TeamSpeak 3 Security Awareness

[Asphyxia]

Tutorial for running your TeamSpeak 3 client virtually:

Any questions? Comment on the video or reply to this thread!

Hello to our lovely community!

Since October is the perfect time to publish security awareness information (October is National Cyber Security Awareness Month which is an annual campaign to raise awareness about the importance of cybersecurity).

I figured I would take a moment to provide security ideas for using TeamSpeak 3 safely with reasoning on why you should.

Spoiler: Is TeamSpeak 3 Safe?

No, TeamSpeak 3 has been developed with several critical security issues scattered throughout. Additionally, the software is proprietary and utilizes the Qt framework. If you open TS3, click Help -> About -> Qt Version: 5.6.2 at current time.

Because the Qt framework is inherently insecure by making production fast and cross-platform (security and speed can come together but only if done properly and this places almost all responsibility on secure development to the developers of TeamSpeak 3 which is a team of a few guys, as far as I know (I may be wrong) not a single security engineer nor employee), there is no way to safely run Qt applications which are proprietary on a host machine. This means if you run TeamSpeak 3 in the same environment you use LastPass, access bank accounts, check your emails, and various other confidential actions --- you are unsafe every time you connect to a TeamSpeak 3 server publicly facing the Internet.

To give you some insight as to how slow-moving the Qt framework is regarding security, HSTS was developed for enforcing HTTPS connections around the year 2012. The year is 2017 and HSTS support has just arrived to Qt developers as shown here: https://en.wikipedia.org/wiki/Qt_version_history 5.9 and TS3 is still on 5.6. You can see Mozilla's support for it back in 2012: https://support.mozilla.org/en-US/questions/942924

Why the fuck are you still running TeamSpeak 3 outside of virtualization? There is no reason to take this unnecessary risk. This is like putting your dick in a homeless person's bum; no protection.

In the very end of all this, there are two people responsible for the security of TeamSpeak 3. That is yourself and TeamSpeak 3 developers or the company itself. From the interview R4P3's security team had with TeamSpeak's two CEOs, we understand that security is not at the top of their list of things to do. Instead, the response to us was more about quieting our community and ultimately leading to a shutdown of our research on the security of TS3.

Your responsibility to securely run TeamSpeak 3: Install virtualization software such as VMware Workstation Pro ( https://my.vmware.com/web/vmware/info/slug/desktop_end_user_computing/vmware_workstation_pro/14_0 ). When installing an operating system to run TeamSpeak 3, consider something secure like Tails Linux or Kali Linux. This is assuming you will not have confidential information on the mentioned virtual machine OS. If you are just looking for a simple operating system, consider Ubuntu Desktop. Keep in mind that if someone breaks out of your TeamSpeak 3 instance, your real IP may be leaked even if you are running a VPN on the virtual machine. Ideally, the host machine where you are running the VM should have a secure VPN setup. Two common IP leaks on systems using a VPN are an IP leak by DNS and and WebRTC/STUN. Consider using a custom DNS with your VPN solution. I like NordVPN as a VPN provider. After your VPN is configured, think about going to Google and take a look at "IP Leak Test", check around if you want to test if your VPN is working to maximize privacy. While these steps are more for privacy, they are optional. Separating your TeamSpeak 3 instance from your main operating system is not optional from a security standpoint.

TeamSpeak's responsibility as the company (TeamSpeak Systems GmbH) and developers: Knock down your security shortcomings by going after cybersecurity talent, specifically someone experienced with application security. I realize there is a shortage of talent globally, but if you look in the right direction I promise you may be surprised how much safer your software may become by giving the right cybersecurity researchers a chance. You need a dedicated individual to inspect the life-cycle of your application's code. When a new feature is added that allows an input, is the input secure? When a connection is handled in your server software, will it crash if simply an integer is missing? Throughout all of your applications, what does error handling look like? Is garbage collection being implemented properly to keep memory usage appropriate? An application audit would keep your users much safer and give your developers an idea of where they can improve security practices which can make your current code safer and help your company and applications for the life of your hopefully successful future.

