{"id":414224,"date":"2026-01-17T00:33:08","date_gmt":"2026-01-17T00:33:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/ca\/414224\/"},"modified":"2026-01-17T00:33:08","modified_gmt":"2026-01-17T00:33:08","slug":"mandiant-releases-rainbow-table-that-cracks-weak-admin-password-in-12-hours","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ca\/414224\/","title":{"rendered":"Mandiant releases rainbow table that cracks weak admin password in 12 hours"},"content":{"rendered":"

Microsoft released NTLMv1 in the 1980s<\/a> with the release of OS\/2. In 1999, cryptanalyst Bruce Schneier and Mudge published<\/a> research that exposed key weaknesses in the NTLMv1 underpinnings. At the 2012 Defcon 20 conference, researchers released a tool set<\/a> that allowed attackers to move from untrusted network guest to admin in 60 seconds, by attacking the underlying weakness. With the 1998 release of Windows NT SP4<\/a> in 1998, Microsoft introduced NTLMv2, which fixed the weakness.<\/p>\n

Organizations that rely on Windows networking aren\u2019t the only laggards. Microsoft only announced<\/a> plans to deprecate NTLMv1 last August.<\/p>\n

Despite the public awareness that NTLMv1 is weak, \u201cMandiant consultants continue to identify its use in active environments,\u201d the company said. \u201cThis legacy protocol leaves organizations vulnerable to trivial credential theft, yet it remains prevalent due to inertia and a lack of demonstrated immediate risk.\u201d<\/p>\n

The tables first assist attackers in providing per-byte hash results with the known plaintext<\/a> challenge 1122334455667788. Because Net-NTLM hashes are generated with the user\u2019s password and the challenge, a known plaintext attack, it becomes trivial with these tables to compromise the accont. Typically tools including Responder, PetitPotam, and DFSCoerce are involved in attacks against Net-NTLM. Typically tools including Responder<\/a>, PetitPotam<\/a>, and DFSCoerce<\/a> are involved.<\/p>\n

In a thread<\/a> on Mastodon, researchers and admins applauded the move, because they said it would give them added ammunition when trying to convince decision makers to make the investments to move off the insecure function.<\/p>\n

\u201cI\u2019ve had more than one instance in my (admittedly short) infosec career where I\u2019ve had to prove the weakness of a system and it usually involves me dropping a sheet of paper on their desk with their password on it the next morning,\u201d one person said<\/a>. \u201cThese rainbow tables aren\u2019t going to mean much for attackers as they\u2019ve likely already got them or have far better methods, but where it will help is in making the argument that NTLMv1 is unsafe.\u201d<\/p>\n

The Mandiant post provides basic steps required to move off of NTLMv1. It links to more detailed instructions.<\/p>\n

\u201cOrganizations should immediately disable the use of Net-NTLMv1,\u201d Mandiant said. Organizations that get hacked because they failed to heed will have only themselves to blame.<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft released NTLMv1 in the 1980s with the release of OS\/2. In 1999, cryptanalyst Bruce Schneier and Mudge…\n","protected":false},"author":2,"featured_media":104497,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[49,48,61],"class_list":["post-414224","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/414224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=414224"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/414224\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/104497"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=414224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=414224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=414224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}