Vulnerabilities / Threats

3/20/2018
03:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Azure Guest Agent Design Enables Plaintext Password Theft

Researchers find attackers can abuse the design of Microsoft Azure Guest Agent to recover plaintext administrator passwords.

The design of the Microsoft's Windows Azure Guest Agent could let hackers steal plaintext administrator passwords from target machines, researchers at Guardicore reported this week. If abused, the flaw could enable a cross-platform attack affecting every machine type Azure provides.

Analysts discovered the attack vector while researching the Azure Guest Agent, which provides plugins for Azure's infrastructure-as-a-service (IaaS) offerings. The agent receives tasks from the Azure infrastructure and executes them; tasks are saved on the machine's disk. VM Access is a plugin for recovering VM access when users are accidentally locked out, or credentials are lost.

This research uncovered several security issues, all of which have been shared with Microsoft. Guardicore claims attackers have been able to access plaintext credentials after taking over an Azure virtual machine - if the VM Access plugin had been used on the machine - since 2015.

"When we looked into the communication channels between the guest agent and the underlying infrastructure, we were alarmed by the way the guest agent handles sensitive information," says Ofri Ziv, head of Guardicore Labs.

Microsoft says the attack method divulged by Guardicore doesn't constitute a security vulnerability, however.

"The technique described is not a security vulnerability and requires administrator privileges. We are continuing to investigate new features to improve customer experiences, and recommend customers follow best security practices, including setting unique passwords across their services," a Microsoft spokesperson said in a statement provided to Dark Reading.

Researchers found a flaw in the way the Azure Guest Agent receives the "Reset password" command from the Azure portal. The reset function contains encrypted sensitive data, and an attacker can abuse the workflow to steal new credentials in plaintext. The data can be decrypted using the certificate that resides on the machine, Ziv explains.

For the attack to be possible, the machine has to have used the VM Access plugin to reset a password at least once. The attacker must also have admin permissions to the Azure machine. With privileged access, it's "fairly easy" to take advantage of this flaw, he points out.

This design affects every Azure machine, Windows or Linux, that has the Azure Guest Agent (bundled into every minute) if the Azure reset password tool was used, says Ziv. Windows defenses like Credentials Guard don't protect machines from this exploitation.

The business implications of stolen plaintext passwords are powerful, he continues. Attackers can reuse them to access enterprise services, machines, and databases, testing credentials across different environments. This isn't possible with a password hash, which if stolen, can't be used as it is against services that don't support Microsoft authentication protocols.

Plaintext passwords can also be easily manipulated, Ziv explains. "For example, if the stolen machine's password is 'AzureForTheWin1,' the attacker might follow this pattern and login (successfully) to the Azure portal using 'AzureForTheWin!' as a password," he says. Attackers wouldn't be able to test different variations with a password hash.

Further, he points out, companies keeping plaintext credentials could violate compliance regulations including PCI-DSS and SWIFT.

Microsoft has buckled down on credential security in recent versions of Windows. Credential storage has been hardened over time and since Windows 8.1 and Windows Server 2012, the operating system has not kept plaintext passwords at all. Guardicore approached the company with its findings 6 months ago, says Ziv, and Microsoft reported the behavior is "by design."

"We don't know about attackers that exploited this security flaw, but we believe that the popularity of the Azure reset password plugin exposes many machine to this flaw by leaving their plaintext passwords on machines' disks," he adds.

Azure users are advised to check if they have reset password configuration files stored on their Azure machines. If so, they should be deleted. Anyone who has used the Azure reset password should "assume it got compromised," says Ziv, and replace it on every machine or service where it is used.

This type of attack could be avoided by employing temporary credentials when resetting an account password, and then creating a new password for GuestOS, for example. 

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Early bird special ends March 23 - use promo code 200KS for an extra discount. Check out the security track here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350
PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343
PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...