LAN Manager

LAN Manager was a Network Operating System (NOS) available from multiple vendors and developed by Microsoft in cooperation with 3Com Corporation. It was designed to succeed 3Com's 3+Share network server software which ran atop a heavily modified version of MS-DOS.

History

LAN Manager was based on the OS/2 operating system co-developed by IBM and Microsoft. It originally used the Server Message Block protocol atop either the NetBIOS Frames protocol (NBF) or a specialized version of the Xerox Network Systems (XNS) protocol. These legacy protocols had been inherited from previous products such as MS-Net for MS-DOS, Xenix-NET for MS-Xenix, and the afore-mentioned 3+Share. A version of LAN Manager for Unix-based systems called LAN Manager/X was also available.

In 1990, Microsoft announced LAN Manager 2.0 with a host of improvements, including support for TCP/IP as a transport protocol. The last version LAN Manager, 2.2, which included an MS-OS/2 1.31 base operating system, remained Microsoft's strategic server system until the release of Windows NT Advanced Server in 1993.

Many vendors shipped licensed versions, including:

Cryptanalysis

Main article: LM hash

LAN Manager authentication uses a particularly weak method of hashing a user's password known as the LM hash algorithm, stemming from the mid '80s when floppy viruses were the major concern as opposed to potentially high-frequency attacks with feedback over a (high-bandwidth) network.[1] This makes the supposed one-way function crackable in a matter of seconds using rainbow tables, or in few hours using brute force. Its use in Windows NT was replaced by NTLM, of which older versions are still vulnerable to rainbow tables, but less vulnerable to brute force attacks. NTLM is used for logon with local accounts except on domain controllers since Windows Vista and Windows Vista no longer maintains the LM hash by default.[1] Kerberos is used in Active Directory Environments.

The major weaknesses of LAN Manager authentication protocol are:[2]

  1. Passwords are not case sensitive. All passwords are converted into uppercase before generating the hash value. Hence it takes password, PassWord, PaSsWoRd, PASSword and other similar combinations same as PASSWORD converting all characters to uppercase. Password characters are also limited to a subset of the ASCII character set.
  2. Password length is limited to maximum of 14 characters
  3. A 14-character password is broken into 7+7 characters and the hash is calculated for the two halves separately. This way of calculating the hash makes it exponentially easier to crack, as the attacker need to brute force 7 characters twice instead of 14 characters. This makes the effective strength of a 14-characters password equal to twice that of a 7-character password, which is significantly less complex than the strength of a 14 character password.
  4. If the password is 7 characters or less, then the second half of hash will always produce same constant value (0xAAD3B435B51404EE). Therefore if the length of password is less than or equal to 7 characters, then a password length of 7 characters or less can be identified visibly without using tools.
  5. The hash value is sent to the server on network without salting, making it susceptible to man in the middle attacks such as replay the hash.

See also

References

  1. 1 2 Jesper Johansson. "The Most Misunderstood Windows Security Setting of All Time". TechNet Magazine. Microsoft. Retrieved 2 November 2015. Although Windows Vista has not been released yet, it is worthwhile to point out some changes in this operating system related to these protocols. The most important change is that the LM protocol can no longer be used for inbound authentication—where Windows Vista is acting as the authentication server.
  2. ↑ Rahul Kokcha

External links

This article is issued from Wikipedia - version of the Monday, January 25, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.