Zerologon

security

A 2020 flaw letting attackers take over a Windows domain controller.

Zerologon exploited a cryptographic weakness in the Netlogon protocol so that an attacker on the network could reset a domain controller's machine password and seize control. It was rated maximum severity.

Zerologon was a flaw in the Netlogon protocol that allowed an unauthenticated attacker with network access to a domain controller to set the machine account password to empty and take over the entire Active Directory domain. The severity rating was maximum and the exploitation was, in the end, remarkably simple.

The cause was a cryptographic misuse rather than a memory bug. A custom authentication scheme used AES in a mode with a fixed initialization vector of zeros, which meant an attacker sending all-zero input had a usefully high chance of producing a valid result by simply retrying a few hundred times. The primitive was strong and the way it was applied was not.

The remediation was staged over months because enforcing the corrected protocol immediately would have broken older devices that spoke the flawed version, which is the recurring shape of enterprise security work: the fix is known quickly and the deployment is gated by compatibility with things nobody controls. Zerologon is also the clearest available argument that domain controllers are a category of asset requiring different treatment, since compromising one is not compromising a server but compromising every identity in the organization.

Also known as: Zerologon, CVE-2020-1472

← All glossary entries