Unsigned NTLM authentication messages vulnerable to Man-in-the-Middle attack on SMB file servers Unsigned NTLM authentication messages allow an attacker on the LAN to add, remove or copy files to and from the organization’s file servers (and workstations with filesharing enabled). Recommendation While office networks are often treated as "trusted" spaces, measures should be in place to reduce the potential harm of an attacker who gains access. In addition, devices that "travel" -- such as laptops and mobile phones -- should have adequate security settings (generally, firewalls) to protect them on other networks. A policy should be in place for connecting personal devices to work networks, as well as work devices to non-work networks. NETWORK TRAFFIC ANALYSIS Summary Any content that is sent out over the network without encryption is easy to intercept; this includes email, web passwords, and chat messages. This attacker could be someone, such as a patron of the Internet cafe where a staff member is working, who just happens to be using the same local network to connect to the Internet. Or, she could work for an organization with privileged access to the relevant network, such as the Internet Service Provider (ISP) of either the sender or receiver and other network-backbone connections made along the way. Overview Intercept network traffic Review it for security concerns Watch for unencrypted email (POP/SMTP/IMAP) connections, unencrypted website logins (for blogs, websites, and webmail in particular) Materials Needed Page 58 of 240