Have You Seen My Domain Controller?

[ad_1] At Cisco Reside Melbourne 2025, the SOC noticed many attention-grabbing behaviors from the varied purchasers of the convention community. One of many extra attention-grabbing ones was observations pertains to the DNS visitors emitted by Home windows purchasers on the community, in search of their group’s Lively Listing Area Controllers. With our Endace full packet seize for the occasion, we have been capable of seize DNS visitors from purchasers on the community and carry out evaluation utilizing Splunk Enterprise.

As a reminder, when a Home windows shopper is looking for to speak to a website controller it should make DNS queries for SRV information for names like _kerberos._tcp.dc._msdcs.DOMAINNAME or _ldap._tcp.dc._msdcs.DOMAINNAME. These DNS requests allow the shopper to seek out close by Kerberos or LDAP servers for his or her area.

Within the Cisco Reside Melbourne 2025 SOC, we noticed purchasers ship out DNS queries for roughly 3,800 distinct names beginning with “_ldap” or “_kerberos”. Whereas most of them returned a failure of some type (NXDOMAIN or SERVFAIL), roughly 300 had a profitable DNS response. A few of these have been profitable in subsequent makes an attempt to connect with the service (that means the area controllers are accessible in some vogue from the general public web), and some have been adopted up by cleartext LDAP BINDs, leaking credential info throughout the native community and Web. (SEE DANIEL’S BLOG POST)

There are a number of issues to think about from this.

First, there may be an open-source intelligence (OSINT) facet to this. The operators of any wi-fi community that you simply hook up with along with your laptop computer achieve telemetry about your group.

Second, a malicious wi-fi community might – relying on how your purchasers are configured – trick the shopper into sharing authentication info with it. Instruments reminiscent of Responder are designed for this objective. Correctly configured fashionable Home windows purchasers will use SMB signing, LDAP over TLS, LDAP channel binding, and different types of safety in opposition to a hostile community atmosphere. Are you certain your purchasers are configured in a approach that makes them sturdy in opposition to a hostile community?

Third, in case your group has Lively Listing area controllers on the general public Web, are you taking the mandatory steps to guard them?

Lastly, the Cisco Reside community is designed to be a protected community for attendees to make use of. However that's no assure that – elsewhere – the identical SSID couldn't be used to face up a hostile community. Shoppers will often auto-connect after they see a wi-fi community they’ve linked to earlier than.

One dependable mitigation for all of this can be a VPN shopper. A correctly configured VPN shopper like Cisco Safe Consumer can assist each a full tunnel VPN and “Begin Earlier than Login”. With this characteristic, the shopper laptop connects to the VPN as early as attainable. All visitors, together with DNS lookups, are despatched over the VPN. Whereas this doesn't eradicate all these dangers, it raises the security bar considerably.