When the value of ‘0’ is applied to the UseLogonCredential registry under the subkey below, WDigest will not store credentials in memory. When the patch is installed, the legacy hosts have the ability to choose how WDigest credentials will be stored. To mitigate this risk, Microsoft issued a patch in KB2871997. For older hosts, such as Windows 7, 8, Server 2008, and Server 2012 this behavior is not enabled by default. WDigest has been disabled by default in Windows 8.1, Server 2012 R2, and all operating systems thereafter.

The security concern with this protocol is that it stores the clear-text password in memory to be used during the session.

WDigest is a now legacy challenge/response protocol that was used in Windows Server 2003 for LDAP and web authentication. The reason clear-text credentials can be pulled from Local Security Authority Subsystem Service (LSASS) is generally because of WDigest. With an offensive objective in mind, what attacker wouldn’t want to get their hands on clear – text passwords ? F or older hosts runni ng Windows 7, 8, Server 2008, and Server 2012, a key co nfiguration that enables someone to achieve clear – text passwords is not disabled by default. DISABLE CLEAR-TEXT PASSWORDS IN MEMORY FROM WDIGEST In Part 1 of the Credential Dumping Series, I took a closer look at vulnerabilities within Windows authentication and credential management and explained why these are prime targets for attackers in this post, I’ll walk you through some of the protective measures your organization can take to mitigate Windows credential theft. However, this is only a piece of the bigger picture of the Windows credential model.

Credential theft is part of almost all attacks within a network, and one of the most widely known forms of credential stealing is surrounding clear-text credentials by accessing lsass.exe.

Credssp registry fix