How to Stop Pass-the-Hash Attacks on Windows Desktops

The recent publication of attack techniques and the lack of preventative tools have forced enterprises to rely on ineffective techniques to mitigate this risk. Fortunately, by removing administrative rights from all users and leveraging a Windows privilege management solution like PowerBroker for Windows, you can mitigate this risk throughout your organisation. Some of these techniques steal hash information from the current user logged in locally or via RDP. When those sessions contain privileges above a standard user, the malware or hacker has an advantage because they can elevate their privileges from system to system – from low-level user to high-value permissions such as help desk personnel or domain administrators. The key to protecting these systems when modern tools are not available for Windows 8.1 or Windows 2012 R2 is to never give elevated privileges to users in the first place. Therefore, if malware does infect a host, the hacker can only gain standard user access despite any lateral movement they are able to obtain without leveraging another vulnerability. So, how does PowerBroker for Windows help? The solution doesn’t elevate the permissions of the user, but rather changes the application’s security token using patent-pending technology: Again, the user’s privileges never change and the modified application runs with the new security token, which can be customised to any level required for the application to correctly function: As a result, the user never has a hash that malware or a hacker can leverage against another resource with elevated permissions. In addition, the privileges granted to the application could either be executed as a full administrator or customised to only allow the privileges or process required for the task to execute. For example, the application can be granted full administrative privileges but denied access to shut down the system. The fact remains that, in most organisations, too many users have excessive privileges. Hacking techniques like Pass-The-Hash have been successfully used to maliciously compromise entire infrastructures. Simply removing privileges can cripple business productivity, since critical applications and tasks can no longer function correctly as a standard user. A tool or technique is needed to bridge that gap, and PowerBroker for Windows is that solution. PowerBroker for Windows preserves the privileges granted to the user and only modifies the application’s runtime security token to meet the needs of the application (on a per application basis). With over 250 rules in PowerBroker’s sample rules library, you do not need to start from scratch to make this change a reality. Our best practices guide, professional services team, and years of experience in privileged account management can help make hacking techniques like this a moot point for your business.

• Learn more about privilege management with PowerBroker for Windows
• Request a free trial of PowerBroker for Windows