Detecting KERBEROS ticket attacks within a domain
A system and methods for mitigating Kerberos ticket attacks within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by comparing hashes for each authentication object to previous generated hashes.
1. A system for detecting ticket-based attacks within a domain, comprising:
a computing system comprising a memory and a processor;
an authentication object inspector comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing system to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.
2. The system of claim 1 , wherein the authentication object inspector is operated by the identity provider.
3. The system of claim 1 , wherein the authentication object inspector is operated by the identity provider.
4. The system of claim 1 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
5. The system of claim 1 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
6. A method for detecting ticket-based attacks within a domain, comprising the steps of:
using an authentication object inspector operating on a computing device comprising a memory and a processor to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
analyze a plurality of the stored network traffic records to determine a plurality of access paths;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.
7. The method of claim 6 , wherein the authentication object inspector is operated by the identity provider.
8. The method of claim 6 , wherein the authentication object inspector is operated by the identity provider.
9. The method of claim 6 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
10. The method of claim 6 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.