Database Users

New Active Sync Security Vulnerability

Airscanner Mobile Security Advisory: Remote Password Compromise of Microsoft Active Sync 3.7.1
Product:
Microsoft Active Sync 3.7.1
Platform:
Tested on Windows XP Professional SP-2 and Windows Mobile Pocket PC 2003
Requirements:
Windows XP Professional with Active Sync 3.7.1
Credits:
Seth Fogie
Airscanner Mobile Security
www.airscanner.com
July 22, 2005
Risk Level:
Low for denial of service attacks. Medium for password collection attack.
Summary:
”Active Sync” is Microsoft’s default connectivity program that keeps a desktop PC and a handheld Pocket PC synchronized. It also includes various other features, such as debugging ability, file transfer, etc.
Details:
When a Pocket PC device attempts to sync to a PC, it will send three initial packets to the Active Sync program on port 5679. The following outlines the contents of the packets:
packet1[] = "\x00\x00\x00\x00";
packet2[] = "\x98\x00\x00\x00"; //SIZE OF NEXT PACKET
packet3[] =
"\x28\x00\x00\x00"
"\x04\x15\x40\x04"
"\x11\x0a\x00\x00" //2577 (AUTORUN?)
"\x05\x00\x00\x00"
"\x59\x29\x6d\x46" //EQUIP ID
"\x00\x00\x00\x00"
"\x28\x00\x00\x00" //LINK TO POCKET_PC1 TEXT
"\x3e\x00\x00\x00" //LINK TO POCKETPC TEXT
"\x5c\x00\x00\x00" //LINK TO SSKD TEXT
"\x78\x00\x00\x00" //LINK TO AXIM X50 TEXT
"\x50\x00\x6f\x00" //TEXT IN UNICODE
"\x63\x00\x6b\x00\x65\x00\x74\x00\x5f\x00\x50\x00\x43\x00\x31\x00\x00\x00\x50\x00"
"\x6f\x00\x63\x00\x6b\x00\x65\x00\x74\x00\x50\x00\x43\x00\x00\x00"
"\x53\x00\x53\x00\x44\x00\x4b\x00\x00\x00\x00\x00\x44\x00\x65\x00"
"\x6c\x00\x6c\x00\x20\x00\x41\x00\x78\x00\x69\x00\x6d\x00\x20\x00"
"\x58\x00\x35\x00\x30\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00"
"\x04\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00";
If the equipment ID value is valid, the PC will respond with a x12345678. If the equipment ID is not correct, the response will be x03. With this static response, it is trivial to brute force the valid equipment ID value. The reason this is important is because if you change the value in packet1 to x00000001 to the correct corresponding PID, a prompt will appear on the PC asking for a PIN value (figure 1). If a target enters a password, the information will be passed back to the remote, requesting client. If a value other than x01 is sent, that value will be XORed with the response to pseudo-'encrypt' the password. This method of information gathering is possible from over a network and does work over the Internet. From a quick nmap scan, we found about roughly 10 computers with this port open per 50 class C subnets.
Figure 1: Active Sync Password Dialog
Finally, we discovered that if numerous attempts were made to initialize with a PC running Active Sync, after about four attempts the Active Sync process freezes. In addition, if a user attempts to sync while a brute force equipment ID attempt is underway, the sync will usually fail.
Workaround:
Block Internet and LAN access to port 5679 using a firewall until this issue is patched.
Vendor Response
Waiting response.

Activesync Support Code : 80072efd Easy Fix

First Post. And just wanted to help
I finally found the solution to an ongoing issue on my machine
"The server could not be reached. This can be caused by temporary network conditions. Support Code:80072efd"
I have a t-mobile mda with K-AM_WWE_216901_2169101_020710_ship rom installed and a windows xp sp 2 machine; I also have an exchange server sp2. I have been testing this phone big-time to rollout for numerous clients.
The problem came in after I had push mail working and went to sync locally over USB or Bluetooth. Active sync 4.1 would give me the error.
The solution was as follows for me
My mx record points to mail.domain.com but my server name is server.domain.com so I entered an "A" record in dns on my dns server named mail to point at the local ip address.
All was solved
I also ran into a problem on push mail early on where it would sync once and then not again, the issue was as easy in the default web page I turned on "enable keep alives" and changed the timeout to 1800 seconds.
I hope this helps.

