Pass-the-hash – What it is and how to protect yourself?

Every day, we hear about cyberattacks against companies of all kinds. According to the 2019 Cost of a Data Breach Report, not only did the number of data leaks rise, but its cost as well. The average cost of a data leak, in the 507 organizations surveyed, was USD 3.92 million, an increase of 1.5% over the previous year. That’s right, and investments in cybersecurity have also increased, although the growth rate is lower today, according to Gartner. 

One of the techniques used by malicious attackers is the exploitation of flaws, which allows access to sensitive data and pass-the-hash. In this article, we discuss how this technique works, as well as the business risks involved, and how the Privileged Access Management (PAM) senhasegura tool can help organizations to prevent this type of attack.

The pass-the-hash attack technique has been around since the early 1990s and remains widely used by hackers to perform attacks. Although many organizations are adequately protected against pass-the-hash attacks, many have not taken any steps to protect themselves yet. Pass-the-hash occurs when a malicious agent steals privileged credentials by compromising the device. When a malicious attacker succeeds in performing this type of attack, they can quickly obtain the password hash of a domain admin credential. Thus, when the hash is compromised, the attacker is able to move laterally within the infrastructure and thus compromise other credentials and devices.

In this case, the attack needs Social Engineering skills to make the user click on a phishing email or infect a device with malware. When detecting the problem, the user will probably call the Technical Support team. Upon responding to the user’s request, the Support agent will use a privileged credential to authenticate into the device and check the problem. At this moment, the malicious attacker stores the administrative credentials used as a hash, even when the agent remotely accesses it. That’s it! With this hash, the attacker can use it to access IT resources within the affected organization’s infrastructure. It is no coincidence that the pass-the-hash attack is one of the most common attacks in the cybersecurity market.

It is worth remembering that, although it can be performed even on Linux and Unix devices, this type of attack is more common to occur on devices with the Windows platform installed. In this environment, pass-the-hash exploits the Single Sign-On feature of some authentication protocols such as NT Lan Manager (NTLM) and Kerberos. In this case, a malicious attacker is able to obtain private SSH keys and thus authenticate themselves on devices, in addition to moving laterally. 

On Windows platforms, when a password is created on a device, it is hashed in the memory of the Security Account Manager (SAM) and Local Security Authority Subsystem (LSASS) processes. Moreover, the Credential Manager process stores a database file in Active Directory, for example. Now that we know the dynamics of pass-the-hash attacks, the question that remains is: how do you protect yourself from this type of attack?

Many organizations implement actions based on best practices to protect themselves from pass-the-hash attacks. The separation of Domain Admin accounts is one of these actions. In this way, users with administrative credentials can have a common privileged credential, but without privileged access to the network. Therefore, it is possible to use Domain Admin accounts only when necessary, reducing the attack surface. Another good practice to mitigate the risk of these attacks is to make stronger password policies for this type of account. This involves not only the complexity of passwords, but the policies for changing and accessing credentials, including the frequency for changing passwords.

After implementing these best practices, the next step is to completely remove privileged access from devices connected to the infrastructure. This is because pass-the-hash attacks only occur when using these privileged credentials. One of the ways to achieve these results is through a Privileged Access Management (PAM) solution.

According to Gartner, PAM-related technologies provide secure privileged access in order to meet business requirements (auditing, for example). This is accomplished by protecting, managing, and monitoring privileged access and accounts. In addition to the controls associated with user access, technologies linked to PAM are also able to reduce cyber risks and the attack surface through the secure storage of credential passwords, both the personal and system ones. 

Accounts stored in a PAM solution are the most critical. In this case, many Information Security policies used in organizations may provide for complex requirements for these passwords, including their frequent changes. Regulatory requirements and cybersecurity best practices require that these passwords are unknown to most people within the organization. Thus, in addition to controlling connectivity to administrative systems, the features of a PAM solution will allow the management of access, the life cycle of privileged credentials, and the audit of privileged actions performed by these credentials. Finally, passwords can be rotated by the end of the respective accesses.

The functionalities of a PAM solution such as senhasegura, which help mitigate the risks associated with pass-the-hash attacks, include:

• Role-based access controls: it allows the implementation of the least privilege concept, which brings greater control over users’ privileges. Consequently, it is possible to reduce the risks of a range of threats. The access granularity of senhasegura simplifies the implementation of least privilege models in Linux and Windows environments.
• Access requests based on approval workflow: senhasegura allows the invocation of administrator privileges to run applications, considering the control by lists of authorized actions. Besides, one can also protect Linux and Windows systems through the configuration of approval workflows at one or multiple levels.
• Windows features: access to Windows Control Panel operations with administrative privileges. Also, senhasegura allows the invocation of administrator privileges to access sensitive data shared on the network, thus ensuring the security of files and directories against threats.
• Auditing and compliance: all requests for use of administrative credentials must be recorded in session logs, allowing for greater traceability of user actions and easier auditing of privileged activities and actions. 

When it comes to cybersecurity, the different components of the infrastructure may demand different solutions involved with PAM. Thus, it is recommended to use both Privileged Account and Session Management (PASM) and Privileged Escalation and Delegation Management (PEDM) solutions. While access and credential management requirements in isolated applications can be fulfilled with PASM, critical infrastructure such as server environments are best covered with PEDM solutions. Despite being different approaches, PEDM and PASM are complementary, allowing, as a consequence, the creation of a complete, secure, and reliable solution.