1
00:00:25,400 --> 00:00:27,780
My name is Darryl Highland.

2
00:00:27,780 --> 00:00:30,660
Today's presentation is the Insecure Workstation.

3
00:00:31,040 --> 00:00:34,600
I had a lot of fun putting this together and I hope everyone enjoys it.

4
00:00:34,720 --> 00:00:37,400
The Insecure Workstation, Bob Reloaded.

5
00:00:38,540 --> 00:00:43,500
The information provided in this presentation is for educational purposes only.

6
00:00:43,500 --> 00:00:45,260
Just use good judgment.

7
00:00:49,010 --> 00:00:51,790
Today's presentation has two parts.

8
00:00:52,130 --> 00:00:55,270
Rights escalation used in API call vulnerabilities.

9
00:00:55,270 --> 00:00:58,810
This is kind of an old issue that just won't die.

10
00:00:58,990 --> 00:01:01,030
So I thought it was important just to bring it out.

11
00:01:01,030 --> 00:01:03,350
Maybe we can put it to bed eventually.

12
00:01:03,690 --> 00:01:07,770
The second part of this is subverting Windows logon.

13
00:01:08,810 --> 00:01:12,010
A few key takeaways in today's presentation.

14
00:01:12,450 --> 00:01:15,210
A better understanding of desktop security.

15
00:01:15,990 --> 00:01:18,530
Simple desktop console vulnerabilities.

16
00:01:18,910 --> 00:01:23,690
And protecting information assets with layer defense or defense in depth principles.

17
00:01:23,690 --> 00:01:29,930
And of course, since this is DEF CON, subverting desktop security for fun and entertainment.

18
00:01:33,040 --> 00:01:36,820
What is a help API vulnerability?

19
00:01:37,420 --> 00:01:44,600
It's a vulnerability that is exposed when an application running with system level rights makes an API call to the help viewer.

20
00:01:44,600 --> 00:01:49,680
And does not drop any of those privileges before invoking that help viewer.

21
00:01:49,680 --> 00:01:57,160
A user then, using the help viewer, can access other applications which will execute at system level, of course.

22
00:01:57,600 --> 00:02:03,240
And as you can see with the bug track on this, 2003, this is nearly two years old.

23
00:02:03,460 --> 00:02:05,420
So why is it still an issue?

24
00:02:07,140 --> 00:02:10,320
The other question is, how widespread is this vulnerability?

25
00:02:11,000 --> 00:02:14,780
To tell the truth, I'm really not sure how widespread this is.

26
00:02:15,240 --> 00:02:16,860
But I do know one thing.

27
00:02:16,860 --> 00:02:26,560
Over the last eight months, I've discovered one application during product testing that still had the help API vulnerability on it.

28
00:02:27,580 --> 00:02:35,800
Two, I found another vulnerable application running on my company's network that had never been reported yet.

29
00:02:35,920 --> 00:02:45,680
And third, I actually found an application that had been reported in bug track, but it was running on someone else's network unpatched.

30
00:02:45,680 --> 00:02:50,400
So this is a reality, and this is an extremely simple vulnerability.

31
00:02:51,240 --> 00:02:53,760
Now, why do vendors continue down this path?

32
00:02:53,760 --> 00:02:55,680
Of course, the issue is money.

33
00:02:55,960 --> 00:02:58,360
They want to beat the competitors to market.

34
00:02:58,360 --> 00:03:04,180
They're cutting corners and not properly security testing their applications prior to going to market.

35
00:03:04,700 --> 00:03:08,420
Vendors also may presume that users are not abusing their products.

36
00:03:08,780 --> 00:03:11,600
Obviously, they've never been to DEF CON.

37
00:03:13,160 --> 00:03:16,940
Sell first, fix later, make you pay for it.

38
00:03:17,400 --> 00:03:29,140
I don't know about you, but when I get to go back and patch 20,000 systems because of some lame vulnerability that should have never been in the product when it went to market, I'm upset.

39
00:03:31,700 --> 00:03:33,880
Now for a quick demonstration.

40
00:03:42,450 --> 00:03:47,190
The first one on this list, Spy Sweeper, anti-spyware enterprise version.

41
00:03:47,190 --> 00:03:49,370
This was version 1.5.

42
00:03:49,950 --> 00:03:56,110
Since I discovered this, the vendor did release version, I believe, 2.0 that fixed the vulnerability.

43
00:03:56,750 --> 00:04:00,930
But of course, how many people are running 1.5 out there?

44
00:04:01,150 --> 00:04:03,790
So let's take a quick look at how simple this is.

45
00:04:13,620 --> 00:04:19,340
A user just needs to open up the standard Spy Sweeper GUI.

46
00:04:25,600 --> 00:04:27,860
Launch the Help, the Help Viewer.

47
00:04:29,360 --> 00:04:34,160
Within Help Viewer, there's many paths that he can take, but we'll take the simplest one.

48
00:04:49,020 --> 00:04:52,120
Now let's take a look at Task Manager to see how this is running.

49
00:04:58,720 --> 00:05:06,500
So if we look at Task Manager and look at Spy Sweeper, the main application, we can see it's running at system level.

