Re:Ironclad Apps: End-to-End Security via Automated Full-Sys...
by Animats on Friday November 21, 2014 @02:56PM
(#8643065)
Right. The Internet needs a few "tough nuts" like that. BGP and DNS servers are good places to start because they're 1) in wide use, 2) important, 3) usually standalone, 4) not too big, and 5) attack vectors.
Next up should be a Kerberos server, which is a central security controller for high security networks. A major vulnerability in Microsoft's Kerberos server was announced three days ago:
"The Microsoft Windows Kerberos KDC fails to properly check for valid signatures in the Privilege Attribute Certificate (PAC) included with the Kerberos ticket request. A domain user may forge the information contained in the PAC to request higher user privileges than should be allowed. Since the KDC does not verify the signature correctly, it will award the user the requested privileges, effectively making the user a domain administrator and allowing complete compromise of the entire domain."
Yes, there's an exploit. Applying the patch isn't enough, either.
"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed."
Next up should be a Kerberos server, which is a central security controller for high security networks. A major vulnerability in Microsoft's Kerberos server was announced three days ago:
(https://www.us-cert.gov/ncas/current-activity/2014/11/18/Mic...)
"The Microsoft Windows Kerberos KDC fails to properly check for valid signatures in the Privilege Attribute Certificate (PAC) included with the Kerberos ticket request. A domain user may forge the information contained in the PAC to request higher user privileges than should be allowed. Since the KDC does not verify the signature correctly, it will award the user the requested privileges, effectively making the user a domain administrator and allowing complete compromise of the entire domain."
Yes, there's an exploit. Applying the patch isn't enough, either.
"The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed."