This is Susan Bradley for CSO online today we're gonna talk about some good
news and some bad news so first the good news Microsoft was
going to release a patch in January to disable insecure LDAP channel binding
LDAP channel binding is specifically used in Active Directory
especially for on-premise Active Directory now especially for those of
you that have Active Directory based on older operating system perhaps even
Server 2008 r2 that's going out of support you want to take note so for
those of you on older operating systems you may still have this LDAP binding
insecure LDAP binding occurring in your network as a result of businesses asking
for more time Microsoft pushed off this event to March
of 2020 that's the good news now here's the bad news you may already be passing
credentials for your domain admin account and clear text in your network
as noted in this 2016 post identifying clear text LDAP bindings to your domain
controllers so this is not new it's been around for a while and attackers already
know that you are probably doing this in your network so what's a quick and easy
way to determine if your Active Directory environment isn't set up for
secure binding so first off go into your event logs into the directory services
section and look for events 2 8 8 6 and event 2 8 8 7 in particular if you have
to 8 8 6 in your direct active directory security event logs you'll see that
you're already in an insecure position basically your passwords are going over
in clear-text and if an attacker gets inside your
domain they can grab those values and hashes and well just go to town on with
them if you have an older domain controller you may find that you've
already had inherited from years ago a group policy setting specifically for
this LDAP server signing requirement if the LDAP server is
none or not define that's not good it actually should be to require signing
and you want to apply that in your domain now I'm sure you're saying but
wait how do I know if this is going to impact my domain good question what we
need to do next is turn up a bit of logging there's a specific PowerShell
command or you can do a register key that turns on advanced logging for this
these events in your event logs then about 24 hours or later you'll want to
look to see if you've got any of the other events 2 8 8 9 every single time a
client performs what's called a sazzle bind without requesting signing or a
simple bind on clear text if you see any of these two 8 8 9 in your event logs
then uh-oh you need to figure out what actual application is doing this and
either go back change out the application or see if you can up the
security now if you find you're using that a third party LDAP application that
is requesting simple binding and not passing things properly and secured try
going back to that vendor and saying hey I need some help here can you adjust
this and make this so it is in a secure manner or you can add what's called a
stay s SSL certificate to enable LDAP signing on your domain controllers have
included a link to a blog post that goes into detail on how you add a certificate
to allow for this secure LDAP binding once you've adjusted that application
properly then you go back into your group policy and check on that require
signing and apply throughout your domain and again check before you do it it may
impact hopefully it doesn't but if it does you need to make some changes to
your network environment as we start the new year it's time to go through your
end of your inventory review if you've got any insecure setups review what
you've done to your network in the past what you want to do in the the new year
review videos that we've gone online at Tech Talk and until next time this is
Susan Bradley for CSO online thanks again