0

So here's the deal, I could never login on my desktop to skype for business. Since I am an microsoft 365 admin, I issued a ticket and waited for someone to call me to help me login. He remotely logged in to my computer was able to view my screen. After about thirty minutes of changing different settings on the admin page and clearing the Lync cache, I was instructed to download skype for business basic on my computer through the 'install apps' portal on office 365 admin portal. I already had office 365 installed and skype installed through my school account, so when testing I was simplying logging out and logging back in. After the install of skype for basic was complete (for my account I could not log into) I tried logging in and nothing. We tried troubleshooting and nothing. Finally I suggested that I try on my mobile device, and I got an interesting pop up message after being able to successfully login (note we had tried on desktop about 8 times and I reset my password). Here is the message I received: enter image description here I knew that something was wrong with this certificate so I emailed to my self from my phone and showed him on my screen. He then told me that this is nothing like he has seen before and since this certificate was not issued by godaddy or microsoft he couldn't do anything about it. He then told me to hit the continue button and try to login. After doing so I was finally able to login successfully on my mobile phone and on my desktop. I still felt like I messed up big time by accepting a Fake certificate. After the call was finished I ran a couple scans, both on my desktop and on my phone and something came up.

C:\Users\Downloads\setupskypeforbusinessentryretail.x64.en-us_.exe ... is Suspicious !!!

Apparently McAfee GetSusp found it as a Boot Sector Virus. I then checked the time stamp of when I downloaded and it was during the call, the same time he told me download skype for business basic. I also ran another scan and this came up under a MBR scan: enter image description here Here are the VirusTotal results:

MD5 676846aea84c661c7bc62d8bdac7eb29
SHA-1   fbe8bef191dc31c73e4a5a50ba42f3b0d4e01dc3
SHA-256 7f60396d152b58215d2f677656f0ef0887f9fa6645c34d503c5f0efd18d84e55
Authentihash    ac082088fcead28338527fb6c961c78445c6ef14dd9c08793a6f30fe51af7f7a
Imphash 2e6b765f5c8cfe7892bc03c3c50ab319
File Type   Win32 EXE
Magic   PE32+ executable for MS Windows (GUI) Mono/.Net assembly
SSDeep  49152:ZVa6fmdbtYpIJBDV8/hSvTOHPjb44K8brLgLF3Q9QCa1BLk2Hyus5+iIe2tk9QMz:S0kSfyF87t+7PMr2FwY2sM
TRiD    Win64 Executable (generic) (87.3%)
Generic Win/DOS Executable (6.3%)
DOS Executable Generic (6.3%)
File Size   6.85 MB

File Names:
setupskypeforbusinessentryretail.x64.en-us_.exe
Bootstrapper.exe

So did Microsoft give me a MBR Virus or did I fall for a man in the middle attack on my mobile?

  • Would you mind uploading the .exe file to VirusTotal and adding its scan hash to the question? – LSerni Jan 5 '18 at 23:58
  • @LSerni Just uploaded it – Jghorton14 Jan 6 '18 at 0:04
  • 1
    The version available online appears to be legit. But the binary was downloaded on your PC (C:\Downloads), not on your mobile. I'm quite stumped - apparently two different things happened on the devices. Were they linked to the same access point or router, by any chance? – LSerni Jan 6 '18 at 0:06
  • Your version also seems to be legit (virustotal.com/#/file/… ). So that's a McAfee false positive. The mobile popup is surely strange, and yet... would a faker issue a "Fake" certificate? Wouldn't they go for, say, "Microsft" or "Microsoft *0*ffice"? – LSerni Jan 6 '18 at 0:13
  • 1
    Are you doing this on your school network? I'd guess that maybe it's only trying to filter/inspect some traffic and Skype is on there. – Sirens Jan 6 '18 at 5:18
1

The screenshot you presented is, without doubt (okay: excluding a prank app installed by an evil room-mate), a classic sign of a Man-in-the-Middle attack.

Despite the name, it's not necessarily hostile activity, or even bad. Some antiviruses have to routinely MitM their clients to be able to scan HTTPS flow (as well as decoding MIME attachments and expanding ZIP files; but those activities usually go unnoticed). You definitely want to be "MitM'ed" by your antivirus!

Several proxies, firewalls, load balancers and security apps do the same, to their networks' benefit rather than for your sake. That's still not hostile activity.

So - what really happened to you, this time?

The warning

On the "hostile" side of the question we have the fact that we don't know who is it that is unpacking/repacking the flow. Normally, you should be aware of protections that you own, or otherwise avail yourself of. They should go at reasonable lengths to make themselves known to you and reduce the chances of a mistake or misrepresentation (e.g. through error messages and popups exactly like the one you saw). This did not happen.

On the "friendly" side, there is the fact - not that it's good news - that the operation was sloppy in the extreme, writing "FAKE" in SSL fields and using a certificate that's been out of date for two years. It's almost as if the 'attacker' wanted to be detected. This scenario is common in poorly or carelessly maintained softwares (I could name a ministry where they replaced the certificates with last year's archived ones, so that until last Friday a certain website was expired on January 2nd, 2017 instead of expiring on January 2nd, 2019; the fact that this happened to you near the turn of the year might be relevant - or not), but also in hardware.

It is also conceivable (and too frequently seen) in hacked access points and routers, where sites such as windowsupdate.com, apple.com or antivirus sites or identity-querying sites (GMail, etc.) can be redirected to personal-data-grabbing or Trojan-supplying sites. You think you're updating your video card, instead you're installing a ransomware or a zombie kit. Your credit card details do not go just where you think they're going. This is done by breaking into vulnerable hardware through external access or cross-site scripting attacks (think <img src="http://192.168.0.1/admin/set-password?pwd=evil&pwd2=evil" style="display: none" /><img src="http://evil.site.com/ping" style="display: none" /> inside an advert banner: evil.site.com will then try to access your IP after a few seconds and see whether it succeeds. If it does, they pwn your ass).

But if this had happened, the broken-into appliance would stay broken into; what happened once would keep happening (and they wouldn't have been so sloppy).

This would be plausible if you'd unpacked an old router from the basement storage and plugged it in, complete with the hack you hadn't noticed when you thought the router had just given up the ghost two years ago.

The file

The binary file could have been deemed suspicious, but the VirusTotal upload was legit (i.e., you haven't uploaded it to a fake VT site pretending that the file was clean when it wasn't), the file is digitally signed and the sign checks out, so we can dismiss this data point as "McAfee false positive".

My current conclusions

We're left with what looks to me as a very low suspicion situation; I'd face it with heightened awareness and being more careful than normal for a few days, to see whether other strange things happen.

(Keep in mind that little strange things happen all the time, so it's important not to see the hand of Dr. Evil behind every network lag or broken image).

I don't think that the situation warrants replacing the firmware or the motherboard or similar extreme resorts.

BadBIOS

You may have found out that the "BadBIOS scare" is now thought by several researchers[who?] to have likely been little more than a series of coincidences - or, who knows, maybe even pranks, or attempts to get him to discredit himself - over which Ruiu, the only researcher to have been "hit" by BadBIOS, built an edifice of suspicions.

(If you think this has never happened to reputable researchers or even scientists, think again. I do not feel this event reflects badly on Ruiu at all).

So... with this new "definition" of BadBIOS - "something that makes you suspect that your BIOS has gone bad on you" - yes, you were hit by BadBIOS :-)

Not the answer you're looking for? Browse other questions tagged or ask your own question.