@mkataria The article you referenced does contain some good information about security exploits for the Microsoft Windows Active Directory KDC. Some of them require you to obtain certain keys or privileges in order to compromise security, some of them require access to the domain controller. This article is a bit dated as it is from a couple of years ago, and investigating some of the bugs mentioned shows that Microsoft has patched some of these holes. Other attacks can be secured against by understanding the attack and eliminating the access required to utilize the exploit. As with any computer system, the key is securing the systems. Keep users off of systems that they shouldn't have access to. If there's a memory exploit on a server, don't let users login to that server. If getting access to a file would compromise security, don't allow access to that file. The implications of being able to arbitrarily generate Kerberos tickets can have impacts in a Hadoop environment just as they would in any network. If a user can obtain a ticket to use HDFS, for example, that user may be able to access data that s/he shouldn't access. This is why security is such an important and complex topic. Ensuring that the various systems are secure individually AND together is key to ensuring the security of your information. To address the specific issues mentioned in this article, and to ensure the utmost security of your systems, I would recommend contacting Microsoft about them, determining which issues are applicable to your particular O/S version, and work with Microsoft on the best way to secure the domain controller against these attacks.
... View more
