if TFS is installed using HTTP but only accessible from inside a LAN with Windows authentication, is it possible that a user impersonate someone else? what are other risks?


It depends on how secure your LAN is. If you have full protections against man-in-the-middle attacks (e.g. protection against ARP, DNS or DHCP spoofing), against passive network-wide sniffing (mirror port switch) and also sniffing on local machine then it might be sufficient, i.e. at least not less secure then with HTTPS. If not impersonation might be possible.

  • I was digging a bit more and maybe the right question is how to impersonate another user over HTTP in a web site that uses Windows Authentication. TFS website is nothing more than a web application that uses Windows authentication and cookies between requests. You sniff someone else cookies and you impersonate them easily. Oct 27 '15 at 15:50
  • @user813948: that's what I said: if your LAN is safe against sniffing and man-in-the-middle attacks then you are probably safe. Oct 27 '15 at 16:24
  • You implied that I want to be safe and make the assumption that the environment is safe too. What if someone overnight enters the building? So risks are the same for a website and I've got that but what are (if any) specific to TFS? Unfortunately there is no TFS tag available and I cant create but I'd like to hear from someone who maintains instance day by day Oct 28 '15 at 9:51
  • @user813948: I don't make the assumption that the environment is safe. I only say that to have a protection comparable to TLS you have to make sure that your LAN provides the protection against man-in-the-middle and sniffing in some other way. TLS will not protect you against somebody hacking or stealing the system either (or whatever your vision is what the nightly visitor does). And actually it is not a question of TFS, it is simple the question if the security provided by TLS can be provided without TLS in a LAN. Oct 28 '15 at 11:02

Short answer, Yes that is possible.

Long answer, This is also possible without HTTP, (like with HTTPS) but when your TFS-server is running on a machine that can only contact the internal network.

And the network is secured as @steffen-ullrich suggest. Than only the determined attacker can impersonate another.

The thing you have to ask yourself is "when is there enough protection for me", or "When are the risks of a compromise low enough so I can live with it."

Often they wat companies protect themselves against these type of threats is to employ IDS and other network monitoring techniques. That way they known when someone is trying to fool the system and can take action when it happens.

  • I think your long answer is a bit confused. I dont really understand how is it possible with HTTPS Oct 27 '15 at 15:45
  • You are talking about impersonating not session stealing. HTTPS does not protect you against that.
    – LvB
    Oct 27 '15 at 16:45
  • So can you make an example where you impersonate without stealing a session on HTTP and HTTPS? Oct 28 '15 at 9:44
  • To do that i have to make a few assumptions: I assume you have not securen your LDAP (Ad) with TLS. I therefore can obtain my intend targets identifiers. Which I can use on the intended target, the Ty's server.
    – LvB
    Oct 28 '15 at 11:28
  • It's all about attack vectors and the weakest point in the security system.
    – LvB
    Oct 28 '15 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.