HERNÁN OCHOA(Security consultant and researcher)

Understanding the Windows SMB NTLM Weak Nonce Vulnerability

In February 2010, we found different vulnerabilities in the Windows SMB NTLM Authentication mechanism that have been present in Windows systems for at least 17 years (from Windows NT 3.1 to Windows Server 2008). You probably haven\'t heard about these vulnerabilities, but basically the authentication mechanism used by all Windows systems to access remote resources using SMB has been flawed, allowing attackers to get read/write access to remote resources and remote code execution without credentials, using different techniques such as passive replay attacks, active collection of duplicate challenges/responses, and prediction of challenges. These vulnerabilities is also a good example of flaws that can be found in challenge-response authentication mechanisms.

This presentation will describe the vulnerability in detail, including its scope and severity, explain different techniques to exploit the flaws found and demo fully functional exploit code allowing remote code execution.

Sobre Hernán Ochoa

Hernan Ochoa is a security consultant and researcher with over 14 years of professional experience. Hernan began his professional career in 1996 with the creation of Virus Sentinel, a signature-based file/memory/mbr/boot sector detection/removal antivirus application with heuristics to detect polymorphic viruses. Hernan also developed a detailed technical virus information database and companion newsletter. He joined Core Security Technologies in 1999 and worked there for 10 years in various roles, including security consultant and exploit writer who performed diverse types of security assessments, developed methodologies, shellcode, security tools and contributed new attack vectors; design and development of several low-level/kernel components of a multi-OS security system ultimately deployed at a financial institution; and "technical lead" for ongoing development and support of the multi-OS system. Hernan has published a number of security tools, including Universal Hooker (runtime instrumentation using dynamic handling routines using Python), Pass-The-Hash Toolkit for Windows, and WifiZoo. He is currently working as a security consultant / researcher at Amplia Security performing network, wireless and web applications penetration tests, standalone/client-server application black-box assessments, source code audits, reverse engineering, vulnerability analysis, and other information security-related services.

« volver a Speakers

NOVEDADES



diseño: GrafikaWeb