Skype for Business security challenges – part 3

This is the third part of the topic: ‘enhancing Skype for Business environments’. In case you miss, check part 1 and part 2 to get the full picture.

On the previous topic post I focused on the ‘challenges’ on exposing user accounts and service from unauthorized access or DDOS. But now let’s see the scenario with authorized users using the collaboration features.

As mentioned before SfB is a tool that enables collaboration between people: any device, anytime and anywhere. And with federation you just extend all these capabilities with people across the world (specially with open federation).

But the ‘openness’ of the features can sometimes expose more information than people want to unintentionally share, or worse: intentionally!

 

Let’s use a reverse example: in a traditional meeting room you share information with a specific group of people. If it’s confidential you want to make sure that the information keeps private (closed room), that only the right participants are present, no open doors and all whiteboards, slides erased before leaving the meeting.

It should be the same on a SfB Meeting, right? But from my experience, who checks if the meeting URL is private and no available for guest access? Did you select ‘End Meeting’ when it finished? Did you remove all the shared content that was uploaded?

Another unintentional situation: How many of you sent a username and password using a chat session ? I did 🙂 (and regret it sometimes)

Federation is a great capability of SfB (I loved it, really!), but it can also go against you. Others can see your presence, ‘chat-noying’ and, on extreme cases, it can show more than you think.

Let’s use the picture of a federated test contact that I have on my SfB. This is what you can see from you contact when he changes the privacy level:

	(1) external contacts	(2) Colleagues	Workgroup	Friends and family
Presence	X	X	X	X
SIP	X	X	X	X
Email	X	X	X	X
Title	X	X	X	X
Company	X	X	X	X
Department	X	X	X	X
Office		X	X	X
Work phone		X	X	X
Mobile		X	X	X
Time zone			X	X
Home Phone (3)				X
Other Phone (3)				X

(1) default when adding federated contacts

(2) default for internal company contacts

(3) values set manually by the user on the SfB client

‘So what?’ some people ask
What if the customer finds out that you are an outsourcer, when you mentioned that you work on the main contractor? What if someone based on an email looks on the recipients and locates one the VIP? Why contact you for urgent matters if they can ‘escalate’?

The most extreme example is in fact a risk: Would you allow collaborators on a bank to share their desktop with outside participants and give remote control. The quickest corporate espionage is based on a rogue employee exposing sensitive data to competitors. SfB and other similar tools can be a good tool.

I can hear the readers thinking: this guy is paranoid !!
Answer: I’m not 😉  My out-of-the-box thinking always covers security aspects of the projects that I participate

SfB provides to SysAdmins several features to control and limit on how people collaborate, but in some situations it lacks of granularity. Let’s see some examples:

• You can limit the modalities (can share desktop, application, remote control, use audio/video) on a per user basis. BUT… not per group of users
• Remember the extreme case of undesired desktop/application sharing? You can block with policy. BUT… what if the end-user support is outsourced and you want your users to share the desktop with them ? or with any ‘company group’ domain partner?
• You can in fact block your contact card and presence, by setting that only users on your contact list. BUT… it will do it for all external and internal contacts

Other examples of situations that you can think when administrate SfB:

• Limit federated contacts to reach VIP’s or specific departments
• Block showing internal presence status to all external users.
• Prevent an internal user to share an application but allow external user to share with that user.

• Scan file transfer for virus/malware

And then you get your Legal department with security concerns and compliance policies:

“We need to prevent disclosure of confidential data (ex: block or alert in case confidential project code names, share customer data that violates GDPR rules)”

This 3rd part was also the last one on enumerating the challenges. The next one(s) would be on how to mitigate them.

Advertisements

Skype for Business security challenges – part 2

This is second part of the topic: ‘enhancing Skype for Business environment’. In case you miss, check part 1 to get the full picture.

This one will be shorter and quick to read. It’s about authentication of your user accounts. I will write in form of questions and not go through descriptions the idea is to make you reflect on the topic.

………..

