The Kerberos Key List Attack - The Return of the Read Only Domain Controllers

Explore a 47-minute conference talk from Ekoparty 2021's Main Track that delves into the Kerberos Key List attack and its implications for Read Only Domain Controllers (RODCs) in Azure environments. Discover how Microsoft's push for Azure integration has led to new passwordless authentication features, particularly focusing on security key authentication. Uncover the hidden complexities behind the seamless Single Sign-On (SSO) experience and learn about a novel attack vector targeting RODCs using Kerberos Key List request messages. Gain insights from Leandro Cuozzo, a security researcher at SecureAuth specializing in authentication and identity security, as he presents this critical analysis of emerging security challenges in Azure authentication systems.

The Kerberos Key List attack: The return of the Read Only Domain Controllers ▪ Ekoparty 2021