Network-based Kerberos ticket forgery detection
Methods and systems for detecting forged Kerberos protocol tickets are presented. In one embodiment, a method is presented that includes receiving and decrypting an authentication request including a ticket. A validity start time and a validity end time may then be extracted from the ticket and a validity period may be calculated based on the validity start time and the validity end time. The method may then include retrieving a domain validity period from a domain controller and comparing the validity period to the domain validity period. If the validity period differs from the domain validity period, the authentication request may be blocked.
1. A method comprising:
receiving an authentication request including a ticket;
decrypting the authentication request and the ticket;
extracting validation information from the decrypted authentication request;
extracting, from the validation information, a request time stamp including one or more of a log on time, a log off time, a kick off time, a last successful log on time, a last failed log on time, or a password last set time;
comparing the request time stamp to a corresponding known ticket-forgery-tool-populated default time stamp value; and
blocking the authentication request responsive to determining that the request time stamp matches the corresponding known ticket-forgery-tool-populated-default time stamp value.
2. The method of claim 1 , wherein the authentication request is a TGS-REQ request directed to a domain controller according to the Kerberos protocol and the ticket is a ticket granting ticket.
3. The method of claim 2 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from the domain controller, a password hash for a key distribution service center account; and
decrypting the authentication request and the ticket with the password hash.
4. The method of claim 1 , wherein the authentication request is an AP-REQ request directed to a domain server according to the Kerberos protocol and the ticket is a ticket granting service ticket.
5. The method of claim 4 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from a domain controller, a password hash associated with a key distribution service center account; and
decrypting the authentication request and the ticket with the password hash.
6. The method of claim 1 , wherein blocking the authentication request includes one or more of denying the authentication request, alerting a user to the authentication request, presenting a multi-factor authentication challenge, and requesting additional information regarding network traffic of a computing device associated with the authentication request from a domain controller.
7. A system comprising:
a central processing unit (CPU); and
a memory couple to the CPU, the memory storing thereon computer-executable instructions that, when executed by the CPU, cause the CPU to perform operations, the operations comprising:
receiving an authentication request including a ticket;
decrypting the authentication request and the ticket;
extracting validation information from the decrypted authentication request;
extracting, from the validation information, a request time stamp including one or more of a log on time, a log off time, a kick off time, a last successful log on time, a last failed log on time, or a password last set time;
comparing the request time stamp to a corresponding known ticket-forgery-tool-populated default time stamp value; and
blocking the authentication request responsive to determining that the request time stamp matches the corresponding known ticket-forgery-tool-populated-default time stamp value.
8. The system of claim 7 , wherein the authentication request is a TGS-REQ request directed to a domain controller according to the Kerberos protocol and the ticket is a ticket granting ticket.
9. The system of claim 8 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from the domain controller, a password hash for a user account associated with a key distribution service center account; and
decrypting the authentication request and the ticket with the password hash.
10. The system of claim 7 , wherein the authentication request is an AP-REQ request directed to a domain server according to the Kerberos protocol and the ticket is a ticket granting service ticket.
11. The system of claim 10 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from a domain controller a password hash associated with the domain server; and
decrypting the authentication request and the ticket with the password hash.
12. A non-transitory computer-readable media storing thereon computer-executable instructions that, when executed by a central processing unit (CPU), cause the CPU to perform operations, the operations comprising:
receiving an authentication request including a ticket;
decrypting the authentication request and the ticket;
extracting validation information from the decrypted authentication request;
extracting, from the validation information, a request time stamp including one or more of a log on time, a log off time, a kick off time, a last successful log on time, a last failed log on time, or a password last set time;
comparing the request time stamp to a corresponding known ticket-forgery-tool-populated-default time stamp value; and
blocking the authentication request responsive to determining that the request time stamp matches the corresponding known ticket-forgery-tool-populated default time stamp value.
13. The system of claim 7 , wherein user information corresponding to the validation information includes (i) a user security ID, (ii) a user group identifier, and (iii) user group membership data.
14. The non-transitory computer-readable media of claim 12 , wherein retrieved user information corresponding to extracted validation information includes (i) a user security ID, (ii) a user group identifier, and (iii) user group membership data.
15. The system of claim 7 , wherein blocking the authentication request includes one or more of denying the authentication request, alerting a user to the authentication request, presenting a multi-factor authentication challenge, and requesting additional information regarding network traffic of a computing device associated with the authentication request from a domain controller.
16. The non-transitory computer-readable media of claim 12 , wherein the authentication request is a TGS-REQ request directed to a domain controller according to the Kerberos protocol and the ticket is a ticket granting ticket.
17. The non-transitory computer-readable media of claim 16 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from the domain controller, a password hash for a key distribution service center account; and
decrypting the authentication request and the ticket with the password hash.
18. The non-transitory computer-readable media of claim 12 , wherein the authentication request is an AP-REQ request directed to a domain server according to the Kerberos protocol and the ticket is a ticket granting service ticket.
19. The non-transitory computer-readable media of claim 18 , wherein decrypting the authentication request and the ticket further comprises:
extracting, from a domain controller, a password hash associated with a key distribution service center account; and
decrypting the authentication request and the ticket with the password hash.
20. The non-transitory computer-readable media of claim 12 , wherein blocking the authentication request includes one or more of denying the authentication request, alerting a user to the authentication request, presenting a multi-factor authentication challenge, and requesting additional information regarding network traffic of a computing device associated with the authentication request from a domain controller.