Home / server / Questions / 7235
Accepted
Bruce McLeod
Asked: 2009-05-12 22:16:33 +0800 CST

Is account lockout a denial of service attack waiting to happen?

  • 772

The default behaviour of windows is to lockout an account after a number of failed authentication attempts (usually three)..

This means that with the following

net use \\targetmachine\c$ /user:targetaccount notthepassword
net use \\targetmachine\c$ /user:targetaccount notthepassword
net use \\targetmachine\c$ /user:targetaccount notthepassword

You can lock out a user and potentially even take down an entire company if none of the accounts have the "This account can never be locked out" checked.

Is this security "feature" really a denial of serice attack enabler ? And should this be disabled by default.

An organisation is particularly vunerable with this to the rogue employee scenario.

security denial-of-service

4 Answers

  1. Best Answer

    I wasn't aware that this is default behavior, and it is definitely a denial of service waiting to happen. Temporary lockout (or simple slow-down) is usually sufficient to fend off brute force attacks (There's a lot of discussion on this topic, I can remember a few StackOverflow questions dealing with this, more in the area of website logins though). Yes, they're also a potential denial of service, but only for the duration of the attack.

    I don't agree completely with Dave Cheney, while you should be concerned with physical security, a disgruntled employee (more often an issue at larger companies than at smaller) and a borrowed (trusted hardware) login-screen is all it takes to lock down vital functions of the company, so I don't believe it to be sufficient.

    • 5

  2. Yes, it is a potential denial of service attack. That's why the Microsoft recommendations in the Windows Server 2003 Security Guide have password unlock set for 15 minutes. NSA was the first I saw to really propose using password unlock, and that was back in the Windows 2000 days.

    However, if you have a password unlock, the problem is the attacker is still out there, meaning the attacker can still try and crack passwords (if that's the real intent). The key is to figure out where the attack is coming from and shut it down. Once you've done that, execute a script to automatically unlock all the accounts.

    • 4

  3. Is it a potential denial of service attack, yes

    Should you disable it? No, you should look at the physical security problem that let untrusted hardware onto your network.

    • 3

  4. I don't know which version of Windows you are talking about, but Windows 2003 has the default domain lockout threshold set to 0, which means lockouts are not enabled.

    • 0