Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/13/2018
01:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Microsoft Remote Access Protocol Flaw Affects All Windows Machines

Attackers can exploit newly discovered critical crypto bug in CredSSP via a man-in-the-middle attack and then move laterally within a victim network.

A serious vulnerability found in Microsoft's Credential Security Support Provider protocol (CredSSP) could allow a hacker to gain control of a domain server and other systems in the network.

Researchers from Preempt unearthed the previously unknown remote code execution vulnerability, which affects all versions of Windows, and reported it to Microsoft in August of last year. Microsoft today issued a fix (CVE-2018-0886) for the protocol as part of its Patch Tuesday release.

The logical cryptographic vulnerability in CredSSP can be exploited via a man-in-the-middle attack when a client machine and server authenticate to one another over the Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) connection protocols. CredSSP forwards credentials, encrypted, from the Windows client to the server for authentication.

"We were able to find a classic mistake in the protocol and use that mistake to launch a man-in-the-middle attack," says Yaron Zinar, lead security researcher for Preempt. Zinar and his team will demonstrate the attack next week in Singapore at Black Hat Asia, where they also will release an open source tool that exploits the vulnerability.

Zinar says with CredSSP, the server's certificate doesn't get validated by the client; it's just signed and not hashed. "That allows us to create a malicious [and forged server] certificate that contains" a malicious executable, he says. The client then can be duped with a forged server cert.

Exploiting the flaw requires the attacker to wage a man-in-the-middle attack between the client and server in an RDP or WinRM session. He or she would need WiFi or physical access to the targeted network. A WiFi exploit could be set up using a key reinstallation attack such as KRACK, for example, according to the researchers. Other vectors are Address Resolution Protocol (ARP) poisoning and exploiting vulnerable network devices such as routers, to reach servers inside.

During the man-in-the-middle attack, the attacker basically awaits a CredSSP session to compromise the authentication between the client and server, and employ a remote procedure call attack on that server. "An attacker which have stolen a session from a user with sufficient privileges could run different commands with local admin privileges," according to a blog post by Preempt on the attack. "This is especially critical in case of domain controllers, where most Remote Procedure Calls (DCE/RPC) are enabled by default."

All the client machine user sees is a failed RDP message, so there's little evidence that something went wrong with the remote session. An attacker then could end up with full control of the network if he or she then targets the victim's domain controller.

"Exploiting the vulnerability was very difficult," notes Zinar. "There were a lot of constraints about which packets we could use, and which certs we could use."

Microsoft in its update today said the patch "addresses the vulnerability by correcting how CredSSP validates requests during the authentication process." It recommends also using Group Policy settings or registry-based settings: "We recommend that administrators apply the policy and set it to 'Force updated clients' or 'Mitigated' on client and server computers as soon as possible.  These changes will require a reboot of the affected systems," Microsoft said in its update.

To defend against the CredSSP exploit, Preempt recommends patching workstations and servers, but warns that patching alone is not sufficient to stop this attack. Special configuration changes also need to be made, and blocking RDP and DCE/RPC can help. "If you don't use RDP, turn it off on the machine. And if you are not using remote procedure calls, turn them off," Zinar advises. "Also, decrease the use of privileged credentials. An admin should not use privileged credentials from WiFi, and sometimes not even from his personal workstation. From a dedicated workstation, maybe.

"And don't use domain admins at all," he adds.

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
3/15/2018 | 1:21:55 PM
I do think there is a better way than mentioned by the engineer/developer
Cut and paste this code into a rdp.ps1 file, then run it in Admin mode (powershell of course), this will lock down the admin group (requires encryption and authentication) so the user will not be able to circumvent the key, they have another mechanism of authentication and integrity (make sure you are running Powershell 5.1, you can verify that by running $PSVersionTable).

 

# Identify Administrators Group
$users = New-Object -TypeName System.Security.Principal.NTAccount ("Administrators")

# Security Principles for users accessing systems, Ids the SID value
$SIDofSecureUserGroup = $users.Translate([System.Security.Principal.SecurityIdentifier]).Value

# Secure User Groups found in the Administrators Group
$SecureUserGroupSDDL = "D:(A;;CC;;; $SIDofSecureUserGroup)"
#$SecureMachineGroupSDDL = "D:(A;;CC;;; $SIDofSecureUserGroup)"


# Remote Desktop DisplayName for individual rules
$rule = (Get-NetFirewallRule -DisplayName "Remote Desktop*").DisplayName
    foreach ($i in $rule) {
        Set-NetFirewallRule -DisplayName $i -Profile "Private"
    }

# Set Remote Desktop, add Builtin\Administrators groups to the filter
$nfSecurityFilter = Get-NetFirewallRule -DisplayName "Remote Desktop*" | Get-NetFirewallSecurityFilter

# Set NetFirewallSecurity Filter Settings for Authorized Users, login required for local users, Authorize and Encrypt the session
#Set-NetFirewallSecurityFilter -RemoteUser $SecureMachineGroupSDDL -InputObject $nfSecurityFilter -Authentication Required -Encryption Required
Set-NetFirewallSecurityFilter -RemoteUser $SecureUserGroupSDDL -InputObject $nfSecurityFilter -Authentication Required -Encryption Required

#This cmdlet can be run using only the pipeline.
foreach ($i in $rule) {
    Get-NetFirewallRule -DisplayName $i | Get-NetFirewallSecurityFilter | Set-NetFirewallSecurityFilter -RemoteUser $SecureUserGroupSDDL -Authentication Required -Encryption Required
    #Get-NetFirewallRule -DisplayName $i | Get-NetFirewallSecurityFilter | Set-NetFirewallSecurityFilter -RemoteMachine $SecureMachineGroupSDDL -Authentication Required -Encryption Required
}

#This cmdlet can be run without the pipeline.
#Set-NetFirewallRule -DisplayName "Remote Desktop*" -RemoteMachine $SecureMachineGroupSDDL

Get-NetFirewallRule -DisplayName "Remote Desktop*" | out-file $env:USERPROFILE\desktop\fwrules.txt -Append
Get-NetFirewallRule -DisplayName "Remote Desktop*" | Get-NetFirewallSecurityFilter | out-file $env:USERPROFILE\desktop\fwfilter.txt -Append

 

Result:



 



Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...