Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication
Summary
Researchers discovered a method to bypass LDAP signing and NTLM relay protections by re-authenticating on an existing attacker-controlled connection. This bypass leverages the attacker's session key while still enforcing signing, making it appear legitimate. Microsoft has since released patches for SMB and LDAP to address this vulnerability.
IFF Assessment
The discovery of a new bypass technique for established security protocols like LDAP signing and NTLM relay represents a significant win for attackers and a challenge for defenders.
Severity
The vulnerability allows an attacker to bypass authentication mechanisms (LDAP signing) and perform actions on behalf of a user through NTLM relay. This has a high attack complexity and allows for significant impact on confidentiality and integrity. Attack Vector: Network, Attack Complexity: Low, Privileges Required: Low, User Interaction: None, Scope: Unchanged, Confidentiality: High, Integrity: High, Availability: None.
Defender Context
This finding highlights a critical flaw in how LDAP signing and NTLM relay are implemented, suggesting that existing security configurations might not offer the protection initially assumed. Defenders should ensure their systems are patched against this vulnerability and review their authentication and relay attack mitigation strategies.