Forest Global Training Partners

Cyber Risks · Krebs on Security

Local Networks Go Global When Domain Names Collide

Summary: Security researcher Philippe Caturegli of Seralys scanned the open Internet for self-signed certificates and found more than 9,000 distinct domains across business-oriented TLDs where organizations had built internal Active Directory on names they do not own. After registering memrtcc.ad for $160 plus $500 for a trademark, he received authentication requests containing usernames and hashed Windows passwords from hundreds of Memphis, Tenn. police laptops, and his wpad.ad server logged more than 140,000 hits from Windows hosts worldwide in one week.

Why it matters: Caturegli's point is that ransomware gangs could harvest large volumes of Windows credentials for a small up-front investment by simply waiting for misconfigured workstations to connect and send them, and the City of Memphis is still working to transfer its domain to itself.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related