sufficient level of protection for the working environment. That is, these methods have a pinpoint effect on individual devices, types of attacks, and take into account security settings. That is why in practice it is recommended to use complex solutions that involve a combination of different methods.

Summing up

We hope that the information presented in today's review was useful for you and helped you understand all the nuances of Active Directory, assess all the risks that your system is exposed to. Now you know the main types of attacks and the ways in which they can be implemented in practice, you understand what actions should be taken to prevent intruders from accessing your corporate system. In any case, it is necessary to very carefully think over access passwords, relying on complex phrases that include more than 15 characters. You should also constantly monitor accounts, promptly identify inactive ones and close them. In any case, ensuring security in a corporate Active Directory environment is something that requires a comprehensive approach, including constant monitoring, scanning, updating very important components.

It is also important to raise user awareness. Every person who uses a corporate system must understand what dangers they may encounter and how they can be, if not prevented, then at least minimized. That is, only constant vigilance can ensure sufficient protection of the corporate infrastructure, and with it the stability of business processes.

But if we move slightly away from the topic of corporate security to working with personal devices that are not connected to such a network, then ensuring the stability of their operation and protection from third-party access falls directly on the end user. But here everything is not as large-scale as in the case of working with corporate systems. In particular, it will be enough to connect mobile proxies in order to provide yourself with the necessary security and privacy indicators when working on the Internet.

Follow the link https://mobileproxy.space/en/user.html?buyproxy to get acquainted in more detail with this tool and what functionality it has. Thus, along with ensuring privacy and protection from any unauthorized access with MobileProxy.Space mobile proxies, you get the opportunity to bypass any regional restrictions and access sites blocked in your country at the legislative level. You can also use programs to automate network actions, organize stable work with multiple accounts in social networks, instant messengers, without fear of running into a block from the system.

We also suggest evaluating the current tariffs. Please note that they directly depend on the period of time for which you buy them. The most advantageous offer is to purchase mobile proxies for one year with a quick and easy extension. In this case, your benefit will be more than noticeable in comparison with purchasing a tariff for 1 day.

If any difficulties or technical problems arise in the work, the service support service is available 24/7.

Share this article: