Mandiant Releases NTLMv1 Rainbow Table to Highlight Security Vulnerabilities

Security firm Mandiant has launched a rainbow table specifically designed to crack administrative passwords protected by Microsoft’s NTLM.v1 hash algorithm. This initiative aims to raise awareness among users who continue to utilize this deprecated hashing function, despite its known vulnerabilities.

Ars Technica

The rainbow table released by Mandiant allows for the recovery of passwords in under 12 hours using consumer-grade hardware costing less than $600 USD. This database is hosted on Google Cloud and targets Net-NTLMv1 passwords, which are commonly used in network authentication for accessing resources such as SMB network sharing. The construction of NTLMv1 rainbow tables is facilitated by the limited keyspace of the NTLMv1 algorithm, making it relatively straightforward to map stolen hashes to their corresponding plaintext passwords.

Ars Technica

Despite being known for its susceptibility to cracking for over two decades, NTLMv1 remains in use within sensitive networks. This persistence can be attributed to several factors, including reliance on legacy applications that are incompatible with more secure hashing algorithms and the operational challenges organizations face when migrating from established systems. Industries such as healthcare and industrial control often prioritize mission-critical systems, which can hinder necessary updates due to concerns over downtime.

Ars Technica

Mandiant stated, “By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.” The firm emphasized that while tools to exploit this protocol have existed, they often required sensitive data uploads to third-party services or expensive hardware for brute-forcing keys.

Ars Technica

Some cybersecurity experts have expressed concern that the release of such a rainbow table could inadvertently empower malicious actors. Critics argue that while the intention is to educate and improve security practices, the availability of this tool may lead to increased exploitation of vulnerable systems.

Ars Technica

Following the release of the rainbow table, Mandiant encourages organizations still using NTLMv1 to reassess their security protocols and consider migrating to more secure hashing algorithms. The firm’s initiative is expected to prompt discussions within the cybersecurity community regarding the ongoing use of outdated technologies in critical infrastructure.

Ars Technica

• “By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1,” — Mandiant, Security Firm

Ars Technica

• “While tools to exploit this protocol have existed for years, they often required uploading sensitive data to third-party services or expensive hardware to brute-force keys.” — Mandiant, Security Firm

Ars Technica