Microsoft Remote Access Protocol Flaw Affects All Windows Machines

Attackers can exploit newly discovered critical crypto bug in CredSSP via a man-in-the-middle attack and then move laterally within a victim network.

A serious vulnerability found in Microsofts Credential Security Support Provider protocol (CredSSP) could allow a hacker to gain control of a domain server and other systems in the network.
Researchers from Preempt unearthed the previously unknown remote code execution vulnerability, which affects all versions of Windows, and reported it to Microsoft in August of last year. Microsoft today issued a fix
(CVE-2018-0886)
for the protocol as part of its Patch Tuesday release.
The logical cryptographic vulnerability in CredSSP can be exploited via a man-in-the-middle attack when a client machine and server authenticate to one another over the Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) connection protocols. CredSSP forwards credentials, encrypted, from the Windows client to the server for authentication.
We were able to find a classic mistake in the protocol and use that mistake to launch a man-in-the-middle attack, says Yaron Zinar, lead security researcher for Preempt. Zinar and his team will demonstrate the attack
next week in Singapore at Black Hat Asia
, where they also will release an open source tool that exploits the vulnerability.
Zinar says with CredSSP, the servers certificate doesnt get validated by the client; its just signed and not hashed. That allows us to create a malicious [and forged server] certificate that contains a malicious executable, he says. The client then can be duped with a forged server cert.
Exploiting the flaw requires the attacker to wage a man-in-the-middle attack between the client and server in an RDP or WinRM session. He or she would need WiFi or physical access to the targeted network. A WiFi exploit could be set up using a key reinstallation attack such as KRACK, for example, according to the researchers. Other vectors are Address Resolution Protocol (ARP) poisoning and exploiting vulnerable network devices such as routers, to reach servers inside.
During the man-in-the-middle attack, the attacker basically awaits a CredSSP session to compromise the authentication between the client and server, and employ a remote procedure call attack on that server. An attacker which have stolen a session from a user with sufficient privileges could run different commands with local admin privileges, according to a blog post by Preempt on the attack. This is especially critical in case of domain controllers, where most Remote Procedure Calls (DCE/RPC) are enabled by default.
All the client machine user sees is a failed RDP message, so theres little evidence that something went wrong with the remote session. An attacker then could end up with full control of the network if he or she then targets the victims domain controller.
Exploiting the vulnerability was very difficult, notes Zinar. There were a lot of constraints about which packets we could use, and which certs we could use.
Microsoft in its update today said the patch addresses the vulnerability by correcting how CredSSP validates requests during the authentication process. It recommends also using Group Policy settings or registry-based settings: We recommend that administrators apply the policy and set it to Force updated clients or Mitigated on client and server computers as soon as possible. These changes will require a reboot of the affected systems, Microsoft said in its update.
To defend against the CredSSP exploit, Preempt recommends patching workstations and servers, but warns that patching alone is not sufficient to stop this attack. Special configuration changes also need to be made, and blocking RDP and DCE/RPC can help. If you dont use RDP, turn it off on the machine. And if you are not using remote procedure calls, turn them off, Zinar advises. Also, decrease the use of privileged credentials. An admin should not use privileged credentials from WiFi, and sometimes not even from his personal workstation. From a dedicated workstation, maybe.
And dont use domain admins at all, he adds.
Related Content:
CIGslip Lets Attackers Bypass Microsoft Code Integrity Guard
7 University-Connected Cyber Ranges to Know Now
Millions of Office 365 Accounts Hit with Password Stealers
Vulnerabilities Broke Records Yet Again in 2017

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Remote Access Protocol Flaw Affects All Windows Machines