Understanding, Exploitation, Risks, and Mitigations

Encryption on computer systems has become so ubiquitous that we might expect it to always be in place, but the reality is that some of the most widely used services in the world transmit their data in the clear. That means unencrypted services sending usernames and passwords, as well as all the data sent between systems, for everyone to see. Malicious actors included.

Commonly unencrypted services

Some well known examples of unencrypted services include the File Transfer Protocol, or FTP. Often found running on TCP port 21, FTP is used to share files across the network, as well as an upload mechanism for websites. The telnet protocol, most commonly found on port 23, also communicate sin plain text, and can be used to interact with a huge number of services, including the SMTP service that might readily provide sensitive information to an attacker.

The Simple Network Management Protocol, or SNMP, often running on network-connected devices on port 161 UDP, operate in the clear in versions 1 and 2, with only version 3 adding encryption and authentication. Armed with no more than a widely known and available community string, a malicious actor can interrogate network devices and gather a staggering amount of information about their configuration, as well as that of the broader network. SMB is used by Windows systems to share resources, and it is extremely vulnerable at version 1 in the absence of robust network controls.

Man in the middle

The operation of services without encryption also opens the door to interception of the data being sent and received, also known as a man-in-the-middle (MITM) attack. It might seem attractive to, for example, bolster FTP with the addition of a username and password rather than allowing anonymous access. But the reality is there is little point, when all an attacker need do is connect to the network with a sniffing tool such as wireshark, and capture the username and password the next time it is sent by a client. Configuring usernames and passwords for unencrypted services provides a false sense of security.

The consequences

The compromise of unencrypted services may result in the exfiltration of data, with associated regulatory and reputational consequences depending on the sensitivity of the data in question. It may also result in the harvesting of user login information, useful for the initial exploit, as well as potentially for persistence, operating without triggering monitoring tools. Any stolen credentials may also be useful for the downstream exploitation of other systems owing to common usernames and password reuse. Issues are not limited to the confidentiality of data and systems. An attacker could also manipulate data, undermining integrity, as well as destroying data or executing a denial of service attack, affecting availability.

How to prevent it

There are several mitigations available to prevent the compromise of unencrypted services on an internal network. For example, network administrators could configure systems such that only approved MAC addresses can join the network, making exploitation of the vulnerability more difficult. In a similar vein, restricting user admin rights could prevent the installation of packet sniffing software, and monitoring could detect any such activity. It would also be possible to encrypt the connection in some cases – for example a VPN between users and an FTP server, preventing anyone without the VPN client from connecting.

However, the most effective solution to the problems introduced by the use of unencrypted services on a network is to introduce encryption. Whilst this may be difficult particularly in complex environments with significant technical debt, it remains the most comprehensive solution. Ensuing encryption in transit using TLS 1.2 resolves this issue. Replacing FTP with FTPS, SNMP 1 with SNMP 3, LDAP with LDAPS, and so on, means that even in the event a threat actor connects to the network and starts intercepting traffic, all data will be unusable to them.

To find out how I can help your organisation protect itself against a constantly evolving threat landscape, contact me via YDC. Read more about my testing services here.