Table of Contents
A Kerberoasting attack is a cyber threat tactic that uses the Kerberos authentication process, which Microsoft Directory actively uses.
In this type, malicious or harmful actors use special tools to extract encrypted Kerberos tickets from a network. Once obtained, they attempt to decrypt these tickets into a readable format and gain access to information stored within the network.
Such attacks are famous for impersonating the user so that sensitive information can be obtained. In this article, we will explore the concept of Kerberoasting attacks and the potential risks they pose.
Understanding the Connection between Kerberos and Service Accounts
Service accounts are user accounts that run services on Windows systems. They often have elevated privileges, such as Domain Admin rights, which enable them to perform tasks.
When hackers request service tickets from the Kerberos Distribution Center (KDC) using service accounts, they receive encrypted tickets that are safeguarded by the password hash associated with those service accounts.
Hackers then launch brute force attacks to crack these password hashes and gain entry into the system.
Types of Kerberoasting Attacks
Kerberoasting attacks are of several types. They range from SPN Scanning to service account password cracking (Kerberoasting) to persistence attacks. Let’s have a look at them.
SPN Scanning
SPN scanning is a reconnaissance technique attackers use to identify services running on a network.
Attackers send requests to the Kerberos Key Distribution Center (KDC) and request specific SPN types. The KDC, in response, generates a list of services corresponding to the requested SPN type.
SPN and Kerberoasting
In this type, attackers crack service account passwords. After requesting for the Kerberos Key Distribution Center (KDC) and requesting for specific SPN types, attackers obtain the password hashes from the ticket.
Offline attacks can then be used to decrypt the password hashes. For example, dictionary attacks or brute force attacks.
Persistent Attacks
In persistent attacks, attackers can still access the victim’s system and network despite being removed or detected.
They employ various strategies to execute a persistent attack, using Silver and Golden Tickets.
- Silver Tickets
In silver ticket attacks, fake Kerberos TGS (Ticket-Granting Service) tickets are used. Attackers can access any user or service on the network by forging the TGS tickets.
They use the silver keys to access the compromised network even after getting removed.
With silver tickets, hackers can crack the password of the host service account. It is followed by creating a new scheduled task and gaining access to the hash of the Kerberos TGT account.
Once the attacker has the hash of the KRBTGT account, they make a Golden Ticket.
- Golden Tickets
Golden Tickets are commonly used in privilege escalation attacks. Golden tickets are fake Ticket-Granting Tickets (TGT) used to access any resource on the network.
After gaining access to the network, attackers use Golden Tickets to execute attacks at the domain administrator level.
Attackers can obtain a Golden Ticket once the Kerberos Key Distribution Centre (KDC) has been compromised.
These tickets are extremely dangerous as they grant attackers complete network access and control.
Hackers can then conduct as many malicious activities as they want within the compromised network. It becomes an easy task to steal data, install malware, or even disrupt a network.
Famous Kerberoasting Attacks
Let’s have a look at some of the famous Kerberoasting attacks.
Operation Wocao
During Operation Wocao, hackers used PowerSploit’s Invoke-Kerberoast module to access the authentication data through encrypted service tickets.
The brute force method was used to get the login credentials of these service accounts. The passwords were weak and commonly shared amongst multiple accounts.
After guessing the passwords, they compromised the network.
Solorigate Backdoor Incident
It is the most famous Kerberoasting attack. Attackers in the Solorigate Backdoor Incident obtained unauthorized access to the victim’s private information.
They were also able to spread laterally within the victim’s network.
It is believed the hacker belonged to a proficient group of APT29 and executed the highly sophisticated backdoor known as Solorigate.
The cyber attack targeted various organizations, including government agencies and technology companies. To achieve their objectives, attackers used Kerberoasting to crack the Service account password.
FIN7 Threat Group
The FIN7 threat group also used Kerberoasting to steal the login credentials of the service account and spread it across the entire network.
What Possible Threats Can Occur Due To Kerberoasting Attack?
After gaining access to the victim’s system and network, the attacker can plan and execute multiple malicious activities. A few are mentioned below.
