Mandiant releases rainbow table that cracks weak admin password in 12 hours

Mandiant has released a rainbow table for NTLMv1 that can recover passwords in under 12 hours using consumer hardware costing less than $600, according to Google Cloud. The table targets Net-NTLMv1 passwords used in network authentication for resources such as SMB shares, and is hosted in Google Cloud. NTLMv1 rainbow tables exploit the hashing function’s limited keyspace, and these tables have existed for two decades but typically require substantial resources to be practical.

Despite widespread awareness of NTLMv1 weaknesses, many organisations still rely on it due to legacy applications, downtime concerns, and inertia, the article notes. Mandiant says the release aims to lower the barrier for security professionals to illustrate the insecurity of Net-NTLMv1 and to encourage moving away from the deprecated protocol. The piece also recounts historical weaknesses and prior tools that have attacked NTLMv1, and it includes a call for organisations to immediately disable Net-NTLMv1.