ANDROID HACK MICROSOFT ACTIVESYNC HOW TO
ANDROID HACK MICROSOFT ACTIVESYNC ANDROID
ANDROID HACK MICROSOFT ACTIVESYNC PASSWORD
ANDROID HACK MICROSOFT ACTIVESYNC PLUS

Given that organizations do not want blanket disclosure of client credentials for Exchange they should consider implementing a forced password change as part of the notification process as well.

ANDROID HACK MICROSOFT ACTIVESYNC HOW TO

They can then email those users with detailed instructions on how to disable push, and under what circumstances manual synchronization is allowed. Organizations with access to Rapid7’s Logentries can identify such clients simply by searching for where(/Nine-/i) in the query bar. Then, they can determine what those users who are currently using the NineFolders app to access organization data should do. Relying entirely on users is never a good idea, so IT administrators should look for MUA strings that begin with “Nine-“ to flag the app’s use in the ActiveSync logs. Users can disable push synchronization in Nine and synchronize manually, one when they’re on a trusted network (never on a public wifi of any kind), or using a VPN connection into a trusted network.

com is the password) Plugging the Leak!įortunately, there is a definitive fix for this vulnerability. This decrypted capture of traffic sniffed using mitmproxy, an open source hacking tool, shows that account credentials appear in Base64 encoded form:Īny Base64 decoder will tell you this field reads to see here (the part after. Likewise, DNS queries for the Exchange server are vulnerable in the same way from the Nine app. All communications packets include those credentials in an HTTP basic authentication header, and Nine does not perform certificate validation to make sure the certificate is valid and current (not revoked).

Because communication between the Nine app and a remote Exchange ActiveSync service often happens when the victim opens his or her phone, when an email is received (and push enabled), or when the phone polls the remote service, exposure of credentials is highly likely. In this kind of situation, the attacker need merely wait for a Nine user to come within range of the rogue WAP.

Then, the attacker could funnel secure HTTP (HTTPS) traffic to a proxy that serves self-signed certificates from any certificate authority. This might mean, for example, that an attacker could set up a mobile WAP using an innocuous-seeming yet attractive SSID like “Starbucks” or “MacDonalds” that was bridged to a 3G/4G mobile data connection. According to the researchers, attacks may easily be launched in open wireless environments, or by enticing Nine users to access the Internet using a rogue wireless access point (WAP) under their direction and control.

ANDROID HACK MICROSOFT ACTIVESYNC ANDROID

Potentially, traffic from the Android device to an Exchange server, or to, for organizations using Outlook365 corporate email, could be sniffed. The biggest risk from this vulnerability comes from a man-in-the middle attack, which could be foisted by an attacker with privileges on the same network as the mobile device running the Nine app. At present, the Nine app (also known as NineFolders) is available through the Google Play store and has been installed somewhere between half-a-million and one million times. It has been identified with a Common Vulnerabilities and Exposures (CVE) ID – namely, CVE-2016-6533 – though no formal corresponding entry is currently available in the CVE database.

ANDROID HACK MICROSOFT ACTIVESYNC PLUS

Baldly stated, this app leaks Microsoft Exchange user credentials, plus mail envelopes and attachments, mailbox synchronization data, caleandar entries and tasks to attackers. In October, Rapid7 researchers uncovered a significant vulnerability in the Nine mobile application for Android.

Android hack microsoft activesync