Attack #5: DoS Attack Based on the MaxTokenSize Property

Attack #5:
DoS Attack Based on the MaxTokenSize Property
Microsoft extended the base Kerberos protocol to enable a Kerberos authentication ticket to include authorization data. A Windows Kerberos ticket and Ticket Granting Ticket (TGT) both contain a special field called the Privilege Attribute Certificate (PAC), which enables the Kerberos protocol to transport authorization data such as user group memberships and user rights in the Kerberos authentication tickets.

The Kerberos ticket has a fixed size, which indirectly also limits the PAC size. If a user is a member of a large number of groups (100 or more), this ticket size might be exceeded and Windows authentication and group policy processing might fail. Users that have the Active Directory (AD) permission to create and modify groups could exploit this weakness to mount a Denial of Service (DoS) attack against administrator accounts. Such an attack could prevent administrator accounts from logging on to the network.

Attack #5
Prevention
To prevent this attack, you must start by being extremely careful when delegating AD administrative permissions for group management. You must also restrict the permission to manage an administrator's account group membership. This restriction is difficult to achieve with the default permissions in AD because delegated administrators don't need any special rights to add any user account in the forest to the local and universal groups the administrators are allowed to manage. So, you must place Enterprise Administrators or Domain Administrators accounts in special organizational units (OUs) without read permissions for delegated administrators.

In addition, you can adjust the maximum size of a Kerberos ticket by using the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsaKerberosParametersMaxTokenSize registry subkey. The MaxTokenSize subkey is documented in the Microsoft article "New resolution for problems that occur when users belong to many groups" at http://support.microsoft.com/?kbid=327825.

The MaxTokenSize subkey (REG_DWORD) should be adjusted on all Windows machines from which users use Kerberos to log on to a domain. In Win2K, the default MaxTokenSize value is 8000 bytes. In Win2K SP2 and later and in Windows 2003, the default value is 12,000 bytes.

T o reduce the PAC size, Microsoft also implemented a new method to store authorization data in the PAC in Win2K SP4. The new PAC authorization data storage method can be summarized as follows:

Microsoft provides a special process on the client and server side to explode RIDs back to the SID format during the Windows authorization process. Note that even on platforms where this new PAC authorization data storage method is available, you might still need to adjust the MaxTokenSize or reduce the number of group memberships for a user.

To avoid wasting space in a Kerberos ticket's PAC field, you should remove the SIDHistory attribute from your AD accounts when your migration from the NT 4.0 domain to the Windows 2003 or Win2K domain is done by following the instructions in the Microsoft article "How To Use Visual Basic Script to Clear SidHistory" at http://support.microsoft.com/?kbid=295758.

Microsoft released the Tokensz tool to troubleshoot problems related to the Kerberos token size. You can download the tool from http://www.microsoft.com/downloads/details.aspx?familyid=4a303fa5-cf20-43fb-9483-0f0b0dae265c&displaylang=en. The following Tokensz command lists the current system value for MaxTokenSize and the size of the current token:

tokensz /compute_tokensize /package:negotiate /use_delegation /target_server: 

You can find more details about how to use Tokensz in the Microsoft white paper "Troubleshooting Kerberos Errors" at http://www.microsoft.com/downloads/details.aspx?familyid=7dfeb015-6043-47db-8238-dc7af89c93f1&displaylang=en