Kerberos Simplified: A Beginner's Guide

Contents

Category

Article

Tags

cybersecurityauthenticationactive-directory

Contents

In this blog, we’ll be exploring the Kerberos authentication protocol which was developed in the 1980s at MIT to solve network authentication problems. It became popular and was made freely available. In 1993, Kerberos v5 was standardized by the Internet Engineering Task Force (IETF), in the document RFC 1510, and it is now widely used in enterprise environments.

Enjoy!

What is Kerberos?

Kerberos is a network authentication protocol based on tickets. It provides clients and servers a reliable way to verify each other before establishing a connection.

Kerberos authentication involves two types of tickets: Ticket Granting Ticket (TGT) and Service Tickets (ST). Users are issued a TGT after logging in with their password, and they use it to obtain an ST when accessing network shares or web servers. The ST is presented to the server to start a session and access the desired resources.

The Kerberos Authentication Flow & Risk Areas

Primary Kerberos risk areas are credential theft on the client, service ticket abuse through Kerberoasting, stolen ticket replay during service access, delegation misconfiguration on target services, and full-domain compromise if the KDC or krbtgt secret is exposed.

Common Use Cases

1. Single sign-on (SSO): Kerberos supports SSO, allowing users to authenticate once and then access multiple resources without having to enter their credentials.
2. Web authentication: Kerberos can be used to authenticate users accessing web applications, providing a secure way to access sensitive information.
3. Cross-realm authentication: Kerberos can be used to authenticate users across different realms or domains, allowing for seamless access to resources across different networks.

However, Kerberos is not without its shortcomings. The weakest link in the Kerberos chain is the password. Passwords can be brute forced, cracked, or stolen. In fact, attackers often bypass strong protocols entirely by phishing for user credentials directly through social engineering.

Known Kerberos Attacks

Why Should You Care?

It’s the potential for unauthorized access to sensitive information. Kerberos, being the backbone of AD authentication, is often exploited by attackers during various stages of a cyber-attack, such as initial access, privilege escalation, defense evasion, credential access, and lateral movement. This aligns with modern trends toward weaponizing active directory and credentials in surgical, stealthy ransomware attacks.

By recognizing and addressing these weaknesses, organizations can proactively protect themselves against potential security threats and safeguard their sensitive data.

What’s Next?

The use of cloud-based authentication methods like OAuth and OpenID Connect is increasing, migrating organizations toward modern web Single Sign-On (SSO) standards. They offer more flexibility and scalability than traditional Kerberos authentication and are useful for modern cloud-based applications that need authentication across multiple domains.

Blockchain-based authentication, Contextual authentication (location, device, and behavior patterns), Continuous authentication, Passwordless authentication (FIDO), as well as MFA and biometric authentication are becoming more popular for sensitive applications and services, especially in finance and healthcare. They provide additional layers of security beyond traditional Kerberos authentication, which only uses a username and password.

There has also been a trend towards zero-trust security architectures that assume users and devices are untrusted. This approach relies on various authentication mechanisms like MFA, biometrics, and device attestation to ensure secure access to sensitive resources.

While these trends do not necessarily mean the end of Kerberos authentication, they do suggest that its use may become more specialized, particularly in environments where legacy systems and applications still rely on it.

Thank you for reading my blog, and I hope this information was helpful!

References & Further Reading

• Detecting Active Directory Kerberos Attacks: Threat Research Release, March 2022 | Splunk
• Active Directory Kerberos Attacks - Splunk Security Content
• Decrypt Kerberos/NTLM “encrypted stub data” in Wireshark | by Clément Notin [Tenable] | Tenable TechBlog | Medium
• Don’t make your SOC blind to Active Directory attacks: 5 surprising behaviors of Windows audit policy | by Clément Notin [Tenable] | Tenable TechBlog | Medium
• SANS Digital Forensics and Incident Response Blog | Kerberos in the Crosshairs: Golden Tickets, Silver Tickets, MITM, and More | SANS Institute
• Mutual Authentication Using Kerberos - Win32 apps | Microsoft Learn
• Kerberos: Secure Authentication | SANS Institute