if TFS is installed using HTTP but only accessible from inside a LAN with Windows authentication, is it possible that a user impersonate someone else? what are other risks?
2 Answers
It depends on how secure your LAN is. If you have full protections against man-in-the-middle attacks (e.g. protection against ARP, DNS or DHCP spoofing), against passive network-wide sniffing (mirror port switch) and also sniffing on local machine then it might be sufficient, i.e. at least not less secure then with HTTPS. If not impersonation might be possible.
answered Oct 27, 2015 at 12:37
-
I was digging a bit more and maybe the right question is how to impersonate another user over HTTP in a web site that uses Windows Authentication. TFS website is nothing more than a web application that uses Windows authentication and cookies between requests. You sniff someone else cookies and you impersonate them easily. Commented Oct 27, 2015 at 15:50
-
@user813948: that's what I said: if your LAN is safe against sniffing and man-in-the-middle attacks then you are probably safe. Commented Oct 27, 2015 at 16:24
-
You implied that I want to be safe and make the assumption that the environment is safe too. What if someone overnight enters the building? So risks are the same for a website and I've got that but what are (if any) specific to TFS? Unfortunately there is no TFS tag available and I cant create but I'd like to hear from someone who maintains instance day by day Commented Oct 28, 2015 at 9:51
-
@user813948: I don't make the assumption that the environment is safe. I only say that to have a protection comparable to TLS you have to make sure that your LAN provides the protection against man-in-the-middle and sniffing in some other way. TLS will not protect you against somebody hacking or stealing the system either (or whatever your vision is what the nightly visitor does). And actually it is not a question of TFS, it is simple the question if the security provided by TLS can be provided without TLS in a LAN. Commented Oct 28, 2015 at 11:02
Short answer, Yes that is possible.
Long answer, This is also possible without HTTP, (like with HTTPS) but when your TFS-server is running on a machine that can only contact the internal network.
And the network is secured as @steffen-ullrich suggest. Than only the determined attacker can impersonate another.
The thing you have to ask yourself is "when is there enough protection for me", or "When are the risks of a compromise low enough so I can live with it."
Often they wat companies protect themselves against these type of threats is to employ IDS and other network monitoring techniques. That way they known when someone is trying to fool the system and can take action when it happens.
-
I think your long answer is a bit confused. I dont really understand how is it possible with HTTPS Commented Oct 27, 2015 at 15:45
-
You are talking about impersonating not session stealing. HTTPS does not protect you against that.– LvBCommented Oct 27, 2015 at 16:45
-
So can you make an example where you impersonate without stealing a session on HTTP and HTTPS? Commented Oct 28, 2015 at 9:44
-
To do that i have to make a few assumptions: I assume you have not securen your LDAP (Ad) with TLS. I therefore can obtain my intend targets identifiers. Which I can use on the intended target, the Ty's server.– LvBCommented Oct 28, 2015 at 11:28
-
It's all about attack vectors and the weakest point in the security system.– LvBCommented Oct 28, 2015 at 11:32