S0:E55: Hashcat's EvilMog on the NTLM v1 Bug Still Hiding in "Modern" Windows
Hashcat core developer EvilMog joins Jess and Jake to explain why so many "NTLM v1 is disabled" Windows networks are still exploitable. MSCHAPv2 and PPTP VPN are cryptographically equivalent to NTLM v1 — so a rogue RADIUS server and one unchecked "verify the certificate" box can hand an attacker domain admin, no matter how long or random your password is.
Also in this episode:
A ConnectWise follow-up — what the vendor's latest containment updates do (and don't) tell you, and why "we haven't observed any new activity" doesn't mean your tenant is in the clear.
EvilMog breaks down offline vs…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.