Using Two-Factor Authentication to Stop Pass-the-Hash

Question

Am looking into mitigations to Pass+the-Hash and Pass-the-Ticket in Active Directory that also improve overall network security, too. Have sorting through some of the many two+factor authentication options to increase security of user login, but just discovered that under the standard AD way of doing things two-factor authentication is still using Kerberos or NTLM. So pass-the-hash or pass-the-ticket attacks are still effective against the domain. The stuff I've read seems to say that only "interactive" logins are not vulnerable to this.

How can I adopt two-factor authentication for AD user logins in ways that won't just be as vulnerable to pass-the-hash/ticket as passwords are? To the extent it matters, I'm referring to environments using Windows Server 2008 R2 and Server 2012.

Answer 1

Matt Weeks, in his Credential Assessment Mapping Privilege Escalation at Scale talk, discusses many techniques to prevent PtH, PtT, and PtK (OPtH).

Starting at 41:50 and up until 48:52, he goes over many prevention angles and gotchas -- https://youtu.be/_XXs8pRnqSQ?t=41m50s

My favorite recommendations are the rotation of KRBTGT weekly, and, if you can utilize smart cards then rotate the user hashes daily. He also speaks about a generic PtH control with blocking inbound NTLM to the domain.

The DFIR Blog has an excellent three-part series on many other detections and mitigations --

1. http://dfir-blog.com/2015/11/08/protecting-windows-networks-defeating-pass-the-hash/
2. http://dfir-blog.com/2015/11/24/protecting-windows-networks-dealing-with-credential-theft/
3. http://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/

As for two-factor authentication and one-time password schemes, I don't think that FIDO (e.g., YubiKey) or a competing system would deter any of the above suggestions -- it would just add to their control strength and provide operational residual risk reduction.

Answer 2

There is no way to use 2FA as a mitigation against p2H (stolen kerberos credentials):

1. There are 2 types of credentials in Windows AD network: Kerberos tokens/hashes and clear text Logins/Passwords.
2. Kerberos is a Single factor authentication protocol - it authenticates password hash or PKI certificate but not both. There is NO 2FA method exist to protect stolen Kerberos credentials. (2FA requires user iteractions which contradicts SSO principle - no user iteraction after initial login). You need to implement a security governance program - a set of measures to mitigate PtH.
3. stolen/compromised Logins/Password are protected by using 2FA methods by MS (OTP only, requires CA) or a bunch of 3rd party that allows to use and combine a variety 2FA means.