And now how can I:

• enable multi-factor authentication (ex: RSA keys, biometrics, passwordless, …) on SfB Clients?
• limit specific mobile devices to connect to SfB (ex: iPhone 10.2.1 only, block Huawei devices)?
• login in SfB with different credentials than my Domain?
• prevent the user to save credentials locally on any device?
• restrict a user can sign-in on a maximum of two different mobile devices?
• prevent two or more users to sign-in from the same mobile device?
• limit users to sign-in from specific locations/networks (ex: employees service tablet to only inside the sales store Wifi) ? and block from specific countries?

A little side topic: If by this time you have the idea that ‘Skype for Business’ and MS are unsecured,… well most of this challenges can be also observed on the main competitors 🙂

Take me to part 3 >>

 

Skype for Business security challenges – part 1

So…! You have roll-out Skype for Busines (SfB) on you company. Either it’s a simple or more complex (HA, PSTN connectivity,…) it contains 3 components: a Front-end on an Active Directory and an Edge and a Reverse Proxy. These last two are, hopefully, isolated by firewalls.

Skype for Business topology example

Then you configure several policies to allow remote user access (PC, mobiles clients, ), federation with other SfB domains and conferences.

SfB is about enabling collaboration between people: any device, anytime and anywhere. Once you enable all these abilities to your users, you also create new security challenges to your company.

I would prefer not to call them ‘security risks’ at this time, BUT… ignoring them after reading and knowing them, it would change subject title!

Since there is quite a significant amount of content to cover, I divided this topic into smaller post. Initially I will expose the challenges and after them, I will describe how to mitigate them.

Keep also in notice that, although:

• I use an On-premises SfB as the example, you will see very similar challenges using Office 365, in either Skype for Business Online or Microsoft Teams;
• the challenges might be related to external user connectivity, they can be replicated using just inside your corporate LAN.

Let’s start with the first topic:

Part 1 – Denial of Services and exploits

 

1.1. Denial of Services by account lockout

Requirements:

1. knowing a SIP address of an user. How difficult is that? In 90% of the case it matches his email address.
2. knowing the account login. What are the chances that the UPN is the same as the SIP and Email address? Knowing the domain and the samaccountname might be more tricky, but it’s possible.

As soon as someone knows a valid SIP address I can use a SfB client (windows of for mobile) and can now try to login with credentials 5 or more times.

You can try to login on Skype for Business with different credentials

A successful ‘DDoS’ will lock that user AD account (for some minutes or forever depending on the AD policy).

Not big security issue? Well let’s think:

1. a locked user is a person that cannot work until support unlock him
   (and gets locked again by an active DDoS).
   This can be harmful from but can a possible attempt to sabotage a competitor to reply on time to a last minute RFC. And what happens
2. It will a significant issue if the affected user is a VIP or the CISO
3. by default there is no direct way to prevent these, since even the remote access policies will only take effect after the user successfully logs-in
   remember the traditional message: ‘your account is not allowed to sign-in from external networks’?
4. It can get worse: imagine that you have several UCC 3rd party applications that uses SIP ‘service’ accounts? What happens if they get locked-out?
   What if there are still some companies that uses the default ‘administrator’ account? It can also get locked out the same way as many other critical domain ‘service’ accounts

Getting more concerned now? Using SfB clients is not the only way to cause account lockouts…. (Whaaaaatt?)

A simple SfB installation exposes some Webservices that actually ask for user credentials. How? Less experient SfB administrators configure topology with ‘easy-to- guess’ short URLs.

Here an example of a dialin.company.ch. If you click on the Sign In you will get the chance to enter a username and password (to change a PIN).

But there are more services: (1) the join a meeting URL allows you to try to authenticate, (2) the webscheduler (if installed) request the same, (3) if NTLM is enabled on the IIS (SfB webservices), any browse access attempt on known URLs will request authentication (ex: for the address book service: https://lsweb.company.ch/abs)

1.2 Denial of Services or attacks on published external Web Services

As stated before, a very basic SfB deployment will expose the web services to the internet throw a basic reverse proxy role that forwards the traffic throw the DMZ.

