|
|
|
TROOPERSCON - Security Assessment of Microsoft DirectAccess |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
TROOPERSCON - Security Assessment of Microsoft DirectAccess Par SecurityTube.NetLe [2016-04-25] à 14:46:52
Présentation : A talk about DirectAccess an IPv6-only VPN solution was given by our colleague Ali Hardudi during IPv6 summit. Ali has recently finished his master thesis on this topic. The DirectAccess VPN technology was introduced by Microsoft starting from Windows server 2008. It allows users remotely, seamlessly and securely connect to their internal network resources without a need to provide user credentials, which is done using different technologies such as Windows domain group policies. As everything, this technology has advantages and disadvantages. It is using pure IPv6 and can work over IPv4 infrastructure, provides bidirectional access and allows for remote management and administration while implementing enhanced security features, but not all Windows OS s are supported, the force tunneling and end-to-end encryption are not always possible, and there is a performance degradation when using IP-HTTPS tunneling. The DirectAccess solution is relying on a wide range of technologies, such as Active Directory Domain Controller AD DC IPSEC Public Key Infrastructure PKI HTTPS server as Network Location Service NLS Name Resolution Policy Table NRPT IPv6 tunneling technologies NAT64 DNS64, and others. Ali has built a lab and developed two scenarios for assessment IP-HTTPS default configuration case, and authenticated IP-HTTPS case. In these scenarios an attacker is considered to have the following position He knows URL IP of the DirectAccess server He has compromised or a trusted certificate Position of attacker is remotely settled or within the local subnet of the client. First scenario was the unauthenticated IP-HTTPS case with the following considerations packets with multicast unicast addresses are not forwarded, and a server replies on behalf of clients, if a client wants to configure an address that is already configure. For this scenario the following attacks were performed Scan alive hosts using Ping scan attacker position is local or remote Scan for alive DA clients using Duplicate Address local or remote Send packets with spoofed IPv6 addresses local or remote Denial of Service against IP-HTTPS tunnel local or remote Neighbor Cache exhaustion local or remote MITM using a trusted certificate local or remote MITM by relaying IPSEC packets via attacker s computer local only The second scenario was the authenticated IP-HTTPS case with the following features almost all types of packets are accepted by the DirectAccess, null cipher suites can not be used any more, all the authenticated IP-HTTPS connections are trusted, and the only packets that are not forwarded are those which have unspecified IPv6 source address The following attacks were performed Scan for alive DirectAccess clients using Ping scan attacker position is local or remote Scan DirectAccess clients for open ports local or remote DoS against DirectAccess clients by sending fake Router Advertisement RA with randomized prefixes local or remote Hijacking IPSEC packets that are sent to the client and cause a DoS local or remote DoS DirectAccess client, by sending unsolicited Neighbor Solicitation NS with the IPv6 of the DirectAccess server as a source address local or remote This assessment has shown that IP-HTTPS is a very critical component, which could be utilized by attackers to perform many IPv6 attacks on both DirectAccess client and server. You can have a look at the slides here or watch the video recording on our channel. Cheers, Olga For More Information Please Visit - https www.troopers.de
Les mots clés de la revue de presse pour cet article : security microsoft
Les videos sur SecuObs pour les mots clés : security microsoft
Les mots clés pour les articles publiés sur SecuObs : security microsoft
Les éléments de la revue Twitter pour les mots clé : security microsoft
Les derniers articles du site "SecurityTube.Net" :
- TROOPERSCON - Crypto code the 9 circles of testing
- TROOPERSCON - Towards a LangSec Aware SDLC
- TROOPERSCON - Deep dive into SAP archive file formats
- TROOPERSCON - Thanks SAP for the vulnerabilities. Exploiting the unexploitable
- TROOPERSCON - An easy way into your multi-million dollar SAP systems An unknown default SAP account
- TROOPERSCON - One Tool To Rule Them All
- TROOPERSCON - Mind The Gap - Exploit Free Whitelisting Evasion Tactics
- TROOPERSCON - The Chimaera Processor
- TROOPERSCON - Lets Play Hide and Seek in the Cloud
- TROOPERSCON - Planes, Trains and Automobiles The Internet of Deadly Things
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
