Q: Empty Password

Blank passwords are a serious threat to computer security.A blank password makes the authentication process as weak as simply guessing a username, making a brute-force attack against the account trivial.

Question 1

Empty Password

Accepted Answer

Blank passwords are a serious threat to computer security.

A blank password makes the authentication process as weak as simply guessing a username, making a brute-force attack against the account trivial.

Question 2

Empty Password (solutions)

Accepted Answer

Any account found to have a blank password should be given a strong, complex, password.

FastPassCorp has a solution to secure the password creation process, ensuring that only strong passwords are chosen by users.

Question 3

Weak Password

Accepted Answer

A weak password is one that is either easy to guess given basic knowledge of the user (for example, a birth date or name of a family member), is one that is commonly used (such as 'password' or 'guessme'), or is not complex enough and therefore can be attacked by brute force. All of these characteristics increase the chance of an attacker being able to compromise the password in a short length of time.

Question 4

Weak Password (Solutions)

Accepted Answer

A strong password policy should be enforced. FastPassCorp has a solution to secure the password creation process, ensuring that only strong passwords are chosen by users.

Question 5

LM Hashed Password

Accepted Answer

Older versions of Windows used a password hashing method known as Lan Manager (LM)hashing. This hashing process was relatively weak, and in turn allowed attackers to turn a hashed password back into its original plain text form with relative ease.

Question 6

LM Hashed Password (Solutions)

Accepted Answer

Microsoft provide guidance on this feature and how it can be changed.

Question 7

ClearText

Accepted Answer

Passwords stored using reversible encryption can be extracted from Active Directory by a privilegeduser and decrypted to reveal the original password.

Question 8

ClearText (Solutions)

Accepted Answer

Microsoft provide guidance on this feature and how it can be changed.

Question 9

Default Computer Password

Accepted Answer

Domain member computers have been found using the default computer password. This would allow an attacker to use the computer account to access Active directory and gather more information that could be used in an attack.

Question 10

Default Computer Password (Solutions)

Accepted Answer

The machine(s) in question should have their computer passwords updated. Microsoft provide guidance on how this can be performed.

Question 11

Password Not Required

Accepted Answer

Accounts with the 'password not required' flag can opt to use a blank password. Blank passwords are a serious threat to computer security. A blank password makes the authentication process as weak as simply guessing a username, making a brute-force attack against the account trivial.

Question 12

Password Not Required (Solutions)

Accepted Answer

Update any account with the 'password not required' flag to require a password. Microsoft provide guidance on this feature and how it can be changed.

FastPassCorp has a solution to secure the password creation process, ensuring that only strong passwords are chosen by users.

Question 13

Password Never Expires

Accepted Answer

Accounts have been found which have password expiration enabled.

Question 14

Password Never Expires (Solutions)

Accepted Answer

Guidance on password expiration differs by sector. Please consult guidance for your sector (for example PCI-DSS, NIST etc)

Question 15

AES Keys Missing

Accepted Answer

In the absence of stronger AES encryption keys, weaker encryption methods such as RC4 and DES

are used during the authentication process. This potentially allows an attacker to decrypt the

network traffic and extract credentials for later abuse.

Question 16

AES Keys Missing (Solutions)

Accepted Answer

Microsoft provide guidance on how to enable AES keys.

Question 17

Pre Auth Not Required

Accepted Answer

Without pre-authentication, an attacker is able to make a single request for an authentication token, and then crack the encryption for the token whilst offline.

As there was only a single request made, no suspicious behaviour would show up within the Active Directory security logs.

Question 18

Pre Auth Not Required(Solutions)

Accepted Answer

It is recommended that Kerberos preauthentication is enforced.For further guidance, please seek guidance from an appropriate source.

Question 19

DES Encryption Only

Accepted Answer

When it was first implemented, the Kerberos protocol used the DES encryption standard.This has since been compromised, and it's use should be retired where possible.

Question 20

DES Encryption Only (Solutions)

Accepted Answer

Microsoft provide guidance on how to disable the use of DES encryption.

Question 21

Delegatable Admins

Accepted Answer

Active Directory delegation is critical part of security and compliance.

By delegating control over Active Directory, you can grant users or groups the permissions they need without adding users to privileged groups like Domain Admins and Account Operators.

Question 22

Delegatable Admins (solutions)

Accepted Answer

Microsoft provide guidance on how this can be configured.

Question 23

Smartcard Password

Accepted Answer

Smart card authentication is a two-step login process that uses a smart card. The smart card stores a user's public key credentials and a personal identification number (PIN), which acts as the secret key to authenticate the user to the smart card.

Question 24

Smartcard Password (Solutions)

Accepted Answer

Microsoft provide guidance on how this can be configured.

Question 25

Who developed this tool?

Accepted Answer

FastPassCorp and KSS Partnered to roll out this tool.​​KSS (Knowledge Secure Systems) A leading IT Security Company in the UK and FastPassCorp is a global leading provider of Self Service Password Reset based in Denmark.

Question 26

What does this tool do?

Accepted Answer

This tool is so powerful that it runs through your enterprise active directory securely and releases results in just less than 30 minutes that will show level of risk by checking for :​​Weak or Common Passwords​Accounts with weak encryption​Accounts that has no password​Accounts that reuse the same password​Shows where passwords are stored in clear text​

Question 27

How safe is this tool?

Accepted Answer

The tool does not communicate to the outside world with any of the data. The tool does not change or modify any data in Active Directory, no does it need to run on a Domain Controller or a member device. It can be run from any device.

The only reason for requesting elevated rights is the necessity to get hold of the password hashes. As a hash is a mathematical algorithm that maps data of arbitrary size’ to a bit array of a fixed size t represents the password. It is a one-way algorithm, hence a hash will not enable anyone to calculate a password. The hashes in Active Directory is compared against the hashed list of breached passwords in the file. Again the file just contains the most breached hashes.

Identifying a breached password will not lead to anyone knowing what the actual password is. The same is true for the comparison towards the text file holding specific passwords to check. If the system that a password holds one of these passwords, the user account pops up on the list however the password is not revealed.

Question 28

How do I use this tool?

Accepted Answer

Requirements:The tool will run on any Windows Device having .Net4.7.2 installed. The device needs to have access to Active Directory but it is not a requirement that the device is a member device. To run the test a user account having Domain Admin (r/o) rights are needed.Instructions:Install .Net 4.7.2 or newerDownload the toolUnzip the files in a folder of your choiceOpen the PDF document in the documentation folder and follow the detailed instructionsFile will be automatically downloaded upon submission of company email. You can also click the link in the Thank You page if the download haven't started automatically

Question 29

Who is this tool for?

Accepted Answer

This tool may be used by any enterprise ideally with employees from 30 to as large as 5000 users.IT Security Team, IT Managers, or anyone who is working as an Active Directory Admin.

Are you prepared if a hacker attacks tomorrow?

Audit your passwords to see if there are possible risks to your Active Directory.

Know your risk today!

*Information submitted on this form may be associated with other information we have collected and used pursuant to our Privacy Notice.

The biggest businesses in different industries trust FastPassCorp

What can you get from the audit?

About the Password Audit Tool

How Secure is this tool?

RATED AS THE BEST FREE PASSWORD SECURITY AUDIT

Fast and Easy to use

It is now part of our Monthly Security Check Up

Not sure if you have the right privileges? Send the tool to your IT Infrastructure Team.

What you can expect from the Password Audit Results and Recommendations