How to remediate – PPTP Detection

1. Introduction

PPTP Detection indicates a Point-to-Point Tunneling Protocol server is running on a remote host. PPTP is an older VPN protocol known to have security weaknesses. This affects servers that allow remote access, potentially exposing network traffic and data. A successful attack could compromise confidentiality, integrity, and availability of the connected network.

2. Technical Explanation

The vulnerability occurs when a PPTP server is enabled on a system. Attackers can exploit weaknesses in the protocol to gain unauthorized access to the network. This requires the target host to be listening for PPTP connections and accepting incoming requests. There are no known CVEs specifically for detection, but exploitation of PPTP itself has been documented extensively. An attacker could attempt to connect to the server using a compromised client or by exploiting flaws in the authentication process.

• Root cause: The PPTP service is enabled and listening on a network interface.
• Exploit mechanism: Attackers can use tools like pptpdump or similar software to capture MPPE-encrypted traffic, potentially decrypting it with weak keys or exploiting known vulnerabilities in the protocol’s authentication process.
• Scope: Windows servers running PPTP are commonly affected. Other platforms supporting PPTP may also be vulnerable.

3. Detection and Assessment

You can confirm a PPTP server is present by checking for listening ports or examining service configurations. A thorough assessment involves analysing network traffic for PPTP-related packets.

• Quick checks: Use netstat -an | find "1723" to check if port 1723 (the standard PPTP port) is open and listening.
• Scanning: Nessus plugin ID 24865 can detect running PPTP servers as an example only.
• Logs and evidence: Check Windows Event Logs for events related to VPN connections, specifically those mentioning PPTP. Look in System logs for RAS (Remote Access Service) entries.

netstat -an | find "1723"

4. Solution / Remediation Steps

The recommended solution is to disable the PPTP service if it’s not required, or replace it with a more secure VPN protocol like IPsec or WireGuard.

4.1 Preparation

• Ensure you have alternative remote access methods available. A roll back plan is to restart the Remote Access service.
• Changes may require a planned maintenance window and approval from IT security.

4.2 Implementation

1. Step 1: Open the Services application (services.msc).
2. Step 2: Locate “Remote Access Service”.
3. Step 3: Right-click on “Remote Access Service” and select “Properties”.
4. Step 4: Change the “Startup type” to “Disabled”.
5. Step 5: Click “Apply”, then “OK”.

4.3 Config or Code Example

Before

Startup type: Automatic

After

Startup type: Disabled

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate this vulnerability.

• Practice 1: Least privilege – only enable services that are absolutely necessary, reducing the attack surface.
• Practice 2: Secure defaults – configure systems with strong default settings and disable unnecessary features like PPTP.

4.5 Automation (Optional)

# PowerShell example to disable PPTP service
Stop-Service RasDienst
Set-Service -Name RasDienst -StartupType Disabled

5. Verification / Validation

Confirm the fix by checking that the PPTP service is disabled and no longer listening on port 1723.

• Post-fix check: Run netstat -an | find "1723". The output should be empty, indicating the port is not in use.
• Re-test: Re-run the earlier detection method (netstat -an | find "1723") to confirm PPTP is no longer listening.
• Smoke test: Verify other remote access methods are still functioning correctly, if applicable.

netstat -an | find "1723"

6. Preventive Measures and Monitoring

Update security baselines and implement regular patch management processes.

• Baselines: Update your system baseline to include disabling PPTP as a standard configuration item, for example using Group Policy or Intune.
• Pipelines: Include checks in your CI/CD pipeline to ensure systems are not configured with unnecessary services like PPTP.
• Asset and patch process: Implement a regular review cycle for system configurations to identify and remediate any deviations from security baselines.

7. Risks, Side Effects, and Roll Back

Disabling the PPTP service may disrupt existing VPN connections that rely on it.

• Roll back:
  Step 1: Open the Services application (services.msc).
  Step 2: Locate “Remote Access Service”.
  Step 3: Right-click on “Remote Access Service” and select “Properties”.
  Step 4: Change the “Startup type” to “Automatic”.
  Step 5: Click “Apply”, then “OK”.

8. References and Resources

• Vendor advisory or bulletin: Microsoft Security Update Guide
• NVD or CVE entry: CVE-2018-13379