In R4P3's past, we COULD HAVE done very dark things such as launch one of the largest self-spreading worms across the TS3 network. This was at a time when there were around a million users and most run on the Windows operating system. Keep your users safe, keep yourself safe --- everyone. R4P3 is only here to help.

By the graceful teamwork of R4P3's research and TeamSpeak Systems GmbH's rapid response, one of their most critical security issues was patched. Security can not always be responsive though, a proactive approach is recommended. Much like waiting to have a heart attack is a bad idea, just eat some fucking fruit and salad --- drink water.

 

[Asphyxia]

Additional security recommendations:
Whether you are running on Windows or Linux, you should have some basic security checking solution(s). On Windows this could be Malwarebytes or at the DNS level consider OpenDNS.
If you are running a server (e.g. TeamSpeak 3 server) consider a Linux auditing tool such as Lynis. You may also be running a web server which Lynis will detect web server configuration issues.

Another common issue is TeamSpeak's server query feature uses Telnet for admin purposes, this exposes an admin session in clear text. This is probably the stupidest shit I have heard since "Are you okay?" after falling down the stairs and losing my head (maybe it was sewn back)?

The floor is open to more security thoughts and ideas for TeamSpeak 3, please join.

 

[Smoku]

exposes an admin session in clear text.

Where?

 

[Asphyxia]

Where?

I will show you soon, but all you have to know is Telnet is safe like bending over with your pants and underwear down.

TeamSpeak 3 "Server Query" is a tool which may be used for TeamSpeak 3 server admin purposes and uses Telnet. Don't believe me?

TS3 Server Query: http://forum.teamspeak.com/threads/91465-How-to-use-the-Server-Query
Telnet is overall outdated in terms of security, switch to SSH or something encrypted e.g. HTTPS (encrypted web api): https://interwork.com/qa-how-to-eliminate-the-security-risks-associated-with-telnet-ftp/

For the sake of security, I personally recommend disabling the TeamSpeak 3 server query. Many ways to do this, a simple one is to just shutdown port 10011 which is the default port used for server query.

 

[Shinde]

Could u be more specific how a some random guy can steal my info? And can you give us a heads up is it done via .hta file or something similar? https://www.exploit-db.com/exploits/38513/ Like this, just improved stuff.

 

[Asphyxia]

And can you give us a heads up is it done via .hta file or something similar

For obvious security reasons we cannot release this information just yet. The idea is similar though, yes. One could potentially compromise a system via remote code execution, no specifics.

The idea is simple with all RCE (remote code execution) attacks: You join a server as a user, your user client is trusting # of users * # of user inputs/outputs * # of server inputs/outputs. When you think about all the trust going on with your TeamSpeak 3 client and all the servers, users, and so much more --- can you start to imagine how one user being compromised could lead to another one?

I mean in the past we have found vulnerable image rendering engines used to display user avatars. It could be as simple as clicking on a user for a potential execution, much like with the banner graphic caching any type of executable file into the user's startup folder which would trigger execution at next startup (user login to be exact). You can certainly see there is so much trust going on here for TeamSpeak 3 to not hire security staff (even just one) to audit their software to protect their many thousands of users.

The takeaway from this is really to just practice segmentation. This is what banks and enterprise (businesses) do to protect vast amounts of critical information. Why not do this with your bank information, passwords, and all that? It is affordable and simple. Shit, there is even "licenses" somewhere on Google or maybe you have to pay. You get the idea.

Putting all your untrusted applications in a virtual machine (a system within your main system) isolates any potential attacks from your passwords, bank information, and all the goodies attackers go after. Plus if you end up having your virtual machine compromised, it is as simple as restoring to a previous snapshot which is a very easy way to make a backup of a virtual machine.

Keep in mind if you are aiming to thoroughly isolate, run Linux as your virtual machine OS as mentioned above. Hackers primarily target the Windows OS because "Microsoft officially claims there are 400 million active users of Windows 10 itself." You would attack Windows if you were going for the largest audience too.

I realize it sounds like there is a lot to learn here, but this is something everyday users could learn to greatly secure themselves when using their machines. I hope this makes sense and please ask any more questions for clarification if you want.

 

[BlasoK]

So if I only connect to my server, I cant be risking my info, true?

