[HN Gopher] Releasing rainbow tables to accelerate Net-NTLMv1 pr...
___________________________________________________________________
Releasing rainbow tables to accelerate Net-NTLMv1 protocol
deprecation
Author : linolevan
Score : 145 points
Date : 2026-01-16 21:42 UTC (1 days ago)
(HTM) web link (cloud.google.com)
(TXT) w3m dump (cloud.google.com)
| ubuntulover2011 wrote:
| pretty cool
| postepowanieadm wrote:
| Can't wait for someone to decide one of protocols used by google
| needs to be deprecated.
| bawolff wrote:
| Plenty of protocols used by google over the years have been
| deprecated. The difference being that google actually stops
| using insecure protocols when they are discovered to be
| insecure instead of trying to sweep things under the rug.
|
| Keep in mind we are talking about a protocol from 1987. How
| many protocols from 1987 is google currently using?
| schmuckonwheels wrote:
| Google does whatever is convenient and makes them money.
| Altruism was never part of the equation.
| bawolff wrote:
| Sure. Not being hacked is good for business.
|
| Keep in mind that google is primarily a cloud business.
| That means that they take on a lot more of a risk, as when
| they are hacked its a them problem vs traditional software
| where its much more the customer's problem. Security is
| very much about incentives, and the incentives line up
| better for google to do the right thing.
| schmuckonwheels wrote:
| It's more about when Google assumed full control of the
| cloud, the browser, the OS, and everything in between
| they self-appointed themselves as the unelected standards
| board of the Internet, and forced everyone else to follow
| their whims and timelines. Some of which are completely
| insane.
| Fogest wrote:
| What are the policies you view as "completely insane"? I
| have some I disagree with like how they've handled things
| like Manifest v3 in the browsers, however there are still
| alternatives like Firefox anyway. However I think in
| terms of web standards some of the things they have
| pushed are also helpful. It's been much nicer having a
| much more consistent web browsing experience with less
| things like "You must use Internet Explorer on this
| site".
|
| I feel like web browser and website standards are one of
| the main areas Google has a lot more control of policies.
| Is there somewhere else they have much control of for
| standards?
| lmz wrote:
| Re: the IE thing. Only Apple's insistence on Safari in
| iOS is stopping sites from basically being chrome only.
| duskdozer wrote:
| >It's been much nicer having a much more consistent web
| browsing experience with less things like "You must use
| Internet Explorer on this site".
|
| What browser do you use?
|
| Because I've definitely run into this but s/ie/chrome/
| but with no helpful message. You just have to guess that
| that's why it's broken
| solarkraft wrote:
| And you're implying making Windows networks less insecure
| is completely insane?
| fn-mote wrote:
| This is such a negative reading of the situation. You're
| talking about something that has been compromised for TWO
| DECADES.
|
| At least now nobody can pretend.
|
| I for one hope that this hastens the demise of every
| remaining use.
| Retr0id wrote:
| Well, you'll be waiting 20 years or so post-deprecation if you
| want an equivalent timeline.
| schmuckonwheels wrote:
| Google thrives on being the Internet's biggest bully.
|
| It turns out when nerds get a billion dollars they like being
| bullies too.
| RobotToaster wrote:
| Google does that every Tuesday
| aunty_helen wrote:
| > under 12 hours using consumer hardware costing less than $600
| USD
|
| Great, so someone with half a motherboard can break this hash
| RobotToaster wrote:
| Or 1gb of ram, but not both
| schmuckonwheels wrote:
| "To demonstrate how crappy most front door locks are, to boost
| our company's social media cred we will be leaving drills and a
| dish of bump keys at the entrance of the neighborhood."
| bigfatkitten wrote:
| NTLMv1 rainbow tables have been available for 15-20 years. The
| only thing new is that Google are publishing theirs.
| coopreme wrote:
| NTLM is often used for more of the underlying technologies,
| some more secure than others... nthash, net-ntlmv1, net-
| ntlmv2. There's a little more complexity here and this is
| different than the stuff that was out 15 years ago
| bri3d wrote:
| > this is different than the stuff that was out 15 years
| ago
|
| This stuff was out at least 10-15 years ago. It's different
| from the ancient local ntlm hash cracking everyone used to
| get admin in high school, yes, but it's not a novel
| technique.
