Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A client that allows to respond to the server with LM and NTLM, with a password which is simple,, is it insecure.

Isnt a more secure way is to have all the communication with NTLMv2 scheme? and in addition to that have a complex password.

is it true that a weak password can be cracked even in NTLMv2?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

In NTLM (both v1 and v2), the authentication protocol itself is not bad -- as long as you play it within a secured connection. Indeed:

  • Active attackers, who can eavesdrop on the network and also inject pakcets of their own, can hijack open connections at will. If your authentication protocol is performed on a basic TCP connection, an attacker just has to wait for a normal connection from an authorized user, and steal it once the authentication step is done.

  • Even passive attackers, observing the protocol messages, will obtain enough information to run an offline dictionary attack: they can try potential password until one is found that matches the messages seen on the wire; and they can do that on the privacy of their own machines (that's the "offline" part).

SSL/TLS fixes both issues. If the client first opens a SSL connection to the server (with due server authentication through its certificate and so on), and the rest of the communication (including the password-based authentication protocol) occurs within the encrypted tunnel, then you will be safe from attackers. However, under these conditions, a simpler "show the password" protocol, in which the client simply sends the password "as is" (in the SSL tunnel), would be better.

Indeed, attackers are inventive, and they don't restrict themselves to simply spying on the network. It often happens (much too often) that attackers gain some glimpses of server data, e.g. through SQL injections, or by recovering old hard disks from dumpsters. This is why servers should store only hashed passwords. But there are good hash functions for that, and there are also bad hash functions (see this answer for a lot of details). When using the simple "show the password" protocol, the server is free to use any password hashing function that it sees fit; however, when using NTLM, the server must store the hashed value that the protocol mandates, i.e. "NT Hash" or "LM Hash".

Unfortunately, NT Hash is very weak against a brute forcing attacker: it is very fast (an attacker with a PC+GPU can try billions of passwords per second) and it is unsalted (attackers can collude and use precomputed tables, such as rainbow tables, to run attacks almost for free). LM Hash is even worse.

So you really should not use NTLM if you can avoid it.


A weak password is weak, however you put it, because attackers can also perform online dictionary attacks by simply speaking themselves to the server. Under these conditions, a weak password can be tolerated only with strict lockout procedures, such as closing the user account if four consecutive bad passwords are entered. This is what most smartcards do. However, this is hardly appropriate for a server, because it would make it too easy for evil-intentioned person to lock the accounts of other people.

So you need to educate your users into choosing strong passwords. For that matter, NTLMv1 adds some extra insult to the injury, through LM Hash, which restricts passwords to 14 characters and maps lowercase letters to uppercase. Password strength depends on the entropy: a measure of what the password could have been. Entropy needs some room; especially because humans are involved. Humans are bad at making random choices, but also at remembering random choices; their task is made easier if they are allowed to choose long passwords. But LM Hash does not allow long passwords. The next best thing, then, is to add extra entropy by, for instance, making each letter uppercase or lowercase on a random basis. But LM Hash prevents that, too !

share|improve this answer
add comment

Allowing the storage and use of LanMan (LM) hashes is a security weakness as Lan Manager splits the password into two case insensitive 7 character pieces before hashing, which makes cracking the password hash much easier.

In general forcing NTLMv2 and disabling the storage of LM hashes is a good idea from a security perspective and as no supported version of windows requires LM hashes, would seem like a pretty safe bet these days.

A weak password can almost always be cracked if the attacker gets a hold of the hashed version of it that is stored on a system. An attacker can use a dictionary attack which is usually pretty quick to crack many weak passwords, and for short non-dictionary passwords rainbow tables can be acquired to speed up the cracking process.

share|improve this answer
add comment

LanMan passwords are maximum 14 characters (truncated) and then split into two of 7 character length and converted into upper case. This means that the maximum password strength is: 26 characters+10 digits+~10 special characters, which results to 46^7 or 435818 million combinations. On a modern computer with a fast GPU these combinations can be tried out (brute-forced) very fast, in a matter of minutes. Assuming you have access to the hash - if any networking is involved, it's much much slower. But better don't even store that LM hash, if not needed by any (very) old system. Such old systems would be Windows for Workgroups (WfW) 3.11 or such systems from 1993 or so.

So the recommendation is to disable LM hashing and use only NTLMv2. With NTLM(v2) the entire password is hashed, no splitting in two parts, and also no case changing. So if you use a long password (longer than 7 chars) and mixed characters (upper case, lower case, digits, special) then it's not easy to try our all combinations. But one could still easily try out all 6-char passwords in minutes, or all 7-char passwords that don't contain upper case characters, etc. in the same time as LM passwords.

Fortunately LM hashing is disabled on machines newer than Windows XP by default.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.