ActiveSync version 4.2 made a change to how it interacts with the Windows networking stack to use Layered Service Providers (LSPs) on outgoing Desktop-Pass-Through connections. This allows for improved compatibility & policy compliance in environments where connections to the internet must be passed through these LSPs (ISA Proxy is one such example).
Unfortunately, it appears this change has caused some issues for a small segment of users who have LSPs that interfere with ActiveSync communication.
There is a registry key which can be created to essentially remove this change & revert to ActiveSync 4.1 behaviour. This key is:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows CE Services]
"AllowLSP"=dword:0
This posting is provided "AS IS" with no warranties, and confers no rights.
Original post: http://blogs.msdn.com/jasonlan/archive/2006/07/07/659348.aspx

Thanks win_user
win_user's post was instant fix. Been looking for this for a while. Thanks

i have still the same problem. do i have to create the REG_WORD Key as binary, decimal or hexadecimal?

To create it is necessary key DWORD - in both systems of calculation equally "0"

Thanks to win_user--solved the problem perfectly.

http://www.pocketpcfaq.com/faqs/activesync/exchange_errors.php

Recognising Wifi on WM5

Hello,
I've developed an application on WM4 that associates with 802.11 access-points and also establishes GPRS connections. Connections created with my app work just fine on PocketPC 2002 (WM4). When I ported to PocketPC 2005 (WM5) the application still creates the 802.11 and GPRS connections without error but the device will not recognise the 802.11 connection and always wants to create a connection using GPRS when I open IE or attempt any other IP connection. The only way around this that I've found is to put the phone into flight mode, but since my software is supposed to run on phones, that is not an option since users probably want to recieve calls while they browse. I've seen threads related to this on user forums but so far the only solution I've seen is to disable the phone.
Everything works just fine when WZC creates the 802.11 connection which leads me to believe that there's some IOCTL out there that tells the device to use the 802.11 connection.
Does anyone know the true magic to get around this?

litewoheat said:
Hello,
I've developed an application on WM4 that associates with 802.11 access-points and also establishes GPRS connections. Connections created with my app work just fine on PocketPC 2002 (WM4). When I ported to PocketPC 2005 (WM5) the application still creates the 802.11 and GPRS connections without error but the device will not recognise the 802.11 connection and always wants to create a connection using GPRS when I open IE or attempt any other IP connection. The only way around this that I've found is to put the phone into flight mode, but since my software is supposed to run on phones, that is not an option since users probably want to recieve calls while they browse. I've seen threads related to this on user forums but so far the only solution I've seen is to disable the phone.
Everything works just fine when WZC creates the 802.11 connection which leads me to believe that there's some IOCTL out there that tells the device to use the 802.11 connection.
Does anyone know the true magic to get around this?
Click to expand...
Click to collapse
Have you disable WZC ? If you disable the WZC of device, the Connection Manager can not detect the WiFi card and it use GPRS connection. IE use the service of Connection Manager for detect if a device is connected or no to internet.

WZC
WZC is disabled. With it enabled I cannot control the 802.11 device with NDISUIO.

litewoheat said:
WZC is disabled. With it enabled I cannot control the 802.11 device with NDISUIO.
Click to expand...
Click to collapse
Yes and no.
You can query and set OID value of 802.11 also if NDISUIO is locked by WZC.
IOCTL_NDISUIO_QUERY_OID_VALUE accept NDISUIO_QUERY_OID struct that in WinCE is present the ptcDeviceName variable. Set it with name of device and you can query OID value also if NDISUIO is locket by WZC.
You can select the access point with WZC and prefered network. The functions is WZCQueryInterface and WZCSetInterface.
Ciao Massimo

Really can't use WZC
Thanks for the informative reply. We'd like to turn WZC off for other reasons, mainly the notifications it displays when a new access point is in range. In places where there's metro wifi or just a large concentration of wifi access the notifications are extreeeeemly annoying when they constantly pop up(thanks Microsoft).
Is there a way to disable Connection Manager entirely so that it doesn't get in the way?

litewoheat said:
Thanks for the informative reply. We'd like to turn WZC off for other reasons, mainly the notifications it displays when a new access point is in range. In places where there's metro wifi or just a large concentration of wifi access the notifications are extreeeeemly annoying when they constantly pop up(thanks Microsoft).
Is there a way to disable Connection Manager entirely so that it doesn't get in the way?
Click to expand...
Click to collapse
For notification,you can simply disable from panel control->sound & notification.
For disable Connecion Manager, you must kill the process connmgr.exe with a task manager. Without connecion manager, the wifi remains enabled also you syncronize the device with activesync. The collateral effect is that IE don't work. The Connection Manager is a wrapper between applications and socket. Without CM, the applications can not establish a connection also is the device is effectively connected to network.
You can also disable WZC with DeactivateDevice API.
if I can give a suggestion to you, don't disable WZC or Connection Manager... the negative effect is more of positive effect. Try to use my prev solution.
I am developing a advanced manager of wireless with thie solution posted and work very well. I can select a my prefered AP, retrive RSSI and search SSID without disable WZC a CM.
Ciao Massimo