|
| on cursory google, https://github.com/NotMedic/NetNTLMtoSil
| verTicket/blob/maste... is 6 years old and was old news
| when it was committed, and https://crack.sh/netntlm/ has
| been around online for at least 10 and I think more like
| 15+ years.
| patmorgan23 wrote:
| Microsoft has deprecated NTLM and is actively ripping it
| out of windows.
|
| https://support.microsoft.com/en-us/topic/upcoming-
| changes-t...
|
| Windows 11 is probably the last version that will contain
| NTLM (and hopefully NTLMv2). Going forward everything will
| be Kerberos or Oauth based.
| bigfatkitten wrote:
| Ironically enough, the things that tend to break first
| when you try to turn off NTLM are still Microsoft
| products like ADCS.
| reincarnate0x14 wrote:
| You're not wrong, I just want to point out this is net-lmvm1,
| which is different and more complex. Not functionally
| meaningfully more complex to an adversary with a few hundred
| USD (almost typed LSD) in monies. But technically larger
| tables. That being said I'm in agreement that this has been
| known problem for 10+ years, and Google is just saying the
| horses are so long out of the barn their grandchildren are
| grazing.
| throawayonthe wrote:
| you say that like it's a negative analogy
| kstrauser wrote:
| The bad guys already know you live in a bad neighborhood and
| have been closing your front door with a plastic combination
| lock you got in a Happy Meal 40 years ago. They can already
| come and go at a whim. This is Google letting _you_ know that
| your crappy lock is pre-broken to encourage you to upgrade to
| literally anything else.
| sequin wrote:
| It's certainly morally and legally dubious to facilitate
| attacks on things that others choose to use in within their own
| private domains, just because you disagree with that choice.
| But that's how these people roll.
| reincarnate0x14 wrote:
| It's been 15 years since this was known broken. If you had
| children when it was not known broken, they'd be almost old
| enough to drive in most western nations.
|
| At some point the line must be drawn.
| oskarw85 wrote:
| Some are very entitled to drawing lines on someone else's
| property. Why don't you mind your own business?
| reincarnate0x14 wrote:
| I mean this kindly, but if you're still using net-netlmv1
| on anything that matters, you need to pay much more mind
| to your own business because even the original vendor of
| it has been telling you to get off that since 1999
| because it is not safe.
|
| If you're using it on something that doesn't matter, then
| it also doesn't matter that rainbow tables any attacker
| could have already had for a decade are slightly more
| available.
| observationist wrote:
| This empowers script kiddies, but not significantly moreso than
| they already were. Of all the places this is still in use,
| they've been exposed for years, so this isn't likely to result in
| a a bunch of new exploitations.
|
| However, it's most likely to be used by governments, with legacy
| servers that are finicky, with filesharing set up that's impacted
| other computers configured for compatibility, or legacy ancient
| network gear or printers.
|
| I wonder who they're pushing around, and what the motivation is?
| bigfatkitten wrote:
| Mandiant is Google's incident response consulting business.
| Having worked for many years in that field myself (though not
| for Mandiant), they're probably sick of going to the same old
| engagements where companies have been getting owned the same
| way over and over again for the last 15 years.
|
| What releases like this do is give IT ops people the ammunition
| they need to convince their leadership to actually spend some
| money on fixing systemic security problems.
| alfiedotwtf wrote:
| > Mandiant is Google's incident response consulting business
|
| Consulting business? I was under the impression (from Google
| Reader) that if users aren't in the millions, then they'll
| kill the project. How could they also run a high-touch
| consultancy?!
|
| > they're probably sick of going to the same old engagements
|
| Hmm... consultancies love this type of recurring revenue -
| it's easy money
| wolpoli wrote:
| > Consulting business? I was under the impression (from
| Google Reader) that if users aren't in the millions, then
| they'll kill the project. How could they also run a high-
| touch consultancy?!
|
| Google also has the Project Zero which doesn't fit into
| Google business culture either. I wonder if Mandiant is
| paying for their payroll.
