LAN Manager

LAN Manager was a (NOS) available from multiple vendors and developed by in cooperation with . It was designed to succeed 3Com’s network server software which ran atop a heavily modified version of .

Contents

History

LAN Manager was based on the operating system co-developed by IBM and . It originally used the protocol atop either the (NBF) or a specialized version of the (XNS) protocol. These legacy protocols had been inherited from previous products such as for , Xenix-NET for , and the afore-mentioned 3+Share. A version of LAN Manager for Unix-based systems called LAN Manager/X was also available.

In 1990, Microsoft announced LAN Manager 2.0 with a host of improvements, including support for TCP/IP as a transport protocol. The last version LAN Manager, 2.2, which included an MS-OS/2 1.31 base operating system, remained Microsoft’s strategic server system until the release of in 1993.

Many vendors shipped licensed versions, including:

  • 3Com Corporation 3+Open
  • HP LAN Manager/X
  • IBM LAN Server
  • Tapestry Torus

Cryptanalysis

LAN Manager authentication uses a particularly weak method of hashing a user’s password known as the LM hash algorithm, stemming from the mid 1980s when floppy viruses were the major concern as opposed to potentially high-frequency attacks with feedback over a (high-bandwidth) network. Kerberos is used in Active Directory Environments.

The major weaknesses of LAN Manager authentication protocol are:

  1. Passwords are not case sensitive. All passwords are converted into uppercase before generating the hash value. Hence it takes password, PassWord, PaSsWoRd, PASSword and other similar combinations same as PASSWORD converting all characters to uppercase. Password characters are also limited to a subset of the ASCII character set.
  2. Password length is limited to maximum of 14 characters
  3. A 14-character password is broken into 7+7 characters and the hash is calculated for the two halves separately. This way of calculating the hash makes it exponentially easier to crack, as the attacker need to brute force 7 characters twice instead of 14 characters. This makes the effective strength of a 14-characters password equal to twice that of a 7-character password, which is significantly less complex than the strength of a 14-character password.
  4. If the password is 7 characters or less, then the second half of hash will always produce same constant value (0xAAD3B435B51404EE). Therefore, if the length of password is less than or equal to 7 characters, then a password length of 7 characters or less can be identified visibly without using tools.
  5. The hash value is sent to the server on network without , making it susceptible to such as .

LM hash details

LM hash (also known as LanMan hash or LAN Manager hash) is a compromised password hashing function that was the primary hash that Microsoft LAN Manager and versions prior to used to store user passwords. Support for the legacy LAN Manager protocol continued in later versions of Windows for , but was recommended by Microsoft to be turned off by administrators; as of Windows Vista, the protocol is disabled by default, but continues to be used by some non-Microsoft implementations.

Algorithm

The LM hash is computed as follows:

  1. The user’s password is restricted to a maximum of fourteen characters.
  2. The user’s password is converted to .
  3. The user’s password is encoded in the System OEM .
  4. This password is null-padded to 14 bytes.
  5. The “fixed-length” password is split into two 7-byte halves.
  6. These values are used to create two keys, one from each 7-byte half, by converting the seven bytes into a bit stream with the most significant bit first, and inserting a null bit after every seven bits (so 1010100 becomes 10101000). This generates the 64 bits needed for a DES key. (A DES key ostensibly consists of 64 bits; however, only 56 of these are actually used by the algorithm. The null bits added in this step are later discarded.)
  7. Each of the two keys is used to DES-encrypt the constant string “KGS!@#$%”, resulting in two 8-byte ciphertext values. The DES CipherMode should be set to ECB, and PaddingMode should be set to NONE.
  8. These two ciphertext values are concatenated to form a 16-byte value, which is the LM hash.

Security weaknesses

Although it is based on , a well-studied and formerly secure , the LM hash is not a true as the password can be determined from the hash because of several weaknesses in its design: Firstly, passwords are limited to a maximum of only 14 characters, giving a theoretical maximum keyspace of 95^{14} approx 2^{92} with the .

Secondly, passwords longer than 7 characters are divided into two pieces and each piece is hashed separately; this weakness allows each half of the password to be attacked separately at cost than the whole, as only 95^{7} approx 2^{46} different 7-character password pieces are possible with the same character set. By mounting a on each half separately, modern desktop machines can crack LM hashes in a few hours. In addition, all lower case letters in the password are changed to upper case before the password is hashed, which further reduces the for each half to 69^{7} approx 2^{43}.

The LM hash also does not use , a standard technique to prevent . A attack, such as a rainbow table, is therefore feasible. In addition, any password that is shorter than 8 characters will result in the hashing of 7 null bytes, yielding the constant value of 0xAAD3B435B51404EE, hence making it easy to identify short passwords on sight. In 2003, , an implementation of the rainbow table technique, was published. It specifically targets the weaknesses of LM encryption, and includes pre-computed data sufficient to crack virtually all alphanumeric LM hashes in a few seconds. Many cracking tools, e.g. , and , now incorporate similar attacks and make cracking of LM hashes fast and trivial.

A final weakness of LM hashes lies in their implementation — since they change only when a user changes their password, they can be used to carry out a attack.

Workarounds

To address the security weaknesses inherent in LM encryption and authentication schemes, Microsoft introduced the protocol in 1993 with . For hashing, NTLM uses support, replacing LMhash=DESeach(DOSCHARSET(UPPERCASE(password)), "KGS!@#$%") by NThash=MD4(UTF-16-LE(password)), which does not require any padding or truncating that would simplify the key. On the negative side, the same DES algorithm was used with only for the subsequent authentication steps, and there is still no salting. Furthermore, Windows machines were for many years configured by default to send and accept responses derived from both the LM hash and the NTLM hash, so the use of the NTLM hash provided no additional security while the weaker hash was still present. It also took time for artificial restrictions on password length in management tools such as User Manager to be lifted.

While LAN Manager is considered obsolete and current Windows operating systems use the stronger NTLMv2 or Kerberos authentication methods, Windows systems before / enabled the LAN Manager hash by default for with legacy LAN Manager and or earlier clients, or legacy -enabled applications. It has for many years been considered good security practice to disable the compromised LM and NTLMv1 authentication protocols where they aren’t needed. Starting with Windows Vista and Windows Server 2008, Microsoft disabled the LM hash by default; the feature can be enabled for local accounts via a security policy setting, and for accounts by applying the same setting via domain . The same method can be used to turn the feature off in Windows 2000, Windows XP and NT. (25 October 1998) |- | | Not supported | Directory services client (released with Server, 17 February 2000) |- | | RTM | Directory services client (released with Server, 17 February 2000) |- | | RTM (17 February 2000) | RTM (17 February 2000) |- | | RTM (14 September 2000) | Directory services client (released with Server, 17 February 2000) |- | | ? | Version 3.0 (24 September 2003) |- | JCIFS | Not supported | Version 1.3.0 (25 October 2008) |- | (SMBFS) | 5.3 (2004) | Not supported as of v7.1 |}

Poor patching regimes subsequent to software releases supporting the feature becoming available have contributed to some organisations continuing to use LM Hashing in their environments, even though the protocol is easily disabled in itself.

Lastly, prior to the release of Windows Vista, many unattended build processes still used a boot disk (instead of ) to start the installation of Windows using WINNT.EXE, something that requires LM hashing to be enabled for the legacy LAN Manager networking stack to work.

Source

http://wikipedia.org/

See Also on BitcoinWiki