Azure Guest Agent Design Enables Plaintext Password Theft

Researchers find attackers can abuse the design of Microsoft Azure Guest Agent to recover plaintext administrator passwords.

The design of the Microsofts Windows Azure Guest Agent could let hackers steal plaintext administrator passwords from target machines, researchers at Guardicore reported this week. If abused, the flaw could enable a cross-platform attack affecting every machine type Azure provides.
Analysts discovered the attack vector while researching the Azure Guest Agent, which provides plugins for Azures infrastructure-as-a-service (IaaS) offerings. The agent receives tasks from the Azure infrastructure and executes them; tasks are saved on the machines disk. VM Access is a plugin for recovering VM access when users are accidentally locked out, or credentials are lost.
This research uncovered several security issues, all of which have been shared with Microsoft. Guardicore claims attackers have been able to access plaintext credentials after taking over an Azure virtual machine - if the VM Access plugin had been used on the machine - since 2015.
When we looked into the communication channels between the guest agent and the underlying infrastructure, we were alarmed by the way the guest agent handles sensitive information, says Ofri Ziv, head of Guardicore Labs.
Microsoft says the attack method divulged by Guardicore doesnt constitute a security vulnerability, however.
The technique described is not a security vulnerability and requires administrator privileges. We are continuing to investigate new features to improve customer experiences, and recommend customers follow
best security practices
, including setting unique passwords across their services, a Microsoft spokesperson said in a statement provided to Dark Reading.
Researchers found a flaw in the way the Azure Guest Agent receives the Reset password command from the Azure portal. The reset function contains encrypted sensitive data, and an attacker can abuse the workflow to steal new credentials in plaintext. The data can be decrypted using the certificate that resides on the machine, Ziv explains.
For
the attack
to be possible, the machine has to have used the VM Access plugin to reset a password at least once. The attacker must also have admin permissions to the Azure machine. With privileged access, its fairly easy to take advantage of this flaw, he points out.
This design affects every Azure machine, Windows or Linux, that has the Azure Guest Agent (bundled into every minute) if the Azure reset password tool was used, says Ziv. Windows defenses like Credentials Guard dont protect machines from this exploitation.
The business implications of stolen plaintext passwords are powerful, he continues. Attackers can reuse them to access enterprise services, machines, and databases, testing credentials across different environments. This isnt possible with a password hash, which if stolen, cant be used as it is against services that dont support Microsoft authentication protocols.
Plaintext passwords can also be easily manipulated, Ziv explains. For example, if the stolen machines password is AzureForTheWin1, the attacker might follow this pattern and login (successfully) to the Azure portal using AzureForTheWin! as a password, he says. Attackers wouldnt be able to test different variations with a password hash.
Further, he points out, companies keeping plaintext credentials could violate compliance regulations including PCI-DSS and SWIFT.
Microsoft has buckled down on credential security in recent versions of Windows. Credential storage has been hardened over time and since Windows 8.1 and Windows Server 2012, the operating system has not kept plaintext passwords at all. Guardicore approached the company with its findings 6 months ago, says Ziv, and Microsoft reported the behavior is by design.
We dont know about attackers that exploited this security flaw, but we believe that the popularity of the Azure reset password plugin exposes many machine to this flaw by leaving their plaintext passwords on machines disks, he adds.
Azure users are advised to check if they have reset password configuration files stored on their Azure machines. If so, they should be deleted. Anyone who has used the Azure reset password should assume it got compromised, says Ziv, and replace it on every machine or service where it is used.
This type of attack could be avoided by employing temporary credentials when resetting an account password, and then creating a new password for GuestOS, for example.
Related Content:
7 Spectre/Meltdown Symptoms That Might Be Under Your Radar
New Method Proposed for Secure Government Access to Encrypted Data
Microsoft Report: Cybersecuritys Top 3 Threats Intertwine
The Case for Integrating Physical Security & Cybersecurity
Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Early bird special ends March 23 - use promo code 200KS for an extra discount. Check out the
security track here
.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Azure Guest Agent Design Enables Plaintext Password Theft