Karl Voit :emacs: :orgmode:<p><span class="h-card" translate="no"><a href="https://ioc.exchange/@matthew_d_green" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>matthew_d_green</span></a></span> from Johns Hopkins University on <a href="https://graz.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> <a href="https://graz.social/tags/ActiveDirectory" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ActiveDirectory</span></a>:<br><a href="https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.cryptographyengineering.c</span><span class="invisible">om/2025/09/10/kerberoasting/</span></a></p><p>"But there’s also another class of <a href="https://graz.social/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerabilities</span></a>: these are the ones that can’t possibly exist in important production software, because there’s no way anyone could still do that in 2025."</p><p>"Unfortunately, Active Directory is a monster dragged from the depths of time."</p><p>legacy <a href="https://graz.social/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptography</span></a>: "This is very bad, because the <a href="https://graz.social/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptography</span></a> is exceptionally terrible."</p><p>"The result of this is that the user learns an account <a href="https://graz.social/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>password</span></a> that lets them completely control that essential Service. And the result of that (with a few extra steps) is often <a href="https://graz.social/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a>."</p><p>"It’s actually a terrible design that should have been done away with decades ago."</p><p>"Microsoft doesn’t seem to do anything proactive [...]. Instead this all seems much more like a reluctant and half-baked bit of <a href="https://graz.social/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> management."</p><p><a href="https://graz.social/tags/AD" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AD</span></a> <a href="https://graz.social/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Windows</span></a> <a href="https://graz.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ITSecurity</span></a> <a href="https://graz.social/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://graz.social/tags/IndustryStandardMyAss" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IndustryStandardMyAss</span></a> <a href="https://graz.social/tags/fail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fail</span></a></p>