Vulnerabilities / Threats

3/20/2018
03:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Azure Guest Agent Design Enables Plaintext Password Theft

Researchers find attackers can abuse the design of Microsoft Azure Guest Agent to recover plaintext administrator passwords.

The design of the Microsoft's Windows Azure Guest Agent could let hackers steal plaintext administrator passwords from target machines, researchers at Guardicore reported this week. If abused, the flaw could enable a cross-platform attack affecting every machine type Azure provides.

Analysts discovered the attack vector while researching the Azure Guest Agent, which provides plugins for Azure's infrastructure-as-a-service (IaaS) offerings. The agent receives tasks from the Azure infrastructure and executes them; tasks are saved on the machine's disk. VM Access is a plugin for recovering VM access when users are accidentally locked out, or credentials are lost.

This research uncovered several security issues, all of which have been shared with Microsoft. Guardicore claims attackers have been able to access plaintext credentials after taking over an Azure virtual machine - if the VM Access plugin had been used on the machine - since 2015.

"When we looked into the communication channels between the guest agent and the underlying infrastructure, we were alarmed by the way the guest agent handles sensitive information," says Ofri Ziv, head of Guardicore Labs.

Microsoft says the attack method divulged by Guardicore doesn't constitute a security vulnerability, however.

"The technique described is not a security vulnerability and requires administrator privileges. We are continuing to investigate new features to improve customer experiences, and recommend customers follow best security practices, including setting unique passwords across their services," a Microsoft spokesperson said in a statement provided to Dark Reading.

Researchers found a flaw in the way the Azure Guest Agent receives the "Reset password" command from the Azure portal. The reset function contains encrypted sensitive data, and an attacker can abuse the workflow to steal new credentials in plaintext. The data can be decrypted using the certificate that resides on the machine, Ziv explains.

For the attack to be possible, the machine has to have used the VM Access plugin to reset a password at least once. The attacker must also have admin permissions to the Azure machine. With privileged access, it's "fairly easy" to take advantage of this flaw, he points out.

This design affects every Azure machine, Windows or Linux, that has the Azure Guest Agent (bundled into every minute) if the Azure reset password tool was used, says Ziv. Windows defenses like Credentials Guard don't protect machines from this exploitation.

The business implications of stolen plaintext passwords are powerful, he continues. Attackers can reuse them to access enterprise services, machines, and databases, testing credentials across different environments. This isn't possible with a password hash, which if stolen, can't be used as it is against services that don't support Microsoft authentication protocols.

Plaintext passwords can also be easily manipulated, Ziv explains. "For example, if the stolen machine's password is 'AzureForTheWin1,' the attacker might follow this pattern and login (successfully) to the Azure portal using 'AzureForTheWin!' as a password," he says. Attackers wouldn't be able to test different variations with a password hash.

Further, he points out, companies keeping plaintext credentials could violate compliance regulations including PCI-DSS and SWIFT.

Microsoft has buckled down on credential security in recent versions of Windows. Credential storage has been hardened over time and since Windows 8.1 and Windows Server 2012, the operating system has not kept plaintext passwords at all. Guardicore approached the company with its findings 6 months ago, says Ziv, and Microsoft reported the behavior is "by design."

"We don't know about attackers that exploited this security flaw, but we believe that the popularity of the Azure reset password plugin exposes many machine to this flaw by leaving their plaintext passwords on machines' disks," he adds.

Azure users are advised to check if they have reset password configuration files stored on their Azure machines. If so, they should be deleted. Anyone who has used the Azure reset password should "assume it got compromised," says Ziv, and replace it on every machine or service where it is used.

This type of attack could be avoided by employing temporary credentials when resetting an account password, and then creating a new password for GuestOS, for example. 

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Early bird special ends March 23 - use promo code 200KS for an extra discount. Check out the security track here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
NC Water Utility Fights Post-Hurricane Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.