4 ms·

The first 3 bullet points seem like they would happen on corporate networks without really trying too hard.

by Eridrus 11y ago

jameshart 11y ago
But typically that environment would fail bullet 4, right?
- peterwwillis 11y ago
  Are you asking if local accounts inside corporate networks are typically secure by default?
  - JoBrad 11y ago
    You have to create an account, then remove the password from it. You can't create a new account[1] without a password. [1] http://windows.microsoft.com/en-us/windows-8/disable-remove-password http://windows.microsoft.com/en-us/windows-8/disable-remove-...
    - tjoff 11y ago
      That's when using a microsoft account. Local accounts can be created without password directly from the install (at least in W10).
  - deleted 11y ago
    [deleted]
  - criley2 11y ago
    What corporate network uses local accounts as opposed to Active Directory/Domain accounts? If your business is not managing accounts over the domain via Active Directory and is individually setting up unmanaged local accounts for employees, you have far far bigger security issues than this remote desktop exploit.
    - peterwwillis 11y ago
      Any internal corporate network where a lot of R&D is done. AD accounts are typically for users and generic accounts, but if you're just spinning up a VM to test something, or you rebuild hosts regularly, local accounts speed up workflows. And a lot of people don't have solid security practices in place.
      - arca_vorago 11y ago
        I've been crucified in irc for suggesting moving away from samba and towards using chef/puppet/ansible/salt to manage windows user accounts (if coupled with pxe booting for dynamic image loading on user machines...) I still like the idea. OpenLDAP, etc also aren't cutting it to me... but don't confuse me misunderstanding the current importance of AD lock-in and the man/mind-hours needed to transition away from it.
    - l0c0b0x 11y ago
      Sounds like it only takes one local account, and there's got to be a local admin account in order to add the machine to a domain.
      - yuhong 11y ago
        Yes, it has to be a local admin account or it would have to be manually added to the group.
drzaiusapelord 11y ago
Almost no big company is using Win10. Its way too early for its adoption. Even then, they'd have a domain policy that requires passwords and the RDP group would also be controlled by GPO. Even then, they'd be using VPN or Remote Desktop Gateway to run this, not opening thousands of ports 3389 and one-to-one natting them to desktop machines. I could see small ma&pop companies vulnerable to this, but they're probably vulnerable to a host of things. Most small shops I've worked with have no idea what RDP is anyway, and use third party remote products, if any. Is exploit code out there? If not, then that's quite a leap yet for hackers. In a week or two every win10 machine in the world will have this patched. That's a very short window for what looks like to be an ugly, but tiny edge case. This is further evidence that Win10 is far from fully cooked. We're not touching it until 2018 with preliminary testing starting in 2017. MS rushed this pretty badly after the poor reception to 8. Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs. Surprises happen.
- Eridrus 11y ago
  > Almost no big company is using Win10. Ok. I'm glad you have a survey of every business out there. > Is exploit code out there? You use any non-Win10 RDP client and enter the username with the blank password. > Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH.
  - yuhong 11y ago
    >You use any non-Win10 RDP client and enter the username with the blank password. I think they are referring to automated attacks.
  - drzaiusapelord 11y ago
    How long large enterprise takes to move to a new windows has been studied and published. The typical update is close to 4-5 years. Hell, many shops only recently moved from XP to 7. Hell, Win7 is almost seven years old! >You use any non-Win10 RDP client and enter the username with the blank password. What username? What code generates the correct name? That's what I was referring to. Say there is a win10 pro machine with rdp enabled for the account 'jmpendergrast' with no password and listening to 3389 with no firewall blocking it. Wonderful, how many passess until you guess that? Where is the automation code? Note, by default windows will not let you use a password-less account for RDP: https://support.microsoft.com/en-us/kb/303846 https://support.microsoft.com/en-us/kb/303846 So that's another hurdle someone has to get through. Also, when RDP is enabled, it default to the newer versions which don't have this bug. You need to specify legacy access as well. Another hurdle. So let me summarize what needs to happen for this attack to work: Win10 needs RDP enabled with legacy access explicitly allowing non-NLA connections. Then Win10 needs a firewal rule for 3389 from its router or put on the internet without a NAT/Firewall. Then Win10 needs someone to make an account with a password (passwords are mandatory for rdp). Then someone needs to change the registry to allow blank passwords for a RDP user. Then that user needs to remove the password from that account. Then that user needs to be put in the RDP group. And if a home user does this, he or she isn't using a local account they're probably using a MSN account. This is very much an edge case here. >RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH. Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then.

