Fixing Birthday attacks against Transport Layer Security (TLS) ciphers with Intune

Share to your social

What is the Sweet32 Birthday Attacks against TLS ciphers Vulnerability and how do I fix it with intune?

The Birthday Attacks against Transport Layer Security (TLS) Ciphers vulnerability is a common one I find when conducting Cyber Essentials Plus Audits, it often stumps people on how to fix it, so I’ve put this guide together to explain why and show how easy it is to fix.

Whilst this talks about using Intune, in practice you could use the PowerShell script in part B below and either run it manually or use your favourite tool to deploy it.

What is the Birthday attacks against Transport Layer Security (TLS) ciphers with 64bit block size Vulnerability (Sweet32) Vulnerability?

[Qulays QID:378985]
 
This vulnerability is related to weak TLS Ciphers, it means it is possible for attacks to obtain the clear text data that is supposedly encrypted with one of those weak Ciphers.
 
 

WARNING!

Use at your own risk!

This is how I have fixed the issue on my own devices, there may be a better way to fix this for your own environment.

This is designed for Competent IT People to use as a reference and NOT for an IT novice to blindly follow!

Please Test before you use it in anger!

So, the actual fix is to disable the weak ciphers using a power shell command. ‘Disable-TLSCipher -Name <NAME>’ Reading the articles below also suggests you can use SchUseStrongCrypto in a registry key, but I could not find a specific powershell command to apply that. I would rather use a command to enable/disable a feature rather than edit the registry directly, hence why I chose this route.

https://learn.microsoft.com/en-gb/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v22h2

https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-server

https://learn.microsoft.com/en-us/answers/questions/486172/birthday-attacks-against-tls-ciphers-with-64bit-(s

https://learn.microsoft.com/en-us/answers/questions/1351265/how-do-i-fix-cve-2016-2183

PART 1a: Check if we have any Vulnerable Ciphers

First off, you can verify if you do have any vulnerable ciphers by simply using the following command in Power Shell on the machine you’re testing

Get-TLSCiper <Name>

The Three Ciphers to Check for are:

  • DES (also checks for 3DES)
  • IDEA
  • RC
In the image below you’ll see I ran Get-TLSCipher DES and it returned the 3DES Cipher – which is one we need to get rid of…

PART 1b: Deploy the Fix Script via Intune

So rather than logon to each machine and disable the cipher, we can use Intune to deploy a powershell script which will do that for us 🙂
  1. Grab a copy of the PowerShell Script I’ve created below (note, I’m not a PowerShell expert, but this one is fairly basic! – plus I copied it from one of the articles referenced above!!)
  2. Navigate to Microsoft Endpoint Manager > Devices > Scripts (https://endpoint.microsoft.com/?ref=AdminCenter#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/powershell)
  3. Click ‘Platform Scripts’
  4. Click Add > Windows 10 OS
  5. Give the Script a Name “Disable Weak Ciphers (Sweet32 Birthday Attack)” > Click Next
  6. Select the Location of the PowerShell script you’ve downloaded or Created > Click Next
  7. Assign it to a Test Group (or All Devices if you’ve already tested it!) > Click Next
  8. Click ‘Create’ on Review & Create

Now wait a little while for it to start to push out (it can take some time, I wrote this article whilst waiting for it! Still wasnt done, so I rebooted… now it’s done!)

Once Done you can check on one of your test machines it’s worked by running the power shell command ‘Get-TLSCipher -Name DES’ You should not get any results if it’s successful… – It’s also worth checking in Endpoint Manager > Devices > Scripts  > Disable Weak Ciphers > Overview to check it’s deployed OK.

PART 2b: The PowerShell Script

I figured it was safer for you to copy and past in to a new PowerShell file, rather than download a file from my website. So here’ s the file in full, please read and understand it 🙂

## PowerShell Script to address Weak TLS Ciphers (Birthday Attack against TLS Ciphers)
# Copied from reply by Karol Kula on post: https://learn.microsoft.com/en-us/answers/questions/486172/birthday-attacks-against-tls-ciphers-with-64bit-(s
# This Script put together by Chris Blunt - Blunt Security July 2024
# Use at your own risk!
## 
## Please See the following Blog Post for further info about how to use this in Intune
## https://bluntsecurity-uk.jwhoststaging.co.uk/msp-articles/fixing-win-verify-trust-with-intune/
#
## The following MS Articles & Forums has been used as reference material
## https://learn.microsoft.com/en-gb/windows/win32/secauthn/tls-cipher-suites-in-windows-10-v22h2
## https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-server
## https://learn.microsoft.com/en-us/answers/questions/1351265/how-do-i-fix-cve-2016-2183
## https://learn.microsoft.com/en-us/answers/questions/486172/birthday-attacks-against-tls-ciphers-with-64bit-(son 
#

$WeakCipherSuites = @(
    "DES",
    "IDEA",
    "RC"
)

Foreach($WeakCipherSuite in $WeakCipherSuites){
    $CipherSuites = Get-TlsCipherSuite -Name $WeakCipherSuite

if($CipherSuites){
        Foreach($CipherSuite in $CipherSuites){
            Disable-TlsCipherSuite -Name $($CipherSuite.Name)
        }
    }
}

Need help with Cyber Essentials?

If you want some straight talking help with Cyber Essentials or a wider Cyber Security matter Book a discovery call with me today. 

BOOK A DISCOVERY CALL

Cyber Essentials provides an easy reference point for all Organisations no matter how small to meet a basic Cyber Security standard

Cyber Essentials is designed to be easy and cost effective for Small organisations to achieve, in fact often it’s the larger organisations which struggle more as they have more complex systems which need additional work to meet the minimum requirements set out by the UK Government. The framework and question set is available free to any organisation so there is a very low barrier to entry, you just need to spend a little bit of time reading about it!

Recent Posts