When deploying Skype for Business services on mobile devices, laptops, or any other mobile devices outside the corporate network, special attention should be paid to authentication services and how the Skype for Business service is published on the Internet.
By default, both the Skype Online cloud service and the Skype for Business solution accessed from the company's own data center have no additional safeguards against multiple, erroneous end-user logins. Too much visibility into these services increases the risk of Active Directory (AD) accounts being locked out. An attacker often knows the naming structure of user accounts or can guess them easily (e.g. Jan.Kowalski@firma.pl, JKowalski@firma.pl. etc.). If he or she uses these credentials to mistakenly log in, security policies can block the account, and a user who correctly logs in to the network and services will not be able to access any services, even internal services that require access from a corporate account.
For proper protection, all possible authentication channels should be secured and monitored in parallel:
- Skype for Business login details from a desktop or mobile device
- Login data in Web applications
- Data used to call out to remote services such as online meeting or webinars
- Any NTLM/Basic or SOAP service login sent via HTTP to Skype for Business master server
- NTLM authentication requests sent via SIP protocol to edge server
- Exchange Web Service (EWS)
If a company has different security policies for SIP and mobile HTTP, an attacker can send authentication attempts through separate channels and exceed the specified login limit. In this case, the attacker may cause the targeted account to be blocked.
Example:
If a network security policy blocks an account after five login attempts, an attacker can send three login attempts through a cell phone that has Skype service, and another three to a SIP edge server. Both of these actions can block a given network account without reaching the limit on each channel.
Most proxy solutions offered on the market, can't quite cope with SOAP and SIP service authentication, as their structure is mainly dedicated to the Skype service.
The most effective way to prevent such attacks is to have a unified solution to protect distributed resources.
SkypeShield offers protection for both a single site and multiple sites against DDoS attacks. All AD authentication attempts from the channels listed above are monitored by SkypeShield. Failed attempts are counted and stored in a central database table that is shared by all SkypeShield components.
SkypeShield monitors Active Directory login authentication attempts for all Microsoft Skype for Business services. SkypeShield counts unsuccessful login attempts, and when a defined limit is reached, it blocks further login attempts to AD servers. Such "soft blocking" prevents AD accounts from being blocked altogether.
You can check the vulnerability using this free tool ..
If you are interested in this type of solution, please write to us.