There are at least some potential challenges:

1. Simple DDoS against the IIS services until the servers CPU/memory is exhausted
2. Direct exploit of SfB vulnerabilities that on worst case can run unwanted command on the Front-end servers
3. ‘Espionage’: someone can try to guess and find some running meeting with ‘guest’ permissions, since the formats are usually https://meet.company.ch/<username>/<meetingID>

 

1.3. Service exposures

The default (at least for mobile clients) discovery service is https://lyncdiscover.company.com. Just by sniffing this URL you might get some more information. And if you provide a SIP address you will get even more because of the authentication.

In the above example you will get the front-end server FQDN that reply to the request. Might be harmless, but this server internal FQDN is an additional clue to try to use it for user UPN DDoS attacks and as you dig throw other responses you might get to know a little bit more about the internal topology.

 

A normal lyncdiscover and authentication process of a SfB mobile client

Ready to proceed to part 2?

Skype for Business 2015 Server CU8a or CU9?

UPDATE 13/March 21:48 – Microsoft is updating now the info. It’s March2019 update to address a security vulnerability (CVE-2019-0798).Specific details here:
Microsoft Lync Server/Skype for Business spoofing cross site scripting
Better start planning to rollout March/2019 CU9 then! (and Lync 2013 Server if you still use)

I downloaded all the cumulative updates as soon as they are released. I like to keep an history and peek on the changes. Today I need to get the January/2019 CU8, but my repository was unavailable. So I went to official CU download site, but I noticed that the date published was from yesterday, but pointing the the KB3061064 (?!). When I got back the access to my repository, I noticed that this file also has a different version:

Now I have two January/2019 CU with different versions (6.0.9319.537 and 6.0.9319.544) and different file sizes.
Time to dig and spot the differences: there are two msp files that changed:

OcsCore.msp

Two noticeable changes:
– non-US dll language files: they were compiled in different dates, but still have the same version number
– The Tracing files (used by CLS/OcsLogger tracing tool). These one have some significant changes:

EnterpriseWebApp.msp

The files on both packages have the same size, but a ‘look inside’ reveals one particular difference: the ‘Lync.Client.Common.Consolidated.js’ is different.

A closer look reveals 5 lines of codes changes (one seems an additional protection)

So… since MS didn’t update any documentation so far:

• Is this CU8 republished?
  If so, MS will now have customers with different files for the same CU
• Is this a CU9 (or a Cumulative Security update -SU-)?
  It could be, since the date matches the usually releases cycles.

Running the cumulative update installer on a Front-end server with January2019 CU8, confirms the patches changes on the identified components:

The point the a KB4492303 and KB4492302 that don’t exist.

UPDATE 3/April/2019: Microsoft update the ‘Get updates’ section of KB3061064 section with an additional line:
4494279 Fix for Skype for Business 2015 and Lync Server 2013 spoofing vulnerability

That document mentions a ‘March 20’19 security update’:

The March 2019 security update contains a security fix for the spoofing vulnerability that is described in the following security advisory:

• CVE-2019-0798
• CVE-2019-0624

My official guess is now is that this is a SU9 and MS just decided to update this ‘silently’

But some IT engineers might believe that they are downloading and installing CU8 today.

 

The importance of knowing about certificates

Deploying and managing a Lync/Skype for Business environment demands you to know a lot more about technologies and protocols. Their communications are encryption which means that you need to deploy certificates and specially to maintain them over time. One wrong, forgotten or misplaced certificate can give you lot of headaches.

The following issue I faced recently, on a Lync 2013 environment is a good example of how a simple misplaced CA certificate can cause unexpected behaviours.

ISSUE and symptoms

After restarting the servers, the Lync services start reporting connection errors and denials due to certificate validation.

As a consequence, the users experience several issues:

• Contacts presence status unknown
• Address book unavailable
• Unable to schedule, start or join meetings
• External users unable to join/dial-in meetings

They are still able to sign-in, send IM’s and perform peer-to-peer calls (including video and desktop sharing) and PSTN inbound/outbound calls.

