Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a remote workstation.

There is also a classic fix to this - disable wdigest and tspkg. So far so good, but if Kerberos is supported, then it apparently needs the clear text password to renew the Ticket Granting Ticket (TGT) and so you're left between a rock and a hard place - don't support Kerberos and enjoy all the risks associated with hash passing or support Kerberos and accept the risk of cleat-text passwords. The linked post gives the following advice which I think is unacceptable:

Therefore, the most effective protection is to avoid interactive logons to any untrusted hosts.

A big enterprise has 1000s of servers, how do you known which one is compromised and login should be avoided?

My question: are there any practical measures other than rolling out a 2FA (onto those issues later) that would permit a secure keyboard-interactive logon?

P.S. About 2FA. The most common methods are passcode + OTP and X.509 PKI on a smart-card. They aren't flawless either:

  1. if you have hijacked the lsass process, then you could arguably use the otp+passcode to log on to other servers while the passcode is valid. Using auotmation, this could mean you've logged on to tens of servers or more during the 60 second window
  2. As per this TechNet article the user sends the PIN to the server and makes the smart-card available to the RDP server. Same process as in the first item can be used to hack many servers while the admin is clicking away at the compromised server.
share|improve this question
You're assuming you're using a time-based OTP system. Event-driven OTP's can only be used once. – Steve Jul 10 '13 at 16:31
True, I had your basic RSA token in mind. – Konrads Jul 10 '13 at 16:47

1 Answer 1

While you might not like my answer, I don't see a problem with that. Ok, having the password in memory in clear-text is not ideal, it is required in these cases. How would that be a security risk? Well, in order to exploit this, you need Administrative rights, because lsass runs under the protected System account. And be logged in as the same user as you want to exploit. So there's no priviledge escalation resulting from this; the Administrator that logged in has access to his own clear-text password. It would pose a problem, if a program could access that clear-text password without user-intervention. This is not the case (UAC, access to inject code, etc) So you would need additional flaws to get it.

For your specific question: How to know? You don't know. Same as when users tell their password to a friend. You can't protect against that.

Yes, using 2FA or Smartcards is generally a good idea, as you don't enter a password directly.

share|improve this answer
The problem lies in the fact that an administrator cannot safely log on to a computer on the enterprise without risking compromising all other computers due to account hijack. – Konrads Jul 12 '13 at 18:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.