Steve Syfuhs

47.1K posts

Steve Syfuhs banner
Steve Syfuhs

Steve Syfuhs

@SteveSyfuhs

Windows and Authentication at Microsoft. Developer. Mostly dog pictures. Might actually be two dogs in a trench coat. 🇺🇸 / 🇨🇦 @syfuhs.net on blue sky

Seattle, WA Katılım Şubat 2009
2.2K Takip Edilen16.2K Takipçiler
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@olafhartong Cheap binary representation arithmetic. LONG_MAX minus some round number. I don’t remember what off the top of my head. It’s purely for Linux interop. Windows uses 64 bit time and Kerberos itself is agnostic. We bumped it up recently to nudge some aging libraries along.
English
1
0
3
410
Olaf Hartong
Olaf Hartong@olafhartong·
@SteveSyfuhs would you be able to explain why the Kerberos ticket lifetime is set to September 13, 2037, at 02:48:05 UTC ? I assume an end of epoch safe margin. But why 128 days, 26min and 2 seconds ? Is there a reason or good story there ?
English
1
0
8
627
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@JosephRyanRies @cadenzza_ @NerdPyle They aren’t going away any time soon, but we aren’t ever going to invest more energy into them. I don’t recommend building a product on them.
English
0
0
4
181
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @SchwaanK It’s locked behind a feature flag. We’re fixed the final ship bugs but it takes a while for changes to bubble up. Breaking fallback is such a PITA.
English
0
0
3
158
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @arekfurt The SSH channel is a transparent proxy of the opaque TLS data then? Today, which stage is being told it must auth to localhost? It sounds then like it’s currently violating server auth by design, which isn’t ideal.
English
1
0
0
203
Marc-André Moreau
Marc-André Moreau@awakecoding·
@SteveSyfuhs @arekfurt When mstsc validates the certificate in TLS, it checks for "IT-HELP-RDP", not "localhost". When mstsc does Kerberos authentication, the server name is "IT-HELP-RDP" not "localhost". TLS and Kerberos server validation now works with the *intended* server name, not the tunnel name
English
1
0
0
298
Marc-André Moreau
Marc-André Moreau@awakecoding·
Do you sometimes use RDP through an SSH tunnel? Are you aware that this specific use case is not properly covered by the current NTLM deprecation plan from Microsoft? Even with IAKerb and the TryIPSPN solution, connecting to "localhost:<local port>" will never work for Kerberos
English
9
11
79
18.9K
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @arekfurt I go back to server auth. As long as the thing the user sees is localhost, it connecting to anything but localhost voids the server authentication. It doesn’t matter what the intermediate layers do. If something lies about what it’s connecting to, that’s breaking server auth.
English
1
0
0
211
Marc-André Moreau
Marc-André Moreau@awakecoding·
@arekfurt @SteveSyfuhs Which brings me back to my point: Total NTLM Obliteration Or Go Home We can't realistically cover 100% of use cases without changes, but we at least need ways to make it happen which don't include "just use a VPN instead of an SSH tunnel" because that's never going to fly
GIF
English
1
0
1
223
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @arekfurt The absolute reality is that 100% is always unattainable. We have a plan for ~92% give or take. The remaining might be covered by attrition, or we do some exceptionally weird things, or we live with it. Or who knows, I may have sold myself right onto an ice flow going out to sea.
English
2
0
3
353
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @arekfurt At some point we just call it. Our target is when we our metrics hit a ridiculously low number of negotiated NTLM connections. If there are still hard dependencies that require NTLM because insecure behaviors, well maybe we accept that, and they’re stuck manually turning it on.
English
1
0
0
409
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@arekfurt @awakecoding Anything routed through a thing named localhost means you likely can’t get proper server auth, certainly not for preexisting protocols that have specific server auth semantics. That’s not something I’m interested in solving for, *yet*. Let me kill the 90% use cases first.
English
1
0
1
151
Brian in Pittsburgh
Brian in Pittsburgh@arekfurt·
@awakecoding @SteveSyfuhs Tunneling RDP inside SSH like this may be more useful to more people than one might expect. Is there anything in current plans that might not have been publicly addressed quite yet that could allow this to work without fallback to NTLM?
English
2
0
4
749
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@JefTek @EricaZelic In that regard it’s mildly offensive when it gets called legacy or not modern considering just how much of the world runs on it, without issue, every day. It certainly could use some improvements, and it’s getting them. Same as TLS.
English
1
0
7
406
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@JefTek @EricaZelic I would call the internal distinction something else and it would get me in trouble. Kerberos is like TLS: well defined and underpins literally everything. TLS is not modern by any definition, but it gets improved over time. Kerberos too.
English
1
0
4
491
IAM!ERICA
IAM!ERICA@EricaZelic·
3 years ago I would not have thought as Kerberos as a legacy protocol, yet here we are. Microsoft refers to it as a legacy protocol in the Entra ID Architecture documentation.
English
10
2
65
17.8K
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@dwizzzleMSFT @_C_King_123 Compatible with what, sorry? Do you mean an NTLM implementation that’s compatible with Samba? AFAIK they have a built in one. Our NTLM deprecation efforts are coming along nicely too, but the interop with Samba et al is an ongoing process. We’ll have more on that later.
English
1
0
1
309
CKing123
CKing123@_C_King_123·
@dwizzzleMSFT do you know if Windows 11's SMB no longer uses NTLM (and uses one of those Kerberos features announced earlier) for home users? Also, is there a Kerberos equivalent like MIT Kerberos I can use for Samba server that is compatible?
English
1
0
0
189
📔 Michael Grafnetter
📔 Michael Grafnetter@MGrafnetter·
Has anyone else noticed this ntdsutil typo, which has been present in Windows Server for as long as I can remember? It always catches my eye while creating #ActiveDirectory IFM backups, but is too silly to report to Microsoft Support. CC: @SteveSyfuhs
📔 Michael Grafnetter tweet media
English
0
0
10
1.4K
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@awakecoding @cnotin Strictly speaking pku2u doesn’t care where the cert is. It relies on certpoleng to do that, and in the AADJ case certpoleng has an AADJ plugin. There’s a certpoleng event log that’s fairly detailed. The application protocol knows nothing about pku2u.
English
1
0
2
192
Marc-André Moreau
Marc-André Moreau@awakecoding·
@cnotin @SteveSyfuhs I doubt you'll get much more information as this would be considered an implementation-specific detail, something which is often kept out of official protocol documentation, if there was such a thing when it comes to PKU2U in RDP + Entra ID. No, the PKU2U RFC is not enough "docs"
English
2
0
0
160
Clément Notin
Clément Notin@cnotin·
@awakecoding hello! You're the only one tweeting about PKU2U 😉 I'm using it (made sure it wasn't RDS AAD auth by unchecking its option) but I don't see the P2P cert in the user's cert store on the client. Have you already seen this? It appears though when I use PKU2U for SMB
English
1
0
4
777
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@NathanMcNulty @_dirkjan TAP might have different logic on lifetime. TAP didn’t exist when I wrote the TGT code. We’re talking to the current owners about this. It’s not a vulnerability by our classification since no security boundary has been bypassed, but certainly worth aligning for the stated reasons
English
1
0
3
263
Nathan McNulty
Nathan McNulty@NathanMcNulty·
@_dirkjan Hey Dirk-jan, testing this with SIF and getting results that conflict with Steve's comments here (I think!) I did a SIF of 2 hours for All cloud apps, created TAP, got Cloud TGT, waited 6 hours, and extracted NT hash Did you try past 10 hours? :) x.com/SteveSyfuhs/st…
Nathan McNulty tweet media
Steve Syfuhs@SteveSyfuhs