On the servers you will find from several others, eventID 32042 errors ‘Invalid incoming HTTPS certificate’ and eventID 30998 ‘Sending HTTP request failed’

Cause

The clue came from some informational events of services receiving invalid client certificates.

The last description line ‘Certificate error: 21482049809.’  translates to error code 0x800b0109, which is defined as CERT_E_UNTRUSTEDROOT. Lync server could not trust the subordinate CA that was installed on the local machine store ?!

Turns out that a new PKI has been deployed, and I found a subordinate CA incorrectly installed on the ‘Trusted Root Certificate Authorities’ of the servers.
(a subordinate CA can be easily identified because it’s not self-signed (‘Issue To’ name doesn’t match the ‘Issued By’)

Windows Server 2012 (and higher) implements checks for a higher level of trust for certificate authentication. By finding the invalid certificate, doesn’t provide any Trust Root CA list and therefore the services cannot to validate the certificates presented to them.

SOLUTION

1. Delete the subCA from the Trusted Root CA store of the server
2. Reboot the server so it can load correctly the Trusted Root CA list.

Final notes

The issue will only start after a server reboot, so it can take quite some time to associate the cause/effect…. especially if you have just install a OS update !! (and blame it, uninstall, …)

Only after knowing exactly the issue, I manage to ‘google-fu’ a 4 years-old KB2795828 with a similar situation.
From that one I got a very usefull powershell script that help us to find any non self-signed CA on the Trusted Root CA store of the machine

Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject} | Format-List *

Skype for Business 2016 client critical exploit public available

The code mentions the Skype for Business 2016 client, but the base vulnerability affects also the Lync/Skype4b 2015 client:

• Risk: severe – exposes the user data
• Exploit codes available here or here
  No user-interaction is required for the XSS to execute on the target machine. It will run regardless of whether or not they accept the message. The target only needs to be online.

Solution: apply asap the June 2017 update on the Skype4b 2016 or 2015 clients

UCaaS: Part #1 – planning to provide Skype for Business as a service?

Over the years of consulting services, managing and deploying UCC solutions, virtualization,… you might have thought several times about: why not provide them to all my customers from as a packed service?.
It’s nothing new nowadays – you called it ‘cloud’, hosting services, …

I’ve been planning and designing it for quite some years. So why not just share some memories, experience and concepts?
I decided to call it, since the 0 day, UCaaS – Unified Communications as a Service. Looks a cliché now, but it’s short and easy to catch 🙂 but also much broader than just providing Skype for Business

In this first part, I will just do a global overview that applies to any XaaS. I will focus on Lync/Skype4B on later posts.
Look at this one as a cooking lesson, starting by the main topic: the Kitchen 🙂

#1 It’s a service, so you need to see more then installing a couple of servers and connect the users! Before getting to that stage think, discuss and question about everything that comes to your mind.
Why? because we are about to run a business, any resource costs something and you need to count them on your selling price !

#2 We can go this way:
* buy a server, put on your basement or garage, connect to the internet, rent/create a webstore site and ready! (it can actually work)… or,
* everything below this line (more or less complex and as a existing company you might already have)

I like to group things to be easy to read and explain . Be aware that you might not need to own or have all on your side (you can just rent datacentre space, VM’s, backups).

Base infrastructure

The ‘hardware’, where you place it and how you reach it: Servers, Storage, Backup robots, Switching, Routing,  Firewalls, Load Balancers, Rack/Datacentre space, energy, internal and external connectivity (cabling, telecommunications, internet), …
By the way: all these also have something called ‘yearly maintenance costs’ if purchased and you will need to allocate some earnings  to replacement them when it’s time.

if planning big, consider consulting Hardware providers that support ‘pay as you grow model’. Many of them have cloud-ready solutions from small footprint up to large scale (and you can find some nice surprises on less-known brands)

Support infrastructure

Some invisible, but ‘must have’ systems:

• Virtualization- of course you will use it 🙂 and on this one we can even have mixed scenarios as the group above (virtual firewall, load balancers,…)
• Monitoring – Ever heard of an SLA ? if you are providing a service you will have to agree on an uptime. How can you measure and show to the customer? How can you detect failures or when you need more resources?
• Backup and DR – Are you ready to loose your data? what about the customers data?
• Security – you will need to manage patching and upgrades, antivirus, IDS, IPS… it’s a dangerous world outside, waiting to steal your customer data or take down you business.