I'll give it a try, but...
OK, I think you've convinced me. Can I programatically disable the notifications? I can't really expect our users to do that.

litewoheat said:
OK, I think you've convinced me. Can I programatically disable the notifications? I can't really expect our users to do that.
Click to expand...
Click to collapse
For disable notifications edit the registry:
HKCU\ControlPanel\Notifications\{DDBD3B44-80B0-4b24-9DC4-839FEA6E559E}
and set
Options = 0
Ciao Massimo

How to link in wzcsapi.lib?
So I guess I'm not smart enough to figure out how to link in the library wzcsapi.lib. I'm using VS2005. I have Platform Builder so I do indeed have the correct files. I don't get a cannot file file linker error but I do get linker errors for every WZC function in my app. I tried the wzctool sample with the same outcome.
From what I can tell the wzcsapi.lib does have the exports I need but I just can't get VS2005 to link.
Is there some magic to use the WZC functions?

If you use Platform Builder, add into your catalog platform "Wireless LAN (802.11) STA - Automatic Configuration and 802.1x". After sysgen, you found wzcsapi.lib into $(_PROJECTROOT)\cesysgen\oak\lib\$(_CPUINDPATH)\ folder.

No using PB
I'm not using Platform Builder. I'm using VC2005.

Is there a solution for this issue

Using a dll without the correct lib file.
First my guess at the problem, and then a couple of questions.
Library files are compiler specific. The one you're using is for Platform Builder. Platform Builder's compiler probably differs from the one in VS2005.
Another way to use wzcsapi.dll is to link to it at run time using LoadLibrary and GetProcAddress like so
Code:
INTFS_KEY_TABLE GuidTable;
PINTFS_KEY_TABLE pGuidTable;
pGuidTable = &GuidTable;
HMODULE hMod = LoadLibrary (_T("wzcsapi.dll"));
if (hMod==NULL) {
_stprintf(buff, , ErrorCode);
MessageBox(NULL, _T("Failed to load wzcsapi.dll"), _T("ERROR"), MB_OK);
return;
}
_WZCEnumInterfaces pfnWZCEnumInterfaces = (_WZCEnumInterfaces) GetProcAddress (hMod, _T("WZCEnumInterfaces"));
if (pfnWZCEnumInterfaces == NULL) {
MessageBox(NULL, _T("Failed find function"), _T("ERROR"), MB_OK);
return;
}
DWORD ErrorCode = pfnWZCEnumInterfaces(NULL, pGuidTable);
if (ErrorCode!= ERROR_SUCCESS )
{
ErrorCode=GetLastError();
_stprintf(buff, _T("WZCEnumInterfaces Failed--error code %d"), ErrorCode);
MessageBox(NULL, buff, _T("ERROR"), MB_OK);
return;
}
Now for the question part .
How does a miniport driver originally tell the connection manager to consider using the miniport when making and IP connection?
Also, I'd like to be able to request 802.11 scans and set OID_802_11_BSSID to force association with a particular access point. Is this best done using CreateFile/DeviceIoControl or using the WZC funtions? I'll guess using DeviceIoControl, since it doesn't look possible using WZC functions? Can I do this with connection manager running? Anyone have sample code for getting/setting one of the OID_802_11 oid's?
Thanks,
SetoK
Thanks
SetoK

Windows mobile Web Service

Hi, i'm doing a app for windows mobile and i want to connect to a web service, anyone knows how?
Thanks

Use a WebRequest to read the results.
replace ##### with the web address of the service and any parameters it wants e.g.
"http://www.webserver.com/webservice?parma=A&parmb=B"
Then use the Read() method of the stream to get the results. Remember that you can only read 8192 bytes of the stream over the net at one go. You will have to read consecutive blocks of data if the response is longer than that.
e.g.
Code:
using System.IO;
using System.Net;
Byte[] Buffer = new Byte[8192];
int ByteCount;
Stream ResponseStream = WebRequest.Create("########").GetResponse().GetResponseStream();
while ((ByteCount = ResponseStream.Read(Buffer, 0, 8192)) > 0)
{
// Do something with what's in the buffer.
}
ResponseStream.Close();
If the webservice returns XML use an XMLTextReader on the url instead
Code:
XmlTextReader xtr = new XmlTextReader(""http://www.webserver.com/webservice?parma=A&parmb=B");
Then use the Read() method to read the response a line at a time. The Name or Value properties of the class will hold the return values, depends on how the XML has been returned.

