4 ms·

So a more realistic scenario might be after gaining access to a company's LAN, or at a public WiFi? Did I read it right, you can force downgrade Exchange client

So a more realistic scenario might be after gaining access to a company's LAN, or at a public WiFi? Did I read it right, you can force downgrade Exchange clients from TLS to plaintext, essentially? What more did Apple say on the phone? No rationale given?

mirashii 9y ago
I see no evidence of a force downgrade, you can see in the screenshots that he configured SSL off. If you configure SSL off, your credentials go over the wire in plaintext. Surprise surprise.
- MichaelGG 9y ago
  Oh. Well then it's a complete non issue. No wonder MS told them off.
  - hexadecimated 9y ago
    I don't see what other response he could have reasonably expected from Microsoft, given that his complaints were about the iOS Exchange connector, and actually had nothing to do with Exchange Server.
dogma1138 9y ago
No, there is no vulnerability here there is no real way to force downgrade or redirect traffic, iOS will prompt a message asking you to confirm a self signed certificate..... What the author claims is a vulnerability isn't one in any real sense. They basically "complain" that the mailbox on the iOS phone doesn't "validates" that the server is a real exchange server, in all honestly neither does outlook, nor most other client-server protocols I know off if the server isn't correct it will fail that's it. Even if there was a way to downgrade or redirect traffic if you have the ability to do that it's game over, if you can MitM an SSL connection between an iOS device and it's server faking a layer 7 handshake isn't really hard to do at that point.
- mdeeks 9y ago
  I don't even know what could be "validated" that an attacker couldn't fake. The only real validation that can be done is if the certificate is valid for the domain.
  - jlgaddis 9y ago
    A valid certificate with a hostname matching the server's? In this case, it's POST'ing the credentials before the certificate is validated.
    - dogma1138 9y ago
      Again this isn't the case, I've tested it out myself and I get a prompt to confirm the SSL certificate when an invalid certificate is used. This is the step that the author gracefully has omitted: https://imgur.com/a/OXIal https://imgur.com/a/OXIal, and no nothing is sent until you approve the certificate. I can't be bothered to set up an actual exchange server to check what happens if you change the certificate midway, however having to approve a certificate change before when the certificates were rotated at my previous employer at least twice on an iPhone (and much older than the current iOS) it would bet that nothing is being sent.
  - dogma1138 9y ago
    Read it again, the SSL is validated normally. What isn't "validated" is the fact that there is a real exchange server beyond the HTTP/HTTPS endpoint. You can do a layer 7 validation and validate that there is an actual exchange server beyond the HTTP endpoint but as I stated it's utterly useless since if you can MitM the SSL connection answer "yes I'm a real exchange server" won't be a technical problem at that point. The author basically sees something that isn't there, the mail app tries to connect to an exchange server, it does so over SSL, it does validates the SSL certificate or prompts the user to approve it if the chain cannot be validates, it does however sends your credentials in the request to the server like it should.

mirashii 9y ago

I see no evidence of a force downgrade, you can see in the screenshots that he configured SSL off. If you configure SSL off, your credentials go over the wire in plaintext. Surprise surprise.

MichaelGG 9y ago
Oh. Well then it's a complete non issue. No wonder MS told them off.
- hexadecimated 9y ago
  I don't see what other response he could have reasonably expected from Microsoft, given that his complaints were about the iOS Exchange connector, and actually had nothing to do with Exchange Server.

dogma1138 9y ago

No, there is no vulnerability here there is no real way to force downgrade or redirect traffic, iOS will prompt a message asking you to confirm a self signed certificate..... What the author claims is a vulnerability isn't one in any real sense. They basically "complain" that the mailbox on the iOS phone doesn't "validates" that the server is a real exchange server, in all honestly neither does outlook, nor most other client-server protocols I know off if the server isn't correct it will fail that's it. Even if there was a way to downgrade or redirect traffic if you have the ability to do that it's game over, if you can MitM an SSL connection between an iOS device and it's server faking a layer 7 handshake isn't really hard to do at that point.

mdeeks 9y ago
I don't even know what could be "validated" that an attacker couldn't fake. The only real validation that can be done is if the certificate is valid for the domain.
- jlgaddis 9y ago
  A valid certificate with a hostname matching the server's? In this case, it's POST'ing the credentials before the certificate is validated.
  - dogma1138 9y ago
    Again this isn't the case, I've tested it out myself and I get a prompt to confirm the SSL certificate when an invalid certificate is used. This is the step that the author gracefully has omitted: https://imgur.com/a/OXIal https://imgur.com/a/OXIal, and no nothing is sent until you approve the certificate. I can't be bothered to set up an actual exchange server to check what happens if you change the certificate midway, however having to approve a certificate change before when the certificates were rotated at my previous employer at least twice on an iPhone (and much older than the current iOS) it would bet that nothing is being sent.
- dogma1138 9y ago
  Read it again, the SSL is validated normally. What isn't "validated" is the fact that there is a real exchange server beyond the HTTP/HTTPS endpoint. You can do a layer 7 validation and validate that there is an actual exchange server beyond the HTTP endpoint but as I stated it's utterly useless since if you can MitM the SSL connection answer "yes I'm a real exchange server" won't be a technical problem at that point. The author basically sees something that isn't there, the mail app tries to connect to an exchange server, it does so over SSL, it does validates the SSL certificate or prompts the user to approve it if the chain cannot be validates, it does however sends your credentials in the request to the server like it should.