| bri3d wrote:
| Project Zero has been around for 8 years before the
| Mandiant acquisition.
| wolpoli wrote:
| My bad. Still not sure which business unit is paying for
| their payroll.
| hiddencost wrote:
| Google is a quarter million person company (if you count
| full time, temps, vendors and contractors).
|
| Google Cloud is basically an entirely different company
| than Search or Maps. Cloud will happily sell you $10m in
| compute a year and a value add $400k of security
| consulting.
| Retr0id wrote:
| I suspect Mandiant hears a lot of "this is impractical to
| exploit so we don't care" from their clients. Now they have a
| compelling rebuttal to that.
| freedomben wrote:
| It also empowers IT depts and cybersecurity people to be able
| to easily build a PoC to show why moving on from the deprecated
| protocol is important. In many white-hat jobs you can't just
| grab rainbow tables from a torrent, so a resource like this is
| helpful. For the grays and black hats, they've had access to
| rainbow tables like this for a very long time, so no change
| there.
| Xirdus wrote:
| Out of curiosity, why can't white hats grab rainbow tables
| from torrents? Is it about seeding?
| sethhochberg wrote:
| Its less about torrents being the delivery mechanism and
| more about bringing data from a potentially unknown source,
| under potentially unknown licensing, and distributed for a
| potentially unknown reason into the corporate computing
| environment.
|
| Torrents would be a perfectly valid way for Google to
| distribute this dataset, but the key difference would be
| that Google is providing it for this purpose and presumably
| didn't do anything underhanded to collect or generate it,
| and tells you explicitly how you're allowed to use it via
| the license.
|
| That sort of legal and compliance homework is good practice
| for any business to some extent (don't use random p2p
| discoveries for sensitive business purposes), but is
| probably critical to remain employed in the sorts of giant
| enterprises where an internal security engineer needs to
| build a compelling case for spending money to upgrade an
| outdated protocol.
| stackskipton wrote:
| Any business that needs convincing to move on from anything
| labeled NTLM does not care what "nerds" have to say. They are
| either one of those "I'm not spending money on something that
| works" or stuck with such legacy technical debt that at this
| point, removing it from environment is too costly to even
| consider so executives kick it down the road.
| reincarnate0x14 wrote:
| You've been able to find these for years. In fact it's entirely
| possible they just grabbed some or all of them out of an
| existing torrent originally.
|
| It would completely not surprise me if there are automagic
| attacks on net-ntlmv1 at this point against some cloud hosted
| storage. This has been doable by anyone since like 2016 if you
| had the space and weren't prevented from using that protocol
| version.
| TacticalCoder wrote:
| Holy smoke. I honestly thought the 90s called and wanted their
| Windows exploits back (TFA mentions 1999). I do remember talk
| about this from many moons ago.
|
| But we are in two-thousand-twenty-FUCKING-six.
|
| It's unbelievable. Just plain unbelievable.
| 1970-01-01 wrote:
| They're just dumping them out as 2GB blobs onto a cloud? Where is
| the zippy search UI? Very lazy behavior for the hyper giant
| Google.
| Nerada wrote:
| Right? I feel like rainbow tables for NTLM have been around for
| decades, though at-cost. This seems incredibly low effort on
| Google's part.
| MadnessASAP wrote:
| They don't know how to count that low.
|
| https://www.lesswrong.com/posts/koGbEwgbfst2wCbzG/i-don-t-kn...
| bawolff wrote:
| Why would you want a search UI for a rainbow table? That makes
| no sense.
| 1970-01-01 wrote:
| A.
|
| That's the most likely use case for anyone. You want the one-
| offs when cracking, and not a compressed 2GB blob of data
| that may or may not have your answer.
|
| B. The king of search has held the goal of organizing and
| making information useful and searchable since dinosaurs
| roamed the WWW.
|
| https://www.google.com/intl/en_us/search/howsearchworks/our-.
| ..
|
| C. It's just lazy and shows that they don't actually care
| anymore. Making a custom search has been their bread and
| butter for decades. The last step is the easiest but they
| could not be bothered.
