1

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it.

I couldn't find anything in the internet or in different books.

3

LSARPC is really a set of calls, transmitted with RPC, to a system called the "Local Security Authority". This used in the Microsoft/Windows world to perform management tasks on domain security policies from a remote machine. The protocol is described in MS-LSAD. The transport medium is RPC, a part of the "Server Message Block" protocol (MS-SMB, MS-SMB2).

So, while LSARPC is a protocol used to manage things that impact security, as a network protocol it is "merely" a sub-case of the Microsoft generic SMB protocol, whose security can be described as "questionable" (not irremediably doomed, but apparently hard to implement properly, since they got it wrong many times). On the bright side (or dark side, depending on your angle), LSARPC is no less secure than most of the network activities occurring within a Windows domain, since most of it uses SMB.

  • Thank you for the detailed answer. I assume from your answer that there is no comparison between the RPC protocol to the SSL protocol (i.e. SSL is much more secured) which is an important fact I tried to figured out. – SyndicatorBBB Jan 27 '15 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.