What is AS-REP Roasting attack, really?

Microsoft’s Active Directory is said to be used by 95%^[1]
of Fortune 500. As a result, it is a prime target for attackers as
they look to gain access to credentials in the organization, as
compromised credentials provide one of the easiest ways for hackers
to access your data.

A key authentication technology that underpins Microsoft Active
Directory is Kerberos. Unfortunately, hackers use many different
attacks against Active Directory’s implementation of the Kerberos
authentication protocol. One of those is AS-REP Roasting. So what
is AS-REP Roasting, and how can businesses protect themselves?

What is Active Directory Kerberos?

Kerberos was originally developed by the Massachusetts Institute
of Technology (MIT) and centered around using tickets to establish
trust. Microsoft’s implementation of Kerberos found in Active
Directory is based on Kerberos Network Authentication Service (V5)
as defined in RFC 4120^[2]. However, Microsoft has
added to and enhanced Kerberos with its protocol specifications and
several extensions.

There are three different components found in Kerberos
authentication as found in Microsoft Active Directory. These
include:

• Client – The client is the entity that is
  looking to obtain tickets from the KDC
• Application Server – The resource that needs
  the issued tickets presented for authentication
• Key Distribution Center (KDC) – The KDC is the
  trusted third-party that issues the authentication tickets. In
  Microsoft Active Directory, the KDC is each domain controller
  servicing the Active Directory domain.

Overview of the Kerberos authentication protocol ticket exchange

Essential for understanding the risks associated with Active
Directory credential theft, Kerberos is the default protocol used
when logging into a Windows machine part of an Active Directory
domain. It has been the default authentication protocol, replacing
NTLM since Windows 2000 and later. What are the differences between
the two?

The two protocols manage authentication differently. The NTLM
authentication protocol relies on a three-way handshake. The
authentication information is exchanged between the client and
server to authenticate a user. Conversely, Kerberos uses a two-way
process that relies on a ticket-granting service using a key
distribution center (KDC).

NTLM uses password hashing, whereas Kerberos uses encryption.
While Kerberos is the default authentication method, NTLM is still
used as a fallback authentication protocol. If authentication can’t
happen using Kerberos, the system will use NTLM instead.

What is AS-REP Roasting?

Even though Kerberos is a much more secure authentication
protocol than NTLM, it is not without its own set of
vulnerabilities, some of which can stem from the specific user
account settings configured for the account in Active
Directory.

One of the first steps in Kerberos authentication is
preauthentication. Pre-authentication uses the user’s password to
encrypt a timestamp. The domain controller (DC) will decrypt this
to validate the correct password and not have a previous request
replayed. A vulnerability can result when preauthentication is
disabled.

Once this is disabled, a hacker can request authentication data
for any user, and the DC will return an encrypted ticket-granting
ticket (TGT). It can then be used to brute force in an offline
environment to crack the password.

Preauthentication can be disabled on any user account in Active
Directory on the Account tab under the
Account options. Look for the checkbox “Do
not require Kerberos preauthentication.”

Setting the do not require Kerberos preauthentication flag in Active Directory

AS-REP Roasting is the technique that allows retrieving password
hashes for users that have this flag set in Active Directory.
Additionally, various cybersecurity and hacking tools allow
cracking the TGTs harvested from Active Directory. These include
Rubeus and Hashcat.

Using a tool like Rubeus, attackers can find the accounts that
do not require preauthentication and then extract the
ticket-granting ticket (TGT) data for cracking the password
offline.

Data can be transformed into a format that can be cracked by an
offline tool such as Hashcat, which can use brute force password
cracking against the hashes. This process incorporates the use of a
dictionary file for brute-force password guessing.

Preventing the AS-REP Roasting attack

An obvious way to prevent the AS-REP Roasting attack is to audit
your Active Directory environment and ensure there are no accounts
configured with the “Do not require Kerberos
preauthentication.”

In addition to auditing your Active Directory settings for
improperly configured preauthentication, you want to make sure
users are required to use strong, complex passwords.

Also, it is vital to ensure passwords are not found in a
breached password database as breached password lists are used to
crack passwords extracted using the AS-REP Roasting attack.
Breached password protection is not natively found in Active
Directory. So, a third-party solution is required for this type of
protection.

Breached password protection with Specops

Enforcing effective password policies and using a breached
password protection solution for Active Directory is essential to
ensure your environment is not vulnerable to Kerberos attacks such
as AS-REP Roasting. In addition, effective password policies help
ensure users are using strong passwords that are not easily guessed
or otherwise easy to attack with brute force or other common
password attacks.

Specops Password Policy^[3]
takes password policies into the modern era with functionality and
features not natively found in Active Directory. It prevents weak
and even breached passwords from use in the environment using one
of the most important features of Specops Password Policy, Breached
Password Protection.

Recently, Specops released the next iteration of Breached
Password Protection with Live Attack Data. The Live Attack Data
comes from a global honeypot solution used by Specops to gather the
passwords that are used in live brute force attacks. These are
integrated with the current protection offered by Specops to
customers using the Breached Password database and the solution is
continuously updated with the most recent breached passwords.

In addition, with Breached Password Protection found in Specops
Password Policy, organizations can quickly implement breached
password protection to prevent users from using compromised
passwords. For example, if users attempt to choose a password found
in the extensive database of breached passwords maintained by
Specops (over two billion), the password is not accepted. In
addition, if a user’s password becomes breached after it has been
defined in Active Directory, organizations can use Specops Password
Policy to force their users to change the password at next
login.

Specops Password Policy Breached Password Protection

On top of the Breached Password Protection in Specops Password
Policy, it adds many other features and benefits to bolster your
organization’s ability to tailor password policies to fit the
business needs and maintain high levels of security in your
environment. These include:

• Ability to add multiple custom password dictionaries
• Length-based password aging
• Built-in password expiration notifications
• Password content restrictions
• Regular expressions to further control password content
• Multiple password reset options
• Minimum number of characters that are required changed for a
  password reset

Considerations

Active Directory is the number one identity solution used in
organizations today. Unfortunately, his means attackers heavily
target Active Directory environments to find ways to steal
credentials. Their attack methods include attacking the
authentication protocols used by Active Directory, including
Kerberos. AS-REP Roasting is a type of attack that looks to find
accounts with the preauthentication flag for Kerberos
unset for users.

Once found, hacking tools can be used to brute force user
passwords. One of the best ways organizations can defend themselves
is to have good password policies in place along with breached
password protection, as attackers often use breached password
databases in an AS-REP Roasting attack. Specops Password Policy^[4]
helps businesses bolster their password security, including
Breached Password Protection.