Jake Karnes News Today : Breaking News, Live Updates & Top Stories | Vimarsana

While helping Andrew Schwartz with his Kerberos FAST post (which has more information about what FAST is and how it works, so have a read), I noticed something interesting. AS-REQs for machine accounts are unarmored. This is described by Microsoft here: Kerberos armoring uses a ticket-granting ticket (TGT) for the device to protect authentication service ... The post New Attack Paths? AS Requested Service Tickets appeared first on Semperis.

Windows Kerberos Bronze Bit attack gets public exploit, patch now By Proof-of-concept exploit code and full details on a Windows Kerberos security bypass vulnerability have been published earlier this week by Jake Karnes, the NetSPI security consultant and penetration tester who reported the security bug to Microsoft. The security bug tracked as CVE-2020-17049 and patched by Microsoft during November 2020's Patch Tuesday can be exploited in what the researcher has named as Kerberos Bronze Bit attacks. Karnes provides a high-level summary of the vulnerability and details on how attack...