I'm doing like this, but its not connecting
connecting.StreamWS ws = new connect.connecting.StreamWS();
ws.Url = "http://192.168.56.106:9090"; //url do serviço
string strOut = ws.HelloWorld();
//textBoxResultado.Text = strOut;
MessageBox.Show(strOut);

What happens if you enter "http://192.168.56.106:9090" in the url of Internet Explorer on your Pocket PC?

nothing happens.
The network connection needs to be active?

192.xxx.xxx.xxx is part of your own network, not the web.
What is the webservice you wish to call? Where is it defined?

The webService is running on IIS. I can access it by pc browser or by a forms win app, but not by the windows mobile emulator. The application is deployed to the emulator via visual studio.

You have to configure the emulator to use your network.
From the emulator window itself, click on File -> Configure and click the network Tab. Check 'Host-only networking' and try that. If not, try adding 'Enable NE2000 adapter' and bind it to your network card.

It didn't work, i'm still getting the same error
"Could not establish connection to network."
I think the code is right
private void buttonResultado_Click(object sender, EventArgs e)
{
//Properties.Settings.Default["StreamWSTestClient_StreamingWS_Service1"] = "http://localhost:9090/";
//WindowMobileService service = new WindowMobileService();
//service = "
connecting.StreamWS ws = new connecting.StreamWS();
ws.Url = "http://mlourenco-pc:9090"; //url do serviço
string strOut = ws.HelloWorld();
//textBoxResultado.Text = strOut;
MessageBox.Show(strOut);
//textBoxResultado.Text = ws.Soma(Convert.ToInt32(textBox1.Text), Convert.ToInt32(textBox2.Text)).ToString();
}

Until you can get Internet Explorer on the emulator to display the IIS site you are wasting your time with any code at all.
Emupronet is the set up screen for the emulator.
NE2000 is the setup screen for the NE2000 adapter.
Localhost is the default under construction screen served by IIS from a default untouched website. The IP address is of the Host PC running IIS.
If the emulator's IE can't display a basic webpage served from your PC, webservices won't work either.
If your internet connection is served through a proxy, your PPC has to match, also you will have to set up the proxy details in code before it will work.

I can access internet but no IIS

Somewhat at a loss as to why it won't work. Works a treat on mine as can be seen in the post above.
Last resort, see if the emulator will work in a 'cradled' state.
From Device Emulator Manager, right click on the active emulation and select 'Cradle'. It should be preceded by a network cable icon.
You will need ActiveSync installed on the PC to be able to virtually 'cradle' it.

I already did it men, it was the f..... firewall
Thanks a lot for your help.
Now the next step is receiving a feed list and call wmp to play it, but not in web client.
Thanks

That explains it! In hindsight I should have spotted the fact you were using a different port number.
HTML goes through port :80 which is normally wide open. Non-standard port numbers are usually blocked by your firewall by default unless specifically defined.
Good luck!

Anyone using OpenVPN with CM7?

I was wondering if anyone was using OpenVPN with CM7 here, and if so -- are you able to successfully use the extra arguments area to set --tls-auth arguments?
I have my key for TLS auth stored in a folder called openvpn on my SD card...
I am using:
--tls-auth /mnt/sdcard/openvpn/static.key 1
in the additional arguments section.. Ive done MD5 compares between the server static.key and whats on the phone, and they are identical.. The server is OpenVPN running on TomatoUSB, and "Extra HMAC Authorization" on the server is set to "Incoming (0)"
The configuration works fine with my laptop, but on my phone it does not seem to be picking up the option... The server log shows it attempting and throwing the error "TLS Error: cannot locate HMAC in incoming packet"
If I turn Extra HMAC Authorization off on the server, I connect fine.. The reason I am wondering if the argument is even being picked up is because if I leave it in there, and disable tls-auth on the server, it connects without complaint. From what I understand, both the server and client need to have the option set or unset, otherwise a connection cannot be negotiated.
Anyone else?
Thanks,
Rick