| bflesch wrote:
| I wonder how the Mandiant acquisition is regarded within google.
|
| Was it a success? Is Mandiant a cash cow or was it basically an
| acquihire?
|
| The big "contact mandiant" button next to the post feels a bit
| like trying to stay relevant and acquire more customers.
| warkdarrior wrote:
| > trying to stay relevant and acquire more customers
|
| Is there any business that does NOT try to do this? Why
| wouldn't they?
| Cantinflas wrote:
| Funeral service providers, for obvious reasons.
| BrandoElFollito wrote:
| This is like reminding that there are CVSes from 2010. Yes there
| are. And there are plenty of vulnerable systems.
|
| They decided to not fix the vulns (either directly by not
| patching, or indirectly by not investing in cybersecurity). So
| exploiting them is somehow an act of mercy. They may not know
| they have a problem and they have an opportunity to learn.
|
| Let's just hope they will have white or gray-ish hats teaching
| the lesson
| davidkellis wrote:
| Didn't l0phtcrack do this like 25 years ago?
| rubyfan wrote:
| I actually got a job that long ago by using l0phtcrack to
| expose an admin password for an NT4 network.
| coopreme wrote:
| NTLM is not Net-NTLM- l0pht did ntlm
| dbetteridge wrote:
| I recall using ntlm rainbow tables to crack windows hashes in
| high school in like 2008?
|
| Amazing that this is still around and causing someone enough of a
| headache to justify spending money on.
|
| Also amazing what a teenager with lots of free time and a
| bootable Linux usb can get up to.
| coopreme wrote:
| LM, nthash aka NTLM, net-ntlmv1 aka ntlmv1, net-ntlmv2 aka
| NTLMv2. Challenge response stuff is different. Naming here is
| painful.
| dbetteridge wrote:
| Ah Microsoft and naming things... Name a better combo
|
| But fair enough, I don't recall which exact version I was
| mucking with that long ago.
| coopreme wrote:
| Ya they just announced they are renaming security algos to
| copilot!!! story here -> https://dubious-adware-breach-
| scam@is.gd/WVZvnI?exploit.bat
| phanimahesh wrote:
| Love this. Classic microsoft.
| CableNinja wrote:
| A few years ago i was doing some vm things in azure. Hadnt
| touched azure before, and spent 10+ minutes of frustration
| trying to figure out how to get amd64/x86_64 things
| started, as the only thing i could find was "Azure ARM",
| and on googling, "arm" here means azure resource manager...
| ARGH why does microsoft insist on using existing names and
| acronyms!?!?
| antonkochubey wrote:
| Because in their eyes if something was not invented here,
| it may as well not exist :-) they haven't managed to cure
| this sickness in decades.
| bri3d wrote:
| net-ntlmv1 rainbow tables have been around forever too
| though, the same attack documented in this blog post has been
| hosted as a web service at https://crack.sh/netntlm/ for 10+
| years
| 1over137 wrote:
| Yeah, but now it's Google! Google!
| eerikkivistik wrote:
| There used to be a joint online project to compute these tables
| in a SETI like distributed system. Everyone who contributed
| their CPU cycles, could use the tables. And yeah, around
| 2005-2008.
| rootsudo wrote:
| yep, that and also can use cain and abel even back then...
| hardest part was putting whatever network card in promiscious
| mode.
| themafia wrote:
| And terrorism is just an abstract way of securing underprepared
| government facilities.
| ruined wrote:
| if you think about it, the united states terrorism risk
| insurance act distorts the terrorism market by subsidizing
| terrorism-generating activity
|
| https://home.treasury.gov/policy-issues/financial-markets-fi...
| afn wrote:
| Tangent: this link looks like a right-wing propaganda site; I
| wouldn't trust any information there without verifying it
| with trusted sources.
|
| > Thanks to the President's decisive leadership in the face
| of radical left-wing obstructionism, the Department of the
| Treasury has now resumed normal operations.
| dijit wrote:
| its an official government website
| Sytten wrote:
| Yeah that protocol is very very broken. I recently did an ntlm
| plugin implementation for Caido [1] and I had to fork our crypto
| JS module to add back MD4 and 3DES.
