Detecting KERBEROS ticket attacks within a domain
A system and methods for mitigating authentication ticket attacks within a domain is provided, comprising an authentication object inspector configured to observe a new authentication object generated by an identity provider, and retrieve the new authentication object; and a hashing engine configured to retrieve the new authentication object from the authentication object inspector, calculate a cryptographic hash for the new authentication object, and store the cryptographic hash for the new authentication object in a data store; wherein subsequent access requests accompanied by authentication objects are validated by near-real-time comparison of hashes for each authentication object to previously-generated hashes.
1. A system for detecting and mitigating ticket-based attacks within a domain, comprising:
a computing system comprising a memory and a processor;
an authentication object inspector comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing system to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality calculations and transformations on the respective authentication object.
2. The system of claim 1 , wherein the authentication object inspector is operated by the identity provider.
3. The system of claim 1 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
4. A method for detecting and mitigating ticket-based attacks within a domain, comprising the steps of:
using an authentication object inspector operating on a computing device comprising a memory and a processor to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
analyze a plurality of the stored network traffic records to determine a plurality of access paths;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.
5. The method of claim 4 , wherein the authentication object inspector is operated by the identity provider.
6. The method of claim 4 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
7. Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system employing an asset registry platform for detecting and mitigating ticket-based attacks within a domain, cause the computing system to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
analyze a plurality of the stored network traffic records to determine a plurality of access paths;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.
8. The non-transitory, computer-readable storage media of claim 7 , wherein the authentication object inspector is operated by the identity provider.
9. The non-transitory, computer-readable storage media of claim 7 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.
10. A system for detecting and mitigating ticket-based attacks within a domain employing an asset registry platform, comprising one or more computers with executable instructions that, when executed, cause the system to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
analyze a plurality of the stored network traffic records to determine a plurality of access paths;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;
wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.
11. The system of claim 10 , wherein the authentication object inspector is operated by the identity provider.
12. The system of claim 10 , wherein the authentication object inspector is operated by a client device communicating with the identity provider over a network.