The Ghosts of NTLM

Imagine, if you will, a castle with walls that once stood as the epitome of medieval engineering. Strong, impervious to most battering rams, and impressive enough to ward off would-be invaders. Over time, however, the world moved on. Cannons arrived, followed by precision artillery. Yet, inexplicably, some villages never upgraded their defenses. They continued to trust in their venerable walls, assuming—perhaps hoping—they’d still hold.

This is, in essence, the story of NTLM, Microsoft's venerable (but creaky) authentication protocol. Once a marvel, it now teeters on the brink of irrelevance. But here’s the rub: NTLM isn’t quite dead yet. No, this ghost of protocols past continues to haunt the digital corridors of countless enterprises. And like any good ghost story, there’s a chilling twist—a zero-day vulnerability discovered by researchers at 0patch that lets attackers exploit NTLM in ways that are almost laughably simple. All they need is for a user to view a malicious file in Windows Explorer. Not open, mind you, but merely glance in its direction.

The Perils of a Digital Sidelong Glance

The vulnerability operates like this: Windows Explorer, in its helpfulness, triggers an outbound NTLM connection as soon as a malicious file is viewed. This interaction dutifully sends the user’s NTLM password hashes—essentially, the keys to the kingdom—to an attacker-controlled server. Once in their possession, these hashes can be relayed to access other systems, cracked to reveal plaintext passwords, or even leveraged for more widespread identity theft.

What’s most alarming isn’t just the simplicity of the attack but its sheer breadth. It affects every Windows version from the bygone Windows 7 to the shiny Windows 11 24H2, along with their server counterparts. It's as though a vulnerability had managed to sneak aboard every train from steam engines to bullet trains, exploiting the same fundamental design flaw: NTLM's outdated reliance on transmitting password hashes.

NTLM: A Time Capsule of Technology

NTLM, or NT LAN Manager, dates back to an era when floppy disks were cutting-edge and "The Matrix" was a preview of the cyber dystopia to come. Even its latest iteration, NTLM v2, while sturdier than its predecessor, remains fundamentally rooted in yesteryear’s security practices. At its core, NTLM transmits password hashes rather than plaintext passwords, which was a reasonable choice in its day but has since proven to be its Achilles’ heel.

It’s not just the protocol’s age that makes it vulnerable but its inability to adapt to modern security needs. NTLM doesn’t play nice with multi-factor authentication (MFA), and it falls apart under the scrutiny of relay attacks. It’s the digital equivalent of a castle without a moat—a relic trying desperately to remain relevant in a world of drones and laser-guided missiles.

Why, Oh Why, Is NTLM Still Around?

Here’s where it gets really baffling: despite being officially deprecated by Microsoft, 64% of Active Directory accounts continue to authenticate using NTLM. Why? The answer lies in the messy, cobwebbed world of IT infrastructure. Enterprises are reluctant to rip out systems that still technically “work.” Legacy software, custom-built applications, and organizational inertia all conspire to keep NTLM alive.

This lingering dependence on NTLM is a bit like finding a VHS player in an otherwise modern home: charming, perhaps, until you realize it’s hooked up to the house’s security system.

What Can Be Done?

For those hoping Microsoft will ride to the rescue with a patch, history suggests patience will be required. In the meantime, defenders must take matters into their own hands. Here are some strategies to exorcise—or at least tame—the NTLM specter:

1. Harden What You Can

Microsoft provides tools to limit NTLM’s use. Enabling Extended Protection for Authentication (EPA) and enforcing channel binding on LDAP can significantly reduce the attack surface. Scripts are available for retrofitting older systems like Exchange Server 2016 with these protections.

2. Audit and Monitor NTLM Usage

Administrators can enable auditing for NTLM traffic to identify legacy systems or applications that still depend on it. This is the IT equivalent of checking which rooms in the castle are still lit by candles.

3. Implement Modern Protocols

The long-term solution is to phase out NTLM entirely. Kerberos, with its ticket-based authentication, is more secure and compatible with modern defenses like MFA. Transitioning to Kerberos is not without its challenges, but it’s a far safer bet than clinging to NTLM.

4. Use Risk-Based Authentication

Dynamic access policies can add an additional layer of security for systems that must continue using NTLM. Think of it as setting up tripwires and alarms in the less-defensible corners of your digital fortress.

5. Control Outbound SMB Traffic

Blocking outbound SMB traffic to untrusted networks can prevent NTLM hashes from being transmitted to rogue servers. This is akin to ensuring that castle messengers don’t unwittingly deliver sensitive information to enemy spies.

A Final Word

The story of NTLM’s persistence is both a cautionary tale and a call to action. It underscores the dangers of technological inertia and the risks of assuming that yesterday’s defenses will hold against today’s attackers. If NTLM is the ghost in your network, it’s time to stop ignoring the creaks in the floorboards and start rebuilding your walls.

Because in cybersecurity, as in life, the past has a way of catching up with you. And when it does, it rarely knocks before entering.