Suppressing Password Spray Attacks
Microsoft’s October 17 announcement of a new method (in preview) to disable basic authentication for connections to Exchange Online is very welcome. Why? Basic authentication means what it says – a basic mechanism to authenticate a connection to a service. Basic authentication is simple to use and simple to abuse, which is why attackers try to exploit its simplicity in exploits like password spraying attacks.
Exchange Online supports many different connection protocols from ActiveSync to POP3 to IMAP4 to MAPI. This is a good thing because it allows people to use their client of choice to connect to their mailbox. Unfortunately, the profusion of connection protocols creates a difficulty too because each must be secured to stop penetration by attackers.
Protocol Authentication Policies
The preview method now available introduces a new cmdlet set to create and manage protocol authentication policies. Running the New-AuthenticationPolicy cmdlet creates an authentication policy that disables basic authentication for all the protocols supported by Exchange Online. For example:
New-AuthenticationPolicy -Name "No Basic Auth"
RunspaceId : fd030e40-053a-404c-90f9-3cf9f2c2dcef
AllowBasicAuthActiveSync : False
AllowBasicAuthAutodiscover : False
AllowBasicAuthImap : False
AllowBasicAuthLogExport : True
AllowBasicAuthMapi : False
AllowBasicAuthOfflineAddressBook : False
AllowBasicAuthOutlookService : False
AllowBasicAuthPop : False
AllowBasicAuthReportingWebServices : False
AllowBasicAuthRest : False
AllowBasicAuthRpc : False
AllowBasicAuthSmtp : False
AllowBasicAuthWebServices : False
AllowBasicAuthPowershell : False
AdminDisplayName :
ExchangeVersion : 0.20 (15.0.0.0)
The only protocol enabled here is Log Export, which is probably not going to be used by an attacker.
Modern Authentication Needed
Before you block basic authentication, you must enable modern authentication for your tenant and be sure that users have clients that support modern authentication, like Outlook 2016. Enabling a block on basic authentication will have an immediate effect on older clients if you’re not careful. See this support article for more details.
Changing Protocol Authentication Settings
If you want to change a setting to allow basic authentication for a protocol, run the Set-AuthenticationPolicy cmdlet. For example:
Set-AuthenticationPolicy -Identity "No Basic Auth" -AllowBasicAuthPop:$True
You can have multiple authentication policies in a tenant, each of which allows basic authentication for different protocols.
Assigning Policies to Users
After you’ve created the authentication policies you need, you assign them to user accounts to tell Exchange Online whether users can connect using basic authentication.
In my tenant, I decided to have a single policy applied to all user accounts and implement the policy immediately, which means that you also reset the baseline for user refresh tokens. This has to be done with PowerShell, so I used a command to find all user mailboxes and use the Set-User cmdlet to assign the authentication policy and reset the refresh token for the account to the current date and time. This will force Exchange to request clients using basic authentication for connections to reauthenticate using modern authentication.
Get-Recipient -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Set-User -AuthenticationPolicy "No Basic Auth" -STSRefreshTokensValidFrom $([System.DateTime]::UtcNow)
Checking Policies Are Applied to Accounts
To check that policies are in place as you intend, check the accounts by running the Get-User cmdlet. As shown below, you should see that each account is assigned the desired authentication policy and the refresh token is reset to the time when the Set-User command executed.
Get-Recipient -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Get-User | Format-Table
DisplayName, AuthenticationPolicy, Sts*
DisplayName AuthenticationPolicy StsRefreshTokensValidFrom
----------- -------------------- -------------------------
Deirdre Smith No Basic Auth 18 Oct 2018 14:30:42
Tony Redmond No Basic Auth 18 Oct 2018 14:31:06
TempAdminAC No Basic Auth 18 Oct 2018 14:31:11
Defining a Default Protocol Authentication Policy
New user accounts are assigned the default protocol authentication policy for the tenant. Unless you define a default protocol authentication policy in the organization configuration, the value assigned to new accounts is $Null, meaning that no policy is assigned. To change this, run the Set-OrganizationConfig cmdlet and define a new default:
Set-OrganizationConfig -DefaultAuthenticationPolicy "No Basic Auth"
You can check the value with the Get-OrganizationConfig cmdlet:
Get-OrganizationConfig | fl DefaultAuthenticationPolicy
DefaultAuthenticationPolicy : No Basic Auth
All Good So Far
The block on basic authentication has been in place in my tenant for a few days now and no problems have been seen so far. Apart from finding out whether people use obsolete clients to connect to mailboxes, the biggest issue you might face is that disabling basic authentication for PowerShell forces accounts to use multi-factor authentication when they connect to Exchange Online.
If a problem was encountered, it’s easily fixed by reversing course and either removing the authentication policy from the affected user accounts or allowing basic authentication for a specific protocol. To remove a policy, run Set-User again:
Set-User -Identity "John Smith" -AuthenticationPolicy $Null
No events are recorded in the Office 365 Audit Log to show that someone’s account was blocked for basic authentication. But this is a preview that’s designed to show customers what’s coming down the tracks and it’s likely that Microsoft will improve this aspect of the implementation when protocol authentication policies are generally available.
Limiting basic authentication for connections using a protocol policy only affects Exchange Online and has no influence over any other Office 365 workload.
Exchange Online is covered in Chapter 5 of the Office 365 for IT Pros eBook. Then again, Exchange is used by many Office 365 applications, so it turns up throughout the book.
The post Disabling Basic Authentication for Exchange Online (Preview) appeared first on Office 365 for IT Pros.
