Skip to main content

Questions about 2FA for AD admins

Posted by: root 2 years, 10 months ago

We've recently had more questions about deploying WiKID for two-factor authentication for AD admins to thwart potential privilege escalation in ransomware attacks.  We've done a proof-of-concept showing that WiKID can make privilege escalation quite difficult.  We realized that we missed a key question about deploying two-factor authentication for admins:  how do I know I won't lock out all my admins?  That's a damn good question.  And here's the answer:

When an admin requests a one-time password from WiKID, it overwrites the current AD password with the OTP.  The admin logs in and after the OTP expires, it overwrites it with a random long string.  No one knows the value of this string and it's never used on the network.  If Mimikatz or any other pass-the-hash malware attempts to log in with the OTP, it will fail.  It should also trigger an alarm that there's something nasty in your network.
 
The WiKID server is really just acting like a password reset service (and yes, we have that functionality too).   In order to 'turn off' two-factor for any account, just manually replace the random string with a password for that user. Obviously, you want these account credentials secured and not used remotely.
 
Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom