I have been talking to a company that provides telephone exchanges and services to companies this week on behalf of a client and it has highlighted a worrying backdoor. It turns out that many of these companies have a way to remotely connect to their exchange for support purposes - they can remotely control, configure and troubleshoot your system to get you back up and running. Exchanges often have additional modems in them to allow for remote connections. This is all very well and good from a managed service point of view, but what about the rest of your network? Can this be exploited to gain entry to your network? Quite possibly in some cases - it certainly needs to be included in your security audit and perimeter testing.
Talking about a specific company now, they supply the software to monitor and bill phone calls through the exchange. They remotely install, monitor and manage this software. How do they do that? Well, it turns out that they install LogMeIn on your machine. Now this will make outbound connections through the firewall to make the internal machine accessible from the outside world. Hang on; you're making my networked machine that controls my exchange and billing accessible by anyone? By default LogMeIn will use simple username/password type authentication.
The user who accesses the computer has to set up their account with LogMeIn and will use the same username and password combination on all machines as far as I can see. Does the company have a universal account that they use to remotely access the machines or does each user have their own? If the company uses one default username/password, then what happens if someone gets hold of that information or someone leaves? Does the password get changed? If everyone has their own account, then are they removed when they leave the company? As this is all done through the Web, they could still gain access if they aren't specifically removed from the user group.
How much do you trust all the employees of that external company? How much do you trust the disgruntled ex-employee from them who has access? It might not be that they are trying to attack you, but they may be careless about the credentials or not revoke them properly. Also, consider the case where all the internal employees of an organisation are required to have 2-factor authentication and remote access is locked down. What's the point? There is a simple username/password entry point into the network that bypasses all the secure remote access services you may have in place. How secure are the passwords that the external company use? Would they match up to your complexity requirements? If they are simple, easily guessed or shared, then they open full administrative control over a machine on your 'secure' internal network. Who patches the machine and who updates LogMeIn?
How about installing a keylogger in such a firm to pick up on their username/password combinations so that you can gain full access to every customer's network. Once on the internal machine, malware can easily be installed and attacks launched on other internal machines unhindered. How many organisations have followed best practice and installed a UTM firewall in the core of their network to segregate their servers, etc., from other internal machines? Would a machine running this software be on a normal user subnet or on the management subnet anyway? Do many SMEs have more than one subnet anyway?
Needless to say, my advice was to avoid installing LogMeIn on the machine and temporarily allow a more controlled access to the machine with a temporary account, all of which can be disabled immediately after remote installation is completed. This opens up the problem of how to obtain support, but access can be temporarily granted and then removed when support is required with relatively little effort.
Clearly any such system needs to be well documented and be part of the security audit. I would advise that companies also ask for security audit and policy information from any external company who has any kind of access to the network - this should be standard procedure.