 

Customer interfaces

This is your front porch and you should not hide it. If the prospective customers don’t like it, will they trust the inside of the housing?

• Customer infrastructure connectivity – the way that the customer systems and users will connect to your services. The simplest way is the internet, but it would require for some services, WAN, private networks and interoperability/integration solutions.
• The customer portal/tools – This can be from a simple status/account/billing view up to a self-provisioning, self-management
• Ticket / support handling – five customers might be easy to deal with phone calls and emails, but what about 30,100,…?

Software

I include on this section separately, because not everybody is aware of some legal aspects. Let’s take a look at Microsoft products: you cannot just buy a Windows license, install on your server and charge it to one (or more) customer(s) for a running service there.
Microsoft is clear on this: if you are a Hosting/Service Provider, you need to buy licensing throw a SPLA .
Like Microsoft, VMware and many other vendors provide (or enforce) this model and is not a bad option:

• The advantage is that it allows you to pay monthly for what you really use –
  this is the pay-as-you-use model
• The inconvenient is that you need to report the usage periodically and allow auditing to your business

My advice is:

• as a Service Provider, contact the vendor and explain your intentions. They will help you to find the most profitable solution… most of the times.
•  Don’t try to find ‘loopholes’…trust me: it will cost you much more later!

Shared services

Here you put all the platforms and services that can be shared between multiple.
Great examples are web servers hosting multiple websites. But pushing your skills to the limit, you can have a lot more. Multitenant solutions also would fit on this group.

Dedicated your best resources planning them! This is where your cost savings make a difference.

Dedicated services

This is what your best customers are looking and willing to pay for.
It’s your cash cow – the more you have here, the quicker your revenue increases. These business models have more opportunities, specially combined with standardized offers.

It has every group of systems serving unique customers:

• It should be a ‘block model’ – same deployment and standardized procedures, automation and self service tools, will keep operational costs low and predictable.
• But you can also include very ‘$pecific $olutions’ – these one gives you the opportunity to upsell consulting and managed services.

Skype for Business services model would fit on this group… but it might also fit for the group above? 😉

Not there yet

If you already own a company then this is known to you: Work office place, furniture, energy, personal computers, HR, billing / account management, mobile devices, transportation/gas… you also pay for that, right

All done! What now?

After joining and calculating all the pieces, test yourself doing at least these questions:

• What is the cost per service/per user? How much a VM with a specific size costs?
  This is the lowest value will charge for your service.
  => Capitalism rule: to earn money you need to sell it for more than you pay for
• What is the break even point?
  simulate, over and over the time! Be ready to answer: how many customers (or users) do you need to have to cover all the costs made so far?
  Whomever is going to put money on this will make do that question before writing the checks (even yourself if you got the money)
• What is the ROI?
  Investors, banks or stake holders will look for this (and many other tools).
  If you need financing you need to promise when and how much will you pay back.
• Psychological one: are you an entrepreneur?
  It needs investment analysis, financial control, technical know-how, purchasing/selling/negotiation skills, HR management, and so on. As the business creator you need deal with of them.
  This will not be a one-man-show for long. Sooner or later you need help trust and delegate to others. Starting with someone it will look less difficult.

This might seem directed to start-ups guys, but it applies to existing companies. Product and/or Business developers need also to assume the above challenges, the problems, assume risks and responsibilities.

You are putting you neck and reputation on it and get ready to accept failure.
But of you planed all (not just a suicidal gambler), showed you the balls, and if successfully, the personal reward is priceless.

It’s still not over! there are some more strategic decisions for a go-to-market, on part 2 (writing in progress).