Why Is Kerberoasting on the Rise?
Kerberoasting is well known to the government because it’s been popular with many threat actors for some time.
“It’s difficult to detect, and most organizations don’t have the right security posture to detect those kinds of attacks in Active Directory,” Patton says.
The effectiveness of Kerberoasting depends directly on the strength of account passwords and authentication governance, says Jason Porter, CTO of Optiv and ClearShark.
“Many agencies and private and public organizations have implemented much stricter password governance,” Porter says. “However, they do allow exceptions to the rules, and this creates exploits open to Kerberoasting.”
Meanwhile, larger and more complex network implementations have become increasingly difficult to monitor and secure service accounts on, leaving vulnerabilities open to exploitation.
DISCOVER: These are the top cyber threats that agencies face today.
“With the evolution of cloud computing over the past 15 years, people continue to use Active Directory in a virtualized environment, increasing the number of accounts needing to be monitored, patched and serviced,” Porter says.
The attack can be carried out remotely, without the attacker interacting directly with the authentication server or the targeted network resources.
“This makes it difficult for defenders to identify and stop the attack before it is successful,” says Morgan Wright, chief security adviser at SentinelOne.
Techniques and information have become more available not only through the dark web but also through industry publications and forums.
How Does Kerberoasting Affect Agencies?
Agencies handle sensitive and classified information that, if compromised, can disrupt government operations and potentially compromise national security.
LEARN MORE: Encrypted attacks on agencies are on the rise.
If federal agencies rely on Microsoft AD, they must be proactive in defending against Kerberoasting to protect this highly confidential, and potentially detrimental, information.
Agencies tend to work with multiple providers to manage their networks, meaning that they are especially vulnerable to any Kerberoasting that exploits third parties in their software supply chain.
“It’s not enough for agencies to update their best practices for creating and reconfiguring service principal names for authentication,” Patton says. “They need to make sure their vendors are also taking precautions.”
This requires taking extra care as the end user of a managed service, including reviewing contract language in how Microsoft AD objects are created and maintained.
The impact of Kerberoasting on agencies falls into three main categories: unauthorized access and data breaches, elevation of privileges, and operational disruption, Porter says.
EXPLORE: CISA’s breach response is a model for other agencies.
“Successful attacks have led to unauthorized access to sensitive systems and data, while compromised service accounts provide elevated privileges, heightening the impact of a significant system compromise and free rein within the network,” Porter says. “Attacks will, and have, disrupted critical operations and services provided by public sector agencies.”
How to Detect and Defend Against Kerberoasting
Prevention of Kerberoasting should be the top priority for agencies, rather than detection after the fact, Patton says.
For example, through tactics such as regularly deprecating RC4 encryption instances, changing service account passwords, and requiring longer and more complicated passwords, agencies can render offline brute-force attacks useless.
“That said, strategies for detection are still crucial,” he says. “I recommend ensuring that a strong monitoring and alerts process is in place.”
Organizations can generate alerts for when new objects in Microsoft AD are created that might be susceptible to Kerberoasting. In response, security teams can take the time to verify that those objects have been created securely and remediate them if needed.
MORE FROM FEDTECH: Agencies are taking continuous monitoring seriously.
Agencies must strengthen their defenses against a Microsoft AD attack, and it is vital to identify identity settings within AD that leave it vulnerable to attack, Wright says.
“Another step is to use strong and unique passwords for all service accounts. Service account passwords are the same length and do not expire,” he says. “Make sure the passwords are greater than 25 characters.”
A growing tactic is the use of deception technology, which means that an organization can create fake accounts that are used to request service tickets from the Kerberos authentication service.
“Monitoring the fake accounts and the activity associated with them can provide insight into tactics and alert defenders to any attempts to exploit the vulnerability,” Wright says.
Threat hunting is another path to detecting unusual activity, allowing security operations center analysts to focus on unusual Kerberos activity.
“If it has not already been activated, use multifactor authentication,” Wright says. “The goal is to make each step harder and more time-consuming.”
