GIAC GSNA Exam - Topic 3 Question 92 Discussion

The following are the drawbacks of the NTLM Web Authentication Scheme:

NTLM Web authentication is not entirely safe because NTLM hashes (or challenge/response pairs) can be cracked with the help of brute

force password guessing. The 'cracking' program would repeatedly try all possible passwords, hashing each and comparing the result

to the hash that the malicious user has obtained. When it discovers a match, the malicious user will know that the password that

produced the hash is the user's password.

This authentication technique works only with Microsoft Internet Explorer.

Answer C and A are incorrect. NTLM authentication does not send the user's password (or hashed representation of the password)

across the network. Instead, NTLM authentication utilizes challenge/response mechanisms to ensure that the actual password never

traverses the network.

How does it work? When the authentication process begins, the client sends a login request to the telnet server. The server replies with a

randomly generated 'token' to the client. The client hashes the currently logged-on user's cryptographically protected password with the

challenge and sends the resulting 'response' to the server. The server receives the challenge-hashed response and compares it in the

following manner:

The server takes a copy of the original token.

Now it hashes the token against the user's password hash from its own user account database.

If the received response matches the expected response, the user is successfully authenticated to the host.