Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/13/2018
01:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Microsoft Remote Access Protocol Flaw Affects All Windows Machines

Attackers can exploit newly discovered critical crypto bug in CredSSP via a man-in-the-middle attack and then move laterally within a victim network.

A serious vulnerability found in Microsoft's Credential Security Support Provider protocol (CredSSP) could allow a hacker to gain control of a domain server and other systems in the network.

Researchers from Preempt unearthed the previously unknown remote code execution vulnerability, which affects all versions of Windows, and reported it to Microsoft in August of last year. Microsoft today issued a fix (CVE-2018-0886) for the protocol as part of its Patch Tuesday release.

The logical cryptographic vulnerability in CredSSP can be exploited via a man-in-the-middle attack when a client machine and server authenticate to one another over the Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) connection protocols. CredSSP forwards credentials, encrypted, from the Windows client to the server for authentication.

"We were able to find a classic mistake in the protocol and use that mistake to launch a man-in-the-middle attack," says Yaron Zinar, lead security researcher for Preempt. Zinar and his team will demonstrate the attack next week in Singapore at Black Hat Asia, where they also will release an open source tool that exploits the vulnerability.

Zinar says with CredSSP, the server's certificate doesn't get validated by the client; it's just signed and not hashed. "That allows us to create a malicious [and forged server] certificate that contains" a malicious executable, he says. The client then can be duped with a forged server cert.

Exploiting the flaw requires the attacker to wage a man-in-the-middle attack between the client and server in an RDP or WinRM session. He or she would need WiFi or physical access to the targeted network. A WiFi exploit could be set up using a key reinstallation attack such as KRACK, for example, according to the researchers. Other vectors are Address Resolution Protocol (ARP) poisoning and exploiting vulnerable network devices such as routers, to reach servers inside.

During the man-in-the-middle attack, the attacker basically awaits a CredSSP session to compromise the authentication between the client and server, and employ a remote procedure call attack on that server. "An attacker which have stolen a session from a user with sufficient privileges could run different commands with local admin privileges," according to a blog post by Preempt on the attack. "This is especially critical in case of domain controllers, where most Remote Procedure Calls (DCE/RPC) are enabled by default."

All the client machine user sees is a failed RDP message, so there's little evidence that something went wrong with the remote session. An attacker then could end up with full control of the network if he or she then targets the victim's domain controller.

"Exploiting the vulnerability was very difficult," notes Zinar. "There were a lot of constraints about which packets we could use, and which certs we could use."

Microsoft in its update today said the patch "addresses the vulnerability by correcting how CredSSP validates requests during the authentication process." It recommends also using Group Policy settings or registry-based settings: "We recommend that administrators apply the policy and set it to 'Force updated clients' or 'Mitigated' on client and server computers as soon as possible.  These changes will require a reboot of the affected systems," Microsoft said in its update.

To defend against the CredSSP exploit, Preempt recommends patching workstations and servers, but warns that patching alone is not sufficient to stop this attack. Special configuration changes also need to be made, and blocking RDP and DCE/RPC can help. "If you don't use RDP, turn it off on the machine. And if you are not using remote procedure calls, turn them off," Zinar advises. "Also, decrease the use of privileged credentials. An admin should not use privileged credentials from WiFi, and sometimes not even from his personal workstation. From a dedicated workstation, maybe.

"And don't use domain admins at all," he adds.

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
3/15/2018 | 1:21:55 PM
I do think there is a better way than mentioned by the engineer/developer
Cut and paste this code into a rdp.ps1 file, then run it in Admin mode (powershell of course), this will lock down the admin group (requires encryption and authentication) so the user will not be able to circumvent the key, they have another mechanism of authentication and integrity (make sure you are running Powershell 5.1, you can verify that by running $PSVersionTable).

 

# Identify Administrators Group
$users = New-Object -TypeName System.Security.Principal.NTAccount ("Administrators")

# Security Principles for users accessing systems, Ids the SID value
$SIDofSecureUserGroup = $users.Translate([System.Security.Principal.SecurityIdentifier]).Value

# Secure User Groups found in the Administrators Group
$SecureUserGroupSDDL = "D:(A;;CC;;; $SIDofSecureUserGroup)"
#$SecureMachineGroupSDDL = "D:(A;;CC;;; $SIDofSecureUserGroup)"


# Remote Desktop DisplayName for individual rules
$rule = (Get-NetFirewallRule -DisplayName "Remote Desktop*").DisplayName
    foreach ($i in $rule) {
        Set-NetFirewallRule -DisplayName $i -Profile "Private"
    }

# Set Remote Desktop, add Builtin\Administrators groups to the filter
$nfSecurityFilter = Get-NetFirewallRule -DisplayName "Remote Desktop*" | Get-NetFirewallSecurityFilter

# Set NetFirewallSecurity Filter Settings for Authorized Users, login required for local users, Authorize and Encrypt the session
#Set-NetFirewallSecurityFilter -RemoteUser $SecureMachineGroupSDDL -InputObject $nfSecurityFilter -Authentication Required -Encryption Required
Set-NetFirewallSecurityFilter -RemoteUser $SecureUserGroupSDDL -InputObject $nfSecurityFilter -Authentication Required -Encryption Required

#This cmdlet can be run using only the pipeline.
foreach ($i in $rule) {
    Get-NetFirewallRule -DisplayName $i | Get-NetFirewallSecurityFilter | Set-NetFirewallSecurityFilter -RemoteUser $SecureUserGroupSDDL -Authentication Required -Encryption Required
    #Get-NetFirewallRule -DisplayName $i | Get-NetFirewallSecurityFilter | Set-NetFirewallSecurityFilter -RemoteMachine $SecureMachineGroupSDDL -Authentication Required -Encryption Required
}

#This cmdlet can be run without the pipeline.
#Set-NetFirewallRule -DisplayName "Remote Desktop*" -RemoteMachine $SecureMachineGroupSDDL

Get-NetFirewallRule -DisplayName "Remote Desktop*" | out-file $env:USERPROFILE\desktop\fwrules.txt -Append
Get-NetFirewallRule -DisplayName "Remote Desktop*" | Get-NetFirewallSecurityFilter | out-file $env:USERPROFILE\desktop\fwfilter.txt -Append

 

Result:



 



Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15224
PUBLISHED: 2019-08-19
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVE-2019-15225
PUBLISHED: 2019-08-19
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
CVE-2019-15223
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
CVE-2019-15211
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
CVE-2019-15212
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.