Since
march 2016 there were rumors that windows & samba has a very dangerous
vulnerability and advised system admins to ready to patch as soon as possible
on 12th april when Microsoft & SAMBA has scheduled to release their
security patches .
SPECULATIONS:
Badlock
was vulnerability in the SMB & DCERPC protocol used by the SAMBA & Windows
which is overhyped by the http://badlock.org/
and compared with the Heartbleed (http://heartbleed.com/) bug found in the
openssl in terms of the impact by using a very similar template. some people
predicted that it could be as bad as MS08-067, the vulnerability
that the Conficker worm exploited.
REALITY OF THE BADLOCK:
Microsoft
& Samba release their security patches on 12th October for Badlock (CVE-2016-0128/CVE-2016-2118).
As
per Microsoft Bulletin, the vulnerability is “caused by the way the SAM and
LSAD remote protocols establish the Remote Procedure Call (RPC) channel.”
As
per Samba advisory “A man in the middle can intercept any DCERPC traffic
between a client and a server in order to impersonate the client and get the same
privileges as the authenticated user account. This is most problematic against
active directory domain controllers.”
Microsoft
rated this vulnerability important not critical. As it is an Elevation of privilege and require MITM capability.
SHOULD ATTACKER EXPLOIT BADLOCK
Exploitation
of this vulnerability is not simple and will not give the ROI due to following
reasons
Attacker
needs MITM (Middle in the man) Capability.
-
To
achieve it attacker has to already compromise the victim network /System by
other ways.
-
Attacker
would be able to compromise single system at a time.
-
Attacker
foot prints would be very large and easy to capture.
-
If
Attcker already has MITM capability attacker can use it to accomplish to achieve
more simple and valuable task rather than exploiting this bug .
CONCLUSION:
Practice
followed by the peoples behind disclosure of the Badlock has been criticized heavily
by the community since beginning & after it turnout to be a mute
vulnerability everyone felt like cheated and trolled it with Sadlock https://sadlock.org/. It’s always a good
choice to patch as soon as possible but decision cannot be driven by crating
the hype and panic. Such incidence de-focus from the real issues like more critical
& Remote Code execution vulnerabilities
