Has my Home Access+ install been hacked?

[DavetheITguy]

I'm hoping someone on here can help, a malicious student has 'Hacked' Home Access Plus or so they say.... they say they have managed to get a password for an account on the network from HAP+... After doing a bit of research they have used Kali Linux ?, Is it even possible to retrieve a password from the server. It's not a domain controller and the server doesn't store passwords. Everything is locked down with NTFS permissions and students cannot log onto the account through RDP.

 

Is it even possible to gain access to control the server from HAP+ ?

 

Any information would be helpful.

 

Thanks,

Edited May 11, 2016 by Dos_Box

[FN-GM]

There is a tool in Kali you can use to create a false login screen. Then someone logs into this and the password is harvested. Might have done that.

 

To be honest, whilst its a good product I wouldn't use it. Simple reason is we don't know of any security issues as it hasn't been audited etc.

[DavetheITguy]

How would they have uploaded that though to the system ?

[Arreks]

They wouldn't - it's a phishing page.

 

Was the account a student? they probably just got the student to try and log into it if they had the html file open on their screen.

[DavetheITguy]

They say they got a staff account, how would they have publicised the page for the staff member to log in ?

[E_G_R2]

Could be they guessed the password, a few good questions and a weak password.

[DavetheITguy]

Unlikely, Our passwords are alphanumeric more than 8 characters long and contain a symbol..

[Steve21]

Did you remember to lockdown the setup pages? If not they could just change the url for any page to anything they wanted and people would log in etc eg a false email login page

 

So many schools haven't bothered with parts like that even after having warnings emails sent out to them.

 

Other things are you using HTTPS even while accessing the site internally? Or potentially any normal network sniffing/mitm etc could see plain text being sent around

 

Steve

[nicholab]

https://en.wikipedia.org/wiki/Kali_Linux did they use the password hacking tool? Is this an external or an internal that the attach has taken place.

[rrrrr]

If they have got one password it is probably either;

1,Sniffed on wire if no https was used

2, used beef xss, cloned website and used phishing to send user to malicious site to record credentials.

3, keystroke logger?

4, cookie fixation and reset users password.

5, through other means (shoulder surfing, social engineering etc)

 

If more than one password was recovered, could have been a server targeted attack.

Never used HAP so dont know if attacks like sql injection are possible?

[DavetheITguy]

HTTPS across the board internal and external, setup page can only be access via domain admin privilege. everything is secure. I think he maybe bigging himself up when in fact he shoulder surfed or stole a document from a new staff member.

[rrrrr]

HTTPS across the board internal and external, setup page can only be access via domain admin privilege. everything is secure. I think he maybe bigging himself up when in fact he shoulder surfed or stole a document from a new staff member.

 

Probably the most likely method.

[DPenfold]

You have to also remember that the Program itself is created by one person ( @nickbro ) and supported by a small community, the current security it has is very good (impressive to me at least) for a one man army if you will lol.

 

I'd personally I'd investigate the situation, question the student (by the pastoral team or something) and perhaps even taking dispensary action to the child, see the damage the child has made (in this case to HAP) and try to restore HAP or seek an alternative application to use that is even more secure?

 

I agree with @rrrrr and hope you you can resolve the situation asap

[nickbro]

Access to the server shouldn't be possible, however if the server name & encryption key were somehow exposed then the admin password encryption could theoretically be reversed, however if you have properly set HAP+ & the server up then remote access to that server still won't be possible.

 

I've run HAP+ since I built it and my copy has never been compromised.

 

Personally I feel they have setup a phishing site and gotten staff logon credentials via that, which is possible.

 

If you feel that the server name, encryption key and salt's have been exposed, since these are auto generated and not stored in a file that would be near on impossible to achieve, you can change the key and salts by following the instructions on Home Access Plus+ - Documentation, you will need to reset the admin password after you have done this but because this disables the auto generated salts and keys it slightly lowers the security.

[minimoo]

"they say they have managed to get a password for an account on the network from HAP+"

 

This seems pretty unlikely.

 

Let see, any credentials hap stores are in app_data\ (Which asp.net/IIS should block access to by default), it's forced to run over https so you can't sniff traffic etc etc.

 

Could someone use a linux distribution to do a brute force password attack via hap/ldap etc - sounds more likely.

 

have you got IIS logs that would cover last few months of hap activity ?

[DavetheITguy]

Thanks for all the replies and help. I have finally got to the bottom of it all. The student watched the staff member put the username in and then used Kali Linux password creator to fish through random passwords. So in theory he didn't hack he just used a generator. So all is good .

Thanks for all your help. The staff member is question has been talked to.

[nickbro]

I would suggest getting Kerberos SSO working so internally it auto signs in.

[nicholab]

Yep I once used rainbow tables to brute force my password. This was on Windows 2000. It's a good little exercise.

[nickbro]

HAP+ doesn't allow brute force, it locks out after 3 failed attempts for 5 minutes

[jmak]

I don't know @nickbro and I don't use HAP+ so have no axe to grind, but every time I see the thread title it makes me a bit uncomfortable: Even though it has question marks, it gives me the impression that there has been a major security failure in the product and having read through the replies I don't think that's the case. Perhaps a @mod could tone down the title a bit?

[Dos_Box]

Thread title changed to something a bit more accurate.