Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|||
|
|
|
If I understand the question correctly, then I'm guessing the simple answer is No. However, it depends on how, where and when the token is used to authenticate. No, because once you authenticate (say using SecurID), and you are given some kind of a session identifier, it's the session identifier that matters for subsequent requests, not the initial authentication, which happens only once. Those tools grab those session identifiers, so work independently of any previous authentication. This is one of the fundamental problems with, e.g. Single-Sign-On solutions. They make user and administrators lives easier, but once you are authenticated, it opens up much more opportunity for attackers to abuse. However, if you implement further authentication checks, don't rely solely on Windows authentication (use web-based authentication for example). Then you can mitigate those attacks to some extent. For example, some banks ask you to re-authenticate before making some transactions. Even if you're already logged in. You can in theory implement similar controls to reduce the effectiveness of those session grabbing attacks. |
|||
|
|
