Google Shows How Easy It Is to Crack Old Windows Logins

Google Exposes Weakness in Decades-Old Windows Logins

Corporate IT teams now face a stark warning: outdated Windows login systems are far easier to hack than many realized. Google’s security arm, Mandiant, this week released a dataset demonstrating that the Net-NTLMv1 authentication protocol—a decades-old system—can be cracked in hours using consumer-grade hardware. The move is meant to force organizations to take action before their networks are compromised.

Nic Losby, Principal Red Team Consultant at Mandiant, explained that the release “lowers the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.” The dataset provides both a wake-up call and a practical tool for understanding the vulnerabilities still lurking in enterprise systems.

Net-NTLMv1: An Old Protocol That Refuses to Die

Net-NTLMv1 has been part of Microsoft Windows systems for more than 25 years. Its weaknesses were documented as early as 1999, and by the early 2010s, security researchers were actively demonstrating real-world exploits. Despite this, the protocol continues to appear in live enterprise environments, often due to outdated infrastructure and organizational inertia.

“This legacy protocol leaves organizations vulnerable to trivial credential theft, yet it remains prevalent due to a lack of demonstrated immediate risk,” Losby noted. Mandiant’s release shows that risk is far from theoretical—accessing credentials no longer requires sophisticated or expensive tools.

How Easily Credentials Can Be Recovered

The dataset includes rainbow tables capable of cracking Net-NTLMv1 passwords in under 12 hours. Remarkably, this can be done with consumer hardware costing less than $600. Hosting the tables on Google Cloud makes them widely accessible, ensuring both defenders and attackers can see just how insecure the protocol is.

Security teams can now simulate attacks against their own systems, identifying weaknesses before malicious actors exploit them. Analysts warn that failure to phase out Net-NTLMv1 leaves organizations exposed to credential theft, lateral movement within networks, and potentially full-scale breaches.

Why Organizations Still Use Net-NTLMv1

Many enterprises continue to rely on Net-NTLMv1 due to legacy systems, software dependencies, and the misconception that it’s safe because no recent attacks have made headlines. However, Google’s demonstration makes it clear that security by obscurity no longer works. Modern alternatives, such as NTLMv2 and Kerberos, offer stronger encryption and robust defenses against credential-based attacks.

“Even small or medium-sized companies can now see how quickly legacy credentials can be compromised,” Losby said. “Ignoring this vulnerability is no longer an option.”

The Call to Action for IT Teams

Mandiant’s dataset release is more than a technical exercise—it’s a call to action. IT teams are urged to audit systems, disable Net-NTLMv1 where possible, and enforce stronger authentication protocols. Organizations that delay risk exposing sensitive data, financial records, and internal networks to relatively simple attacks.

Experts recommend starting with the most critical systems, prioritizing domain controllers and servers still relying on Net-NTLMv1. Updating policies and enforcing multi-factor authentication (MFA) can further mitigate risks and bring enterprise security in line with modern standards.

Security Lessons from Google’s Demonstration

Google’s move underscores an uncomfortable reality: legacy systems are not just inconvenient—they’re dangerous. By openly demonstrating how fast credentials can be cracked, Mandiant hopes to accelerate corporate action and reduce the prevalence of outdated protocols.

For IT teams, the message is clear: auditing old authentication methods and updating protocols is no longer optional. With tools now available to simulate attacks, organizations can proactively protect themselves before real hackers exploit the vulnerabilities.