The first 3 bullet points seem like they would happen on corporate networks without really trying too hard.

by Eridrus 11y ago

The first 3 bullet points seem like they would happen on corporate networks without really trying too hard.

jameshart 11y ago

But typically that environment would fail bullet 4, right?

peterwwillis 11y ago
Are you asking if local accounts inside corporate networks are typically secure by default?
- JoBrad 11y ago
  You have to create an account, then remove the password from it. You can't create a new account[1] without a password. [1] http://windows.microsoft.com/en-us/windows-8/disable-remove-password http://windows.microsoft.com/en-us/windows-8/disable-remove-...
  - tjoff 11y ago
    That's when using a microsoft account. Local accounts can be created without password directly from the install (at least in W10).
- deleted 11y ago
  [deleted]
- criley2 11y ago
  What corporate network uses local accounts as opposed to Active Directory/Domain accounts? If your business is not managing accounts over the domain via Active Directory and is individually setting up unmanaged local accounts for employees, you have far far bigger security issues than this remote desktop exploit.
  - peterwwillis 11y ago
    Any internal corporate network where a lot of R&D is done. AD accounts are typically for users and generic accounts, but if you're just spinning up a VM to test something, or you rebuild hosts regularly, local accounts speed up workflows. And a lot of people don't have solid security practices in place.
    - arca_vorago 11y ago
      I've been crucified in irc for suggesting moving away from samba and towards using chef/puppet/ansible/salt to manage windows user accounts (if coupled with pxe booting for dynamic image loading on user machines...) I still like the idea. OpenLDAP, etc also aren't cutting it to me... but don't confuse me misunderstanding the current importance of AD lock-in and the man/mind-hours needed to transition away from it.
  - l0c0b0x 11y ago
    Sounds like it only takes one local account, and there's got to be a local admin account in order to add the machine to a domain.
    - yuhong 11y ago
      Yes, it has to be a local admin account or it would have to be manually added to the group.

drzaiusapelord 11y ago

Almost no big company is using Win10. Its way too early for its adoption. Even then, they'd have a domain policy that requires passwords and the RDP group would also be controlled by GPO. Even then, they'd be using VPN or Remote Desktop Gateway to run this, not opening thousands of ports 3389 and one-to-one natting them to desktop machines. I could see small ma&pop companies vulnerable to this, but they're probably vulnerable to a host of things. Most small shops I've worked with have no idea what RDP is anyway, and use third party remote products, if any. Is exploit code out there? If not, then that's quite a leap yet for hackers. In a week or two every win10 machine in the world will have this patched. That's a very short window for what looks like to be an ugly, but tiny edge case. This is further evidence that Win10 is far from fully cooked. We're not touching it until 2018 with preliminary testing starting in 2017. MS rushed this pretty badly after the poor reception to 8. Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs. Surprises happen.

Eridrus 11y ago
> Almost no big company is using Win10. Ok. I'm glad you have a survey of every business out there. > Is exploit code out there? You use any non-Win10 RDP client and enter the username with the blank password. > Also further evidence that remote technologies like ssh, rdp, etc should always be wrapped in something else like VPN or at least strictly firewalled off to known good IPs RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH.
- yuhong 11y ago
  >You use any non-Win10 RDP client and enter the username with the blank password. I think they are referring to automated attacks.
- drzaiusapelord 11y ago
  How long large enterprise takes to move to a new windows has been studied and published. The typical update is close to 4-5 years. Hell, many shops only recently moved from XP to 7. Hell, Win7 is almost seven years old! >You use any non-Win10 RDP client and enter the username with the blank password. What username? What code generates the correct name? That's what I was referring to. Say there is a win10 pro machine with rdp enabled for the account 'jmpendergrast' with no password and listening to 3389 with no firewall blocking it. Wonderful, how many passess until you guess that? Where is the automation code? Note, by default windows will not let you use a password-less account for RDP: https://support.microsoft.com/en-us/kb/303846 https://support.microsoft.com/en-us/kb/303846 So that's another hurdle someone has to get through. Also, when RDP is enabled, it default to the newer versions which don't have this bug. You need to specify legacy access as well. Another hurdle. So let me summarize what needs to happen for this attack to work: Win10 needs RDP enabled with legacy access explicitly allowing non-NLA connections. Then Win10 needs a firewal rule for 3389 from its router or put on the internet without a NAT/Firewall. Then Win10 needs someone to make an account with a password (passwords are mandatory for rdp). Then someone needs to change the registry to allow blank passwords for a RDP user. Then that user needs to remove the password from that account. Then that user needs to be put in the RDP group. And if a home user does this, he or she isn't using a local account they're probably using a MSN account. This is very much an edge case here. >RDP seems like a shitty remote access protocol wrt security, but VPN products are certainly worse than OpenSSH. Everything sucks but FOSS right? How non-biased of you. I won't mention heartbleed and shellshock then.