Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials

guest · Sep 22, 2021

Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials
Email clients fail over to unexpected domains if they can't find the right resources
September 22, 2021
https://www.theregister.com/2021/09/22/microsoft_exchange_autodiscover_protocol_found/

A flaw in Microsoft's Autodiscover protocol, used to configure Exchange clients like Outlook, can cause user credentials to leak to miscreants in certain circumstances.

The upshot is that your Exchange-connected email client may give away your username and password to a stranger, if the flaw is successfully exploited. In a report scheduled to be published on Wednesday, security firm Guardicore said it has identified a design blunder that leaks web requests to Autodiscover domains that are outside the user's domain but within the same top-level domain (TLD).
Click to expand...

Exchange's Autodiscover protocol, specifically the version based on POX XML, provides a way for client applications to obtain the configuration data necessary to communicate with the Exchange server.

As Guardicore explained in a report provided to The Register, the client parses the email address – say, user@example.com – and tries to construct a URL for the configuration data using combinations of the email domain, a subdomain, and a path string as follows: [...] – the Autodiscover protocol tries a "back-off" algorithm that uses Autodiscover with a TLD as a hostname.
Click to expand...

"This 'back-off' mechanism is the culprit of this leak because it is always trying to resolve the Autodiscover portion of the domain and it will always try to 'fail up,' so to speak," explained Amit Serper, Guardicore area vice president of security research for North America, in the report. "This means that whoever owns Autodiscover.com will receive all of the requests that cannot reach the original domain."
Click to expand...

Guardicore: Autodiscovering the Great Leak

Executive Summary

• Autodiscover, a protocol used by Microsoft Exchange for automatic configuration of clients such as Microsoft Outlook, has a design flaw that causes the protocol to “leak” web requests to Autodiscover domains outside of the user’s domain but in the same TLD (i.e. Autodiscover.com).
• Guardicore Labs acquired multiple Autodiscover domains with a TLD suffix and set them up to reach a web server that we control. Soon thereafter, we detected a massive leak of Windows domain credentials that reached our server.
• Between April 16th, 2021 to August 25th, 2021 we have captured:

• 372,072 Windows domain credentials in total.
• 96,671 UNIQUE credentials that leaked from various applications such as Microsoft Outlook, mobile email clients and other applications interfacing with Microsoft’s Exchange server.
Click to expand...

• This is a severe security issue, since if an attacker can control such domains or has the ability to “sniff” traffic in the same network, they can capture domain credentials in plain text (HTTP basic authentication) that are being transferred over the wire. Moreover, if the attacker has DNS-poisoning capabilities on a large scale (such as a nation-state attacker), they could systematically syphon out leaky passwords through a large-scale DNS poisoning campaign based on these Autodiscover TLDs.
• Additionally, we have developed an attack – “The ol’ switcheroo” – which downgrades a client’s authentication scheme from a secure one (OAuth, NTLM) to HTTP Basic Authentication where credentials are sent in clear text.
Click to expand...

guest · Sep 24, 2021

Microsoft rushes to register Autodiscover domains leaking credentials
September 24, 2021
https://www.bleepingcomputer.com/ne...ter-autodiscover-domains-leaking-credentials/

Microsoft is rushing to register Internet domains used to steal Windows credentials sent from faulty implementations of the Microsoft Exchange Autodiscover protocol.
Microsoft rushes to register autodiscover domains
Research regarding faulty Microsoft Autodiscover protocol implementations leaking Windows credentials is not new, and Microsoft has been aware of the issue for years.

The research was first disclosed in a Black Hat Asia 2017 briefing, together with a formal research paper explaining the leaks. Other researchers also said they have reported the issue to Microsoft in the past and were told it was not a bug.
Click to expand...

However, after Serper released his report, Microsoft issued a statement to BleepingComputer indicating that the information was new to them.

"We are actively investigating and will take appropriate steps to protect customers. We are committed to coordinated vulnerability disclosure, an industry standard, collaborative approach that reduces unnecessary risk for customers before issues are made public. Unfortunately, this issue was not reported to us before the researcher marketing team presented it to the media, so we learned of the claims today." Jeff Jones, Sr. Director, Microsoft.
Since then, Microsoft has been rushing to register any autodiscover.[tld] domains it can find to prevent them from being used to steal Windows credentials.
Click to expand...

Log in or Sign up

Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials

guest Guest

guest Guest

Log in or Sign up

Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials

guest Guest

guest Guest

Useful Searches