 

[Shinde]

So if I only connect to my server, I cant be risking my info, true?

Nope, because if user can create channel, he can simply put some random description of .hta file to instant download and execute. Correct me if im wrong but this is not a joke, if this falls to someone's hands he can basically put RAT or even ransomware LOL holy shit.

 

[Asphyxia]

So if I only connect to my server, I cant be risking my info, true?

Let me demonstrate an example to help you better understand.

A new critical issue is found with TeamSpeak 3. This is only an example and non-working, for educational and demonstration purposes.

1. Malicious hacker discovers that when he has connected 40 bots at the same time with malicious code in the nicknames in a specific order, other users in the server have code executed on their machines --- or the server itself runs into a specific nullbyte input which triggers an overflow and the hacker tracks the issue in a debugger/disassembler to find ways to leverage this for remote code execution.
2. The malicious hacker either infects the user or server at which point he may need to restart the server so it appears the server shutdown and is back online.
3. Malicious hacker has injected into the TeamSpeak 3 process which is secretly (invisible) in the background begins launching all these same attacks to each and every TeamSpeak 3 server on the Internet infecting all servers and users. The way the attacker may spread this could be using: https://www.planetteamspeak.com/serverlist/ or various other server lists --- the idea is the infected client is now launching many invisible connections to other servers around the world to make sure every user and or server is infected, they could even port scan random IP ranges in search of the default TS3 server port, then scan for other TS3 server ports on that host.. etc. It can sound complex, but this shit can be very easy honestly.

This could happen on many applications but it is up to the company and developer(s) to audit their software for security purposes to protect their users. Keep in mind at present there are supposedly at least 700,000 users online of which I am guessing over 90% run the Windows OS. This means a botnet size of around 600K is just waiting to happen. Do you know how much money a malicious hacker could make from selling 600,000 user's credentials online? It could be a target. It should be protected.

Why do companies keep all their users at risk? They either do not care or do not have enough money. Either way, if you want to be safe you either have to run your TeamSpeak 3 client in a virtual machine or scream at TeamSpeak 3. Anyone want to help launch a petition to TeamSpeak 3 to properly security audit their shittily secured app?

 

[BlasoK]

Let me demonstrate an example to help you better understand.

A new critical issue is found with TeamSpeak 3. This is only an example and non-working, for educational and demonstration purposes.

1. Malicious hacker discovers that when he has connected 40 bots at the same time with malicious code in the nicknames in a specific order, other users in the server have code executed on their machines --- or the server itself runs into a specific nullbyte input which triggers an overflow and the hacker tracks the issue in a debugger/disassembler to find ways to leverage this for remote code execution.
2. The malicious hacker either infects the user or server at which point he may need to restart the server so it appears the server shutdown and is back online.
3. Malicious hacker has injected into the TeamSpeak 3 process which is secretly (invisible) in the background begins launching all these same attacks to each and every TeamSpeak 3 server on the Internet infecting all servers and users. The way the attacker may spread this could be using: https://www.planetteamspeak.com/serverlist/ or various other server lists --- the idea is the infected client is now launching many invisible connections to other servers around the world to make sure every user and or server is infected, they could even port scan random IP ranges in search of the default TS3 server port, then scan for other TS3 server ports on that host.. etc. It can sound complex, but this shit can be very easy honestly.

This could happen on many applications but it is up to the company and developer(s) to audit their software for security purposes to protect their users.

So we need TS3 developers to fix this...

 

[Asphyxia]

So we need TS3 developers to fix this...

We need TS3 (the company) to value security and the protection of their users. Simply adding a fancy-fucking-tastic "synchronize your accounts" feature does not solve every other security problem.



Until then, just run your TeamSpeak 3 client in a virtual machine where you do not store your passwords, login to your bank, etc..

 

[Najsr]

We need TS3 (the company) to value security and the protection of their users. Simply adding a fancy-fucking-tastic "synchronize your accounts" feature does not solve every other security problem.



Until then, just run your TeamSpeak 3 client in a virtual machine where you do not store your passwords, login to your bank, etc..

Would Sandboxie be enough so I don't use too many resources just for running teamspeak safely?