|
| [1] https://github.com/caido-community/ntlm
| archi42 wrote:
| For those interested: The SHA512 file lists 4096 files. Each file
| is 2 GiB. That means 8 TiB (or about 8.6 TB) of storage required.
| myself248 wrote:
| Rule of thumb: Saturating 100Mbps moves roughly 1TB/day.
| londons_explore wrote:
| Really curious how this was discussed with the legal team...
|
| "We're releasing hacking tools to allow others to break into
| poorly secured computer systems... But we are doing it with good
| intentions so it won't be illegal right??"
| nkrisc wrote:
| Isn't this more or less a case of "illegal numbers"?
| kotaKat wrote:
| "Educational use only", just like every other skiddie tool you
| can freely grab on the Internet these days.
|
| _(The bane of my existence thanks to everyone and their mother
| releasing ESP32 Wi-Fi /Bluetooth/etc deauther 'tools'...)_
| preisschild wrote:
| Maybe actually secure your network then :D
|
| 802.11w exists
| londons_explore wrote:
| Doesn't protect against an attacker who just sends RTS +
| CTS packets every 50 microseconds, preventing all other
| wifi devices from transmitting anything (inc beacons).
|
| As a bonus, even wireshark won't detect anything for
| debugging, because the RTS+CTS handshake typically can't be
| sent to the linux kernel+higher layers.
|
| An ESP32 is capable of doing that on all wifi channels
| 'simultaneously' (ie. round robin, but getting back to the
| start channel within the timeout), effectively blocking all
| wifi.
| darkamaul wrote:
| Second this.
|
| I didn't expect Google (Mandiant) to release rainbow tables
| ever. Curious what changed internally to make that acceptable
| now.
| nubskr wrote:
| Mandiant releases rainbow tables for a 25 year old broken
| protocol because enterprises still won't disable it. It seems
| like sometimes the best security tool is just making the risk
| impossible to ignore.
| tialaramex wrote:
| To be vulnerable to this, what sort of dumb things are end users
| doing?
|
| I couldn't immediately figure out here whether we're talking
|
| 0. Microsoft's supported products default enable this worthless
| "authentication" feature
|
| 1. Microsoft's supported products provide such a feature behind a
| UI that's not clearly marked "Danger: Do not stare into laser
| with remaining eye"
|
| 2: Microsoft does still support this, behind some Registry
| nonsense most users do not understand and once enabled it doesn't
| turn on the "I am a toxic waste dump, leave by nearest exit"
| warning signs on affected machines
|
| 3: Microsoft doesn't support this at all but some 3rd party
| commercial stuff does and customers really do love their crusty
| archaic 3rd party garbage
|
| 4: But this long abandoned SCO machine we've kept on life support
| for twenty years!
|
| 5: What does "supported" mean? Windows NT is scary, we're still
| on Windows 98 here.
| mr_mitm wrote:
| This is mostly an issue in active directory networks. Usually
| the reason people give as to why they still have this enabled
| is due to some legacy system that can't authenticate via
| Kerberos or at least NetNTLMv2. Worst case is if they then
| enable NetNTLMv1 on the domain controllers, even if the DC acts
| as a client. Using authentication coercion, this is a pretty
| quick win for an adversary.
| tialaramex wrote:
| Ok, so it's a 2 on my list.
|
| Microsoft needs to make this forcibly change the UI so that
| users can see "Oh! I'm using crap low security Windows". That
| lights a fire under people to actually get it fixed.
| nolok wrote:
| You have to actively go out of your way to have this enabled.
| But large or older companies always have some old machine (can
| be as dumb a an old but very expensive printer) that isn't
| updated.
|
| Even today the only reason to use samba 2 in 90% of companies
| where it's enabled are old appliances.
|
| At some point device X isn't working, employees complain, IT
| say they need to buy a new very expensive replacement and after
| much argumentation they come to the agreement to enable that
| legacy horror support until the purchase can be made. Which is
| then never made.
___________________________________________________________________
(page generated 2026-01-17 23:01 UTC)