Computer networks are sus­cept­ible to cy­ber­at­tacks if they are not protected against them properly. Networks are protected by not allowing every single user access to shared data and services. In this way, only a des­ig­nated user can access a network. Protected entryways have to be in­teg­rated into an otherwise closed network. This requires the in­stall­a­tion of certain safety pro­ced­ures. With the NT LAN Manager (NTLM), Windows in­tro­duced its own au­then­tic­a­tion protocol back in 1993, but the protocol is now con­sidered largely outdated. How does ntlm au­then­tic­a­tion work?

What is NTLM?

NTLM is a col­lec­tion of au­then­tic­a­tion protocols created by Microsoft. Initially a pro­pri­et­ary protocol, NTLM later became available for use on systems that did not use Windows. The NT LAN Manager allows various computers and servers to conduct mutual au­then­tic­a­tion. Most networks attempt to deny access to un­au­thor­ised users, which requires im­ple­ment­a­tion of an au­then­tic­a­tion process.

The protocol requires a client to be au­then­tic­ated by providing a username and a cor­res­pond­ing password. This allows for an exchange to be es­tab­lished between the user’s device and a server. After the user’s log-in cre­den­tials have been re­cog­nised, the server can then check access rights and allow the user entry.

How does NTLM au­then­tic­a­tion work?

NTLM uses a challenge-response protocol to check a network user’s au­then­ti­city. To do so, the client and host go through several steps:

  1. The client sends a username to the host.
  2. The host responds with a random number (i.e. the challenge).
  3. The client then generates a hashed password value from this number and the user’s password, and then sends this back as a response.
  4. The host knows the user’s password and generates a hashed password value which it can then compare to the client’s response.
  5. If both values match, the au­then­ti­city of the client is confirmed, and network access is granted. If there is no match between the values, the client will be denied access.
Image: Exchange between a client and server during NTLM authentication
With NTLM, the client must first answer a challenge correctly before access to network services can be granted.
Fact

To keep a password sent over a network from being read by un­au­thor­ised third parties, a hash function is used in which the password is converted into an in­com­pre­hens­ible string of numbers with the help of a math­em­at­ic­al function. Since this con­ver­sion cannot be undone very easily, hash functions play a very important role in crypto­logy.

In­form­a­tion is partially relayed in the form of NTLM flags during the exchange between a client and a host. These are codes with a length of 4 bytes. Ne­go­ti­ation flags, which sometimes only differ from each other by one byte, provide in­form­a­tion on the status of the sign-in process.

Ap­plic­a­tions of NTLM

The NTLM protocol was conceived to connect several Windows machines to one another or to a server. The protocol provides security through the mon­it­or­ing of clients’ access rights. Windows uses NTLM as a single sign-on process (SSO); users only have to log in once to then have access to various ap­plic­a­tions within the domain.

NTLM is now con­sidered outdated, and Microsoft uses Kerberos instead. This newer au­then­tic­a­tion protocol is more secure. However, NTLM is still in use, es­pe­cially to support older services. If you are an ad­min­is­trat­or of a larger network, it may be advisable to stop using the NTLM protocol where it is not necessary. This will help to ensure that no client un­in­ten­tion­ally logs in to the network while using it, thereby creating a potential security breach.

NTLM protocol: pros and cons of this method

One advantage is that au­then­tic­a­tion through NTLM does not require users to send passwords un­pro­tec­ted via the network. Password delivery from the client to the server is only done in the form of hashed values which provide a high level of security. However, hashed values have the dis­ad­vant­age of being equi­val­ent to a password. If the trans­mis­sion is in­ter­cep­ted, the very security promised by the system can be com­prom­ised. Passwords are encrypted through MD4. This process is now con­sidered unsecure since these hashed values can be decrypted with re­l­at­ively little effort.

A further dis­ad­vant­age is that NTLM does not include multi-factor au­then­tic­a­tion (MFA). It is advisable to implement several security mech­an­isms, es­pe­cially when sharing sensitive data. The challenge-response protocol in NTLM only allows for a single au­then­tic­a­tion method: that of using a username and password.

Go to Main Menu