@NathanMcNulty @StevenKister1 It generally follows the lifetime of the PRT or max age of the TGT, whichever is less. It's a bit wonky because while they are given at the same time, they aren't inherently bound to one another. You can get a TGT that lives longer than SIF, but in practice you never will.

English
1
0
3
1.4K
Dirk-jan
Dirk-jan@_dirkjan·
New blog: Lateral movement and on-prem NT hash dumping with Microsoft Entra Temporary Access Passes. Some tips and tricks on abusing TAPs for Windows Hello persistence and NT hash recovery over Cloud Kerberos Trust. dirkjanm.io/lateral-moveme…
English
8
247
518
55K
EvilMog® @mog.evil.af
EvilMog® @mog.evil.af@Evil_Mog·
I had so much fun on the @MSFTBlueHat podcast, thank you @nicfill for having me. Also thank you @SteveSyfuhs and sorry I keep pronouncing your name wrong.
Microsoft BlueHat@MSFTBlueHat

🎧 Join Dustin Heywood @Evil_Mog, Hacker, Researcher, and Senior Leader at IBM, on the latest episode of The #BlueHat Podcast as he demonstrates cracking NTLM version 1, shares insights on auditing legacy systems, and discusses the critical role of IT asset management. Tune in now: podcasts.apple.com/us/podcast/sec… Don’t forget to take our BlueHat podcast survey for a chance to win an exclusive BlueHat Yeti cup: forms.office.com/r/YpPS2LAv5S

English
1
1
8
1.2K
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@4ndr3w6S Certainly took us long enough, yeesh. Glad this was all sorted though. It was a good find.
English
0
0
1
73
Andrew
Andrew@4ndr3w6S·
The amount of professionalism from @SteveSyfuhs and his team was like no other 🤗 Keep rocking and fighting the good fight 🤘
English
1
0
3
440
Steve Syfuhs
Steve Syfuhs@SteveSyfuhs·
@Evil_Mog NO I HAVE BEEN BURNED BY THESE DANG IDS AT LEAST ONCE FRIGGEN EH. Not this one though. There’s a few of these suckers lying in wait to anger you.
English
0
0
0
213

Keşfet

@olafhartong @cadenzza_ @awakecoding @SchwaanK @arekfurt @JefTek @EricaZelic @dwizzzleMSFT