Why is Windows password security designed this way?

Question

Let's start with the LM hash. The LanMan hash had MONUMENTAL security flaws, like the password being case insensitive (converted to upper), which reduced the keyspace for a brute force attack. On top of that, >7 character passwords were split into two hashes, reducing the brute force time exponentially. And it is noted that it's not even a true one way function. Next came the NTLM hash, designed to fix the flaws that LM hashes had. It is better, but it is still missing basic password security features, like computation time and salts. Windows passwords are not salted, and the NTLM hash can be calculated really fast with little overhead, making a perfect target for brute force and rainbow table attacks, not to mention bypassing the password entirely by passing the hash.

My question is, why did Microsoft design the password security this way? The weaknesses in LM make it seem almost like Microsoft deliberately put in back doors. Even MD5 would have been much more secure. Why is there LM still supported in some Windows versions, and why isn't NTLM more secure?

Answer 1

Well, first off with LanMan you have to remember that it was designed and implemented in a very, very different security context than we're facing today, or even than we were facing when NTLM & NTML v.2 were designed and implemented. It's probably going a little far to say that Microsoft--really, the tech industry in general--didn't care much at all about security back in the mid 1990s when LanMan was introduced. But as a concern and a priority it was a very, very different time. Windows didn't even have a multi-user model back then. Or administrator vs. user account privilege levels. Or interface with any kind of Windows Server network with anything like any Active Directory/ enterprise grade authentication/identity system. It's sort of like the question of why the earliest versions of Internet Explorer and Netscape Navigator had almost no security protections whatsoever compared to the major browsers today. Different circumstances, different threat environment, different level of technological knowledge about how to build more secure system elements.

Regarding NTLM (and even NTLM v.2), yeah that's a bit harder to absolve Microsoft of. Was NTML a considerable advance over what come before it? As you point out, absolutely. Has Microsoft tried to move away from NTLM via emphasizing using Kerberos authentication as a much more secure model (at least where Kerberos is used)? Yes. But has Microsoft propagated unsecure practices by continuing to rely on NTLM v.2 in the many situations that Kerberos doesn't cover? Given the weaknesses in the NTLM approach that you talk about, I think the answer to that has to be "Yes".

Why is NTLM still in use? Why hasn't Microsoft replaced it with something more robust to cover circumstances where Kerberos isn't used? Here we're getting more fully into speculation territory. But if I had to speculate, I would say that (1) one has to remember how intensively Microsoft has historically been committed to backwards compatibility, especially in the networking and authentication areas; and (2) there actually is a pretty good question about how much extra security that an NTLM replacement would really provide. As you pointed out, NTLM has plenty of problems in terms of its resistance to cracking the hash, but most Windows authentication bypasses aren't accomplished by stealing an NTLM hash and cracking it to gain the cleartext password. Instead, attackers often take the easier ways of (a) passing the hash, if we're talking about non-Kerberos authentication to a network, or (b) just resetting an administrator password via command line in the recovery environment if you have local access to a machine. Considering those points, and that the only really secure way of locking down the contents of your PC against a local attacker--full disk encryption with Bitlocker, with TPM unlock--has nothing to do with NTLM, one can argue that replacing NTML v.2 with some kind of modern,much harder "NTLM v.3" (or whatever you might call it) would do less good than one might think.

(Still, I do have to agree with your sentiment. In my view, it's something Microsoft should have done. In the Windows Vista or Windows 7 eras.)

All of the above being said, I do think that with Windows 10 Microsoft has actually begun to make some first major steps toward finally getting away from NTLM--and password hashes vulnerable to theft/passing/cracking altogether, actually. Credential Guard is designed to use a virtualized secure area to safeguard authentication info--starting with password hashes--against theft or cracking even if the main OS kernel is fully compromised. The combination of Passport and Windows Hello is designed to do away with password hash based-authentication altogether: entering a password, PIN, and/or using biometric authentication just unlocks a private key for use to sign an authentication ticket in a secure part of the OS, which is then sent to the remote server. (Or, at least, that's the way things will supposedly work when all the promised Passport and Credential Guard capabilities are actually,finally delivered into Windows 10. Right now the functionality of those elements are only partially in the OS and/or enabled.)

So, change is coming. Sort-of. Slowly.