Hash Encryption in Windows 10 Anniversary Update
Microsoft recently introduced a large anniversary update for Windows 10, one of its most popular operating systems.
Windows 10 Anniversary Update makes Windows 10 better than ever before. You can enjoy a multitude of new features, including:
– shuffle buttons in the Start menu
– take advantage of additional highly requested adware
– resize and reshape the adorable tiles
– admire how fast your personal data is sent to Microsoft
– try a brilliant monochrome skin for those suffering from moon blindness
– view brand new minimalistic icons developed by thousands of hard-working UI designers
– spend even more time searching for system options across multiple windows, thus raising the bar for your extrasensory perception
In all seriousness, however, the update does actually introduce some important improvements that deserve our attention. These include a Linux shell, pure re-installation, improved intelligence in Cortana, new login options based on Windows Hello, and much more.
The funny thing is that, despite the fact that the standard login workflow of Windows 10 has been slightly changed, this is not mentioned in the release notes at all. Due to these slight, yet significant changes, most hacker tools for pulling password hashes out of Windows will not work anymore. These changes may have been motivated by Microsoft’s desire to discontinue support for legacy and vulnerable cryptographic algorithms. In our example, Microsoft has decided to discontinue support for RC4.
According to Microsoft, user passwords are stored as hashes (instead of plain-text representation) that can be accessed in the corresponding section of the Windows registry (only by the system itself):
HKLM/SAM/SAM/Domains/Account/users/%RID%/V
Where %RID% – is the unique user ID.
Unique user IDs can be figured out by scanning the following registry tree:
HKLM/SAM/SAM/Domains/Account/users/names/%NAME%
Each key containing a username is associated with a corresponding RID. For example, the RID of the Administrator account is always equal to 500 (0x1F4 in the hexadecimal notation), while the Guest’s RID is 501 (0x1F5).
Any user’s registry key also holds at least ‘C’ and ‘V’ records. A ‘V’ record contains the variable-length data that corresponds to this account. The names themselves seem to be abbreviations – ‘V’ stands for ‘variable’ and ‘C’ means ‘constant.’ Each variable in the ‘V’ records is represented as a constant within the interval from 0 to 0xCC, e.g. a username is encoded as 0xC. Therefore, if we know the constant, we can identify an offset to the index that refers to actual data. LM and NT hashes correspond to 0x9C and 0xA8 respectively. However, obtaining the final password hash will require several additional decryption steps.
http://www.passcape.com/images/blog/sam_v_entry.png
Let’s see how the system generally retrieves the NTLM hash of a user:
– First of all, the system identifies a path to the key in the Windows registry where the account settings are stored, e.g. HKLM/SAM/SAM/Domains/Account/Users/00001F4
– The next step is to read the variable that contains the NTLM hash. This variable corresponds to the constant 0xA8. The system thus reads the data index based on the offset in this constant, i.e. 0x19C. Adding the data index to 0xCC will give the offset 0×268 from which we can access the actual data (our ‘raw’ NTLM hash) as shown in the picture. Now the system can read the hash and decrypt it.
– Using SYSKEY, the system decrypts the SAM session key. The SAM session key is stored in the registry section called HKLM/SAM/SAM/Domains/Account/V. This data structure actually keeps two encryption keys: the current one and the previous one. In this step, the system uses the MD5 and RC4 algorithms. In Windows 10 Anniversary Update, RC4 has been replaced with AES
– The system then uses the SAM session key to decrypt the ‘raw’ hash obtained in Step 2 through the RC4 or AES (for Windows 10 Anniversary Update) algorithm.
– And, finally, the data that has been obtained is transformed once again into the actual data by means of the DES algorithm and the user’s RID as the encryption key. Now our NTLM hash is ready.
As you can see, in Windows 10 AU the RC4 stream cipher in Steps 3 and 4 has been replaced with the AES block cipher. This has led to certain changes in the data storage structure (at least because the data length in AES blocks must be multiple to 16 bytes) but has not resulted in stronger security of the operating system.
Summary: In Windows 10 Anniversary Update, the encryption algorithms of SAM accounts have been changed. Did the new algorithms make password hashes safer? No. Was it worth it? Yes, since the unified changes applied to domain users as well – some of their private data was at risk of being compromised due to vulnerabilities in the legacy RC4 algorithm. However, that is another matter entirely.
—
Badho Bahu a Love Story of Fat Girl with a Fit Boy
We love TV series because we want to have fun from time to time. Badho Bahu will allow you to have tons of fun right away, but your heart will be beating faster as well. Badho Bahu has an amazing plot that you will love at instant. We are going to talk a little bit about Badho Bahu and the things this love story has in store for you. So read on to find out even more about it.
Badho Bahu is a romantic TV series that is currently airing on the popular &TV channel. Sunny Side produced this story. Rytasha Rathore plays the important female lead role, while Bigg Boss 9 winner Prince Narula plays the handsome male lead role. The story revolves around an overweight girl who overcomes her life battle with all the composure she could muster. Haryana is the backdrop of this series. Badho is the principal character of the story.
Badho has a big size and a big heart, and this makes the story even more interesting. She is a very innocent girl wanting to help everyone around her. Something really strange happens when Badho eventually get married to the most popular wrestler in her town. The next phase of the story has to do with Badho`s efforts to convince her husband that she was the right choice for him. You will also find many reasons why Badho Bahu is truly worth watching for a while.
Badho Bahu has many interesting things that you will love such as street-side sass and quirky dialect. You will always see Mr. Lucky Ahlawat flaunting his 6-pack abs wherever he goes. In fact, he is the pride of the whole town, as he is a very popular among the town girls. His mischievous and innocent look will make your heart beat faster down the road as well. The father of Lucky is a just a doting dad, and he is also a supportive father-in-law at the same time.
As you can see, Badho Bahu is here to stay. With an amazing plot and interesting backdrop, Badho Bahu is truly here to stay. Badho is all hearts as she takes the harsh words from others. She is always on the lookout for new things to do helping a lot of people along the way. This girl has something good for everyone around her, and she loves her husband as well. However, she is not too sure about the love of her husband, so she is always trying to win him over as well. You will have a blast with Badho Bahu in no time, and that`s not an exaggeration.
—