Airscanner Mobile Security Advisory: Remote Password Compromise of Microsoft Active Sync 3.7.1

Product:
Microsoft Active Sync 3.7.1

Platform:
Tested on Windows XP Professional SP-2  and Windows Mobile Pocket PC 2003

Requirements:
Windows XP Professional with Active Sync 3.7.1

Credits:
Seth Fogie
Airscanner Mobile Security
www.airscanner.com 
July 22, 2005

Risk Level:
Low for denial of service attacks. Medium for password collection attack.

Summary:
”Active Sync” is Microsoft’s  default connectivity program that keeps a desktop PC and a handheld Pocket PC synchronized. It also includes various other features, such as debugging ability, file transfer, etc. 

Details:
When a Pocket PC device attempts to sync to a PC, it will send three initial packets to the Active Sync program on port 5679. The following outlines the contents of the packets:

packet1[] = "\x00\x00\x00\x00";
packet2[] = "\x98\x00\x00\x00"; //SIZE OF NEXT PACKET
packet3[] "\x28\x00\x00\x00" 
"\x04\x15\x40\x04"
"\x11\x0a\x00\x00" //2577 (AUTORUN?)
"\x05\x00\x00\x00"
"\x59\x29\x6d\x46" //EQUIP ID
"\x00\x00\x00\x00"
"\x28\x00\x00\x00" //LINK TO POCKET_PC1 TEXT
"\x3e\x00\x00\x00" //LINK TO POCKETPC TEXT
"\x5c\x00\x00\x00" //LINK TO SSKD TEXT
"\x78\x00\x00\x00" //LINK TO AXIM X50 TEXT
"\x50\x00\x6f\x00" //TEXT IN UNICODE
"\x63\x00\x6b\x00\x65\x00\x74\x00\x5f\x00\x50\x00\x43\x00\x31\x00\x00\x00\x50\x00"
"\x6f\x00\x63\x00\x6b\x00\x65\x00\x74\x00\x50\x00\x43\x00\x00\x00"
"\x53\x00\x53\x00\x44\x00\x4b\x00\x00\x00\x00\x00\x44\x00\x65\x00"
"\x6c\x00\x6c\x00\x20\x00\x41\x00\x78\x00\x69\x00\x6d\x00\x20\x00"
"\x58\x00\x35\x00\x30\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00"
"\x04\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00";

If the equipment ID value is valid, the PC will respond with a x12345678. If the equipment ID is not correct, the response will be x03. With this static response, it is trivial to brute force the valid equipment ID value. The reason this is important is because if you change the value in packet1 to x00000001 to the correct corresponding PID, a prompt will appear on the PC asking for a PIN value (figure 1). If a target enters a password, the information will be passed back to the remote, requesting client. If a value other than x01 is sent, that value will be XORed with the response to pseudo-'encrypt' the password. This method of information gathering is possible from over a network and does work over the Internet. From a quick nmap scan, we found about roughly 10 computers with this port open per 50 class C subnets.
 
Finally, we discovered that if numerous attempts were made to initialize with a PC running Active Sync, after about four attempts the Active Sync process freezes. In addition, if a user attempts to sync while a brute force equipment ID attempt is underway, the sync will usually fail.

Workaround:
Block Internet and LAN access to port 5679 using a firewall until this issue is patched. 

Vendor Response
Awaiting response.

More information avaliable here
http://www.airscanner.com/security/activesync371.htm 

-----------------------------------
Mobile Antivirus Researchers Association
http://www.mobileav.org