Almost the end of the weekend; no better time than to discuss Password Spraying attacks. So what is it?
Well, as the name implies, it is a type of Cyberattack where an attacker tries commonly used passwords against many different accounts rather than target an individual account too many times. This helps to stay under the radar as well as avoiding the triggering of attack lockouts.
The passwords can be come from publicly available 'wordlists', public credential dumps of compromised sites, or target the environment and use specific keywords.
Additionally, to minimise attempts and detection, a list of usernames will be targeted and an attempt made to authenticate to each one using just a single password. If an organisation reuses passwords or has weak passwords in use, this can be a really effective method to break into an account and gain the privileges of the user. This access can then be used to move laterally across the environment or performing Kerberoasting attacks.
Multi-factor authentication (MFA) can prevent against this attack up to a point. There have been instances of MFA fatigue where the user accidentally approves a MFA request. This can be prevented by forcing the user to enter a number, for example before the request can be approved.
However, if initial access has already been gained, if NTLM is enabled in the environment, it does not support MFA, and the malicious actor can attempt to authenticate as any user object in the domain. NTLM should be disabled in the environment as it is inherently insecure.
Mitigating against Password Spraying
- Consider using LAPS for Windows - https://learn.microsoft.com/en-au/windows-server/identity/laps/laps-overview
- Configure the built-in ‘Administrator’ domain account as sensitive to ensure it cannot be delegated
- Passwords for local administrator accounts, service accounts, and break glass accounts should be at the very least a minimum of 30 characters and unique.
- Disable NTLM
- Run vulnerability scans against the network to identify if any credentials are stored in plain text, and if they are easily cracked.
