Re:Kerberoasting
by gnfargbl on Wednesday September 10, 2025 @10:03AM
(#45197870)
> rotated regularly
Is this really a useful mitigation here? If someone has suitable presence to make requests to the TGS, then the time window for cracking and exploiting those tickets (if they are exploitable) is surely always going to be small compared to the rotation window. Hackers don't typically have the patience to sit running hashcat on an old GPU for weeks, they just find some way to get ephemeral access to a bunch of faster GPUs.
Re:Kerberoasting
by harmon on Wednesday September 10, 2025 @10:07AM
(#45197924)
Managed and group managed service account passwords are typically 240 characters long and rotate every 30 days. It is highly unlikely that an attacker can crack these.
Re:Kerberoasting
by gnfargbl on Wednesday September 10, 2025 @10:10AM
(#45197979)
Fair enough, I guess for some threat actors there is a difference between "uncrackable" and "crackable with more than 30 days effort". But that's a pretty select group of actors.
Is this really a useful mitigation here? If someone has suitable presence to make requests to the TGS, then the time window for cracking and exploiting those tickets (if they are exploitable) is surely always going to be small compared to the rotation window. Hackers don't typically have the patience to sit running hashcat on an old GPU for weeks, they just find some way to get ephemeral access to a bunch of faster GPUs.