 

[Asphyxia]

Would Sandboxie be enough

While Sandboxie could offer some protection, it is limited compared to virtualization such as VMware. Light virtualization software still runs on the host system, whereas a virtual machine typically isolates applications much better.

An example: Malicious hacker takes control over the TeamSpeak 3 application, detects Sandboxie, and escapes the light virtualization onto the host system. I believe escaping VMware would be more challenging than Sandboxie.

Consider reading into this Blackhat PDF on escaping a sandbox: https://media.blackhat.com/bh-ad-10/Ridley/BlackHat-AD-2010-Ridley-Escaping-The-Sandbox-slides.pdf (virus scan: https://www.virustotal.com/#/url/fd...c58ed07ee16a221c789717ca4eb538c5601/detection )

 

[Hidden]

So if TS3 upgrades to Qt version 5.9 will virtualization of the teamspeak application still be necessary?

 

[Jackbox]

So if TS3 upgrades to Qt version 5.9 will virtualization of the teamspeak application still be necessary?

Correct! If you look at hundreds and likely even thousands of applications developed using the Qt framework, there are ways to crash the applications, cause remote execution which could lead to full compromise of your system by a malicious hacker, and other unfortunate things.

Because each application is only as secure as the developer makes it and most companies do not care enough about security or do not spend enough money on it — you end up with a straw house instead of solid bricks. The big bad wolf can blow all your shit down.

I hope this analogy is easy to understand.

 

[josejuegos]

Hello, I am the owner of a TeamSpeak hosting.

Can I do something to make my clients' servers safe and avoid this type of thing?

 

[Jackbox]

Hello, I am the owner of a TeamSpeak hosting.

Can I do something to make my clients' servers safe and avoid this type of thing?

Unfortunately there is little you may do because TeamSpeak 3 uses a proprietary protocol, apart from doing something that likely violates their agreement/TOS like reversing their protocol to make a firewall of sorts that blocks malicious binary on the server — you are basically fucked because TeamSpeak 3 is another company like most that hide with something called obscurity. They think by compiling a program that ends up as ASM in some way or another, which appears to malicious hackers in IDA Pro Disassembler, Olly (debug), there are memory editors like Cheat Engine, and even tools for reversing their shit “false security” protocol — look up yumBBQ. The idea is they have a screw holding their shit together that requires a smiley face screwdriver. Impossible for a malicious hacker to fuck with? No sir.. but with their terms, reversing their protocol even to make your users safer likely is not covered so really they’re helping malicious hackers whether they think so or not.

Go stick mice (sharp teeth) up their ass.

 

[Jackbox]

Hello, I am the owner of a TeamSpeak hosting.

Can I do something to make my clients' servers safe and avoid this type of thing?

Sorry about the double here but I wanted to show you what we are talking about with reverse engineering their protocol:
https://r4p3.net/threads/yumbbq-teamspeak-3-tutorial-mmbbq-3-0-3.257/

If we can do it, can’t the horrible fuckers spreading ransomware and eventually ransomworms (this is a threat coming which will auto spread and infect user machines to spread and encrypt user files with a request for bitcoin usually or other payment).

We are only here to raise awareness to hopefully let people know the threat landscape is here. Your ship has holes in it, how much time do you have when it is always 3 am pitch black and the power is out with no flashlights? It’s hard to say.
Literally all I can say is that security is the responsibility of everyone and TeamSpeak clearly thinks differently. If we do not do our community service to aware them they are doing it wrong, who will suffer? All.

Their proprietary protocol offers little protection and takes away a lot of protection. Just imagine a firewall that blocks everything containing executable file names or anything that could be executable. By putting a condom between malicious hackers and your server, you’re saving everyone from AIDS. TS3 prevents condoms by design because they think AIDS is safe for everyone, they truly are helping the bad guys.

 

[Kieran]

Huh, teamspeak on kali linux in virtual box works surprisingly well. Gonna continue using it like that

 

[Jackbox]

Huh, teamspeak on kali linux in virtual box works surprisingly well. Gonna continue using it like that

I’m considering making a tutorial on setting it up. Hell, we could probably just package an image for people so it comes preinstalled/packaged with TS3 and a shortcut.

Do you have a picture of it working?