Elevate Privileges
The lousy actor with the service ticket can gain elevated privileges on the network by pretending to be someone else.
Once he has the key, he can access data and information that was impossible to obtain otherwise.
For example, bad actors can gain administrative access with the Kerberos tickets. This way, they can keep tabs on every network on the server and install malware or steal data.
DDoS Attacks
As mentioned above, hackers can gain administrative access to a network and exploit it as they want.
They can launch denial-of-service (DoS) attacks. DDoS attackers overwhelm the system by burdening it with more traffic than it can manage.
Directing Users to Malicious Websites
Attacks through Kerberoasting attack pretend to be a legitimate user of the network. They exploit the victim’s system and send contaminated data to other users on that network.
When the users click on the infected links, they are directed to a malicious website.
Once the user is in the attacker’s chosen location, they become vulnerable to information loss and computer-based attacks.
Injecting Malware (Trojans)
Users within the network are directed to malicious websites that contain irrelevant and misleading content. From the same websites, users can also download negative information into their systems.
Trojan is the most commonly found malware attackers use to steal your information. Trojan runs silently in the background without anybody’s knowledge.
Bad actors can then exploit the system, extract sensitive data, and spy on the victim.
How To Prevent Kerberoasting Attacks: 7 Effective Ways
Here is how to stay safe:
- Implement Kerberos Constrained Delegation (KCD)
Users can protect themselves and their networks by implementing KCD. It limits the permissions to Kerberos tickets.
Organizations with KCD allow a web server to share its Kerberos access rights with a database server, but only for a specific database.
The web server will be unable to use its access to other databases or other areas of the network. This will keep all the operations in control and check.
- Deception Technology
Kerberoasting attacks can be prevented using Deception technology. It includes decoys, lures, and bait to defend against Kerberoasting attacks.
It creates fake accounts to request service tickets from the Kerberos authentication service while monitoring the activity.
Furthermore, it also detects attempts to crack passwords. If an attacker attempts to attack against a decoy, it alerts the security team. The alert provides information about the attack and techniques to track it down.
However, deception technology is not a complete solution, and organizations must use a combination of security measures.
- Network Segmentation
Hackers spread laterally in a network after successfully planting a Kerberoasting Attack. Network segmentation enables you to divide your data into multiple parts to avoid an overflow.
This will ensure that your networks can hold the data within their capacity and size, and eventually, the data flow will be smooth.
Several layers will be created across your network, and it will become challenging for any hacker to break into your system as he will have to crack all the segments of the data to reach the core control system of your network.
This division of data will act as a safety barrier for your data.
- Air Gapping
Air gapping can be used to mitigate the risk of Kerberoasting attacks. In this method, you keep your sensitive data separate from other data at an unreachable place by the hackers.
This way, that particular system or data will be air-gapped and won’t have automatic access to other networks.
One example of this could be moving your entire system to an area that is isolated from the rest of your plans.
- Endpoint Protection
End-point protection can be installed in each segment. Even if the hackers enter the network, they won’t be able to manipulate the data due to the additional security protocol.
Firewalls are commonly used to protect endpoints. Firewalls create a barrier between your network and external forces.
They do not allow processing of the request sent by the hacker and block it.
- Two-Factor Authentication
Two-factor authentication protects your system by asking for an additional code when someone outside the network tries to log in to your account.
A code will be sent to you if someone attempts to go unauthorized from a different location and device.
When you enable two-factor authentication on your account, you will receive a code either on your mobile number or your email address.
Despite guessing your password, hackers cannot enter your account as this additional information will add a layer of security.
- Use a VPN
Having a reliable VPN is always a good idea to enjoy base-level security.
VPN provides anonymity, masks your IP address, and offers encryption that enhances your chances of not being affected by cyber attacks, including Kerberoasting.
Stay Safe, Not Sorry
Kerberoasting attacks are a dangerous threat to your network security. Attackers take advantage of vulnerabilities within the system to compromise your sensitive data.
Thus, it would help if you implemented stringent protection measures against Kerberoasting attacks to safeguard your network from potential threats.
Marrium Akhtar
October 30, 2023
6 months ago