50
00:05:08,280 --> 00:05:14,420
Obviously, when the viewers kicked off, it's running at system level also.

51
00:05:15,600 --> 00:05:21,540
And of course, since we spawned Command-DXE from there, it's running at system level.

52
00:05:22,060 --> 00:05:27,220
This is basically a textbook Help API vulnerability to the T.

53
00:05:31,040 --> 00:05:35,760
So after I found this during product testing, we didn't buy the product.

54
00:05:41,450 --> 00:05:48,710
I started looking at our network and taking a look at Novell's NetWare XenWorks Remote Desktop.

55
00:05:48,710 --> 00:05:52,050
It puts a little icon in the lower right-hand corner of your screen.

56
00:05:52,910 --> 00:05:54,290
Right here it is.

57
00:05:54,290 --> 00:05:58,730
I'm not going to run it because it's a textbook Help API vulnerability.

58
00:05:58,730 --> 00:06:03,290
I contacted NetWare and they quickly released a patch.

59
00:06:03,390 --> 00:06:08,230
But of course, how many people are running the unsecured version of it out there?

60
00:06:08,730 --> 00:06:11,930
The third one in here, McAfee AV4051.

61
00:06:12,370 --> 00:06:20,390
As you can see, the bug track was actually reported on this in September 15, 2004.

62
00:06:20,390 --> 00:06:23,550
And McAfee quickly released a fix for this.

63
00:06:23,550 --> 00:06:29,150
It's a fairly old version, but you run into many companies, you typically run older versions.

64
00:06:29,150 --> 00:06:33,250
You can't afford to constantly upgrade every time the vendor comes out with something.

65
00:06:33,390 --> 00:06:34,710
This one is a little different.

66
00:06:34,710 --> 00:06:35,610
I want to show it to you.

67
00:06:35,610 --> 00:06:40,530
Because it doesn't have the Help API vulnerability, that was actually fixed in it.

68
00:06:56,010 --> 00:06:59,270
If you go to the Help viewer from here, it's going to be fine.

69
00:06:59,270 --> 00:07:05,470
But, interesting thing about this product, I was actually taking a security class.

70
00:07:05,810 --> 00:07:07,450
A security class.

71
00:07:07,470 --> 00:07:11,010
And in the class, at lunch time, I decided to have a little fun.

72
00:07:11,010 --> 00:07:16,110
So I started playing around with their desktop systems in the security class.

73
00:07:16,770 --> 00:07:20,530
And I found this vulnerability.

74
00:07:20,530 --> 00:07:23,590
Of course, it had already been reported, but I didn't know it.

75
00:07:23,590 --> 00:07:27,830
How many of us are capable of reading all bug tracks and remembering them all?

76
00:07:27,830 --> 00:07:33,810
So, if you drill down in this thing and go to...

77
00:07:43,250 --> 00:07:48,310
If we go to Reports, we get a nice little browser button.

78
00:07:48,350 --> 00:07:49,610
These are always fun.

79
00:08:04,820 --> 00:08:06,540
Of course, right click on it.

80
00:08:09,920 --> 00:08:11,880
Go open, and there it is.

81
00:08:12,100 --> 00:08:15,660
Now, if we look at Task Manager, this is going to be running at system level also.

82
00:08:29,560 --> 00:08:32,020
So, how do you tell if your systems are vulnerable?

83
00:08:32,020 --> 00:08:34,420
Just like I did there, just take a look at them.

84
00:08:34,760 --> 00:08:41,800
Look at Task Manager, take a close look at all the services running in Task Manager with system level.

85
00:08:41,820 --> 00:08:44,980
Do any of those interact with the desktop?

86
00:08:44,980 --> 00:08:50,440
If they interact with the desktop, there is always a possibility that a vulnerability could exist in there.

87
00:08:50,440 --> 00:08:51,640
Take a close look.

88
00:08:51,640 --> 00:08:54,200
What icons are running in the system tray?

89
00:08:54,200 --> 00:08:58,020
Do they launch applications that are running at system level also?

90
00:08:58,020 --> 00:09:03,220
And of course, what applications need higher rights to function properly?

91
00:09:03,840 --> 00:09:13,880
Antivirus, antispyware, remote management tools, auditing tools or auditing applications may need to run at higher rights.

92
00:09:13,880 --> 00:09:16,700
So, scrutinize those applications a little closer.

93
00:09:17,480 --> 00:09:20,980
How do I protect myself from help API vulnerability?

94
00:09:20,980 --> 00:09:22,420
Group policies.

95
00:09:22,700 --> 00:09:27,540
If you sat through my presentation last year, you may not think group policies is a good solution.

96
00:09:27,540 --> 00:09:34,820
But I think it works in this scenario right here and has features that you can use to shut down some of these holes.

97
00:09:34,840 --> 00:09:36,860
Remove the icon from the system tray.

98
00:09:36,860 --> 00:09:44,840
A lot of these applications have the ability to go ahead and remove the icons from the system tray so the viewer can't do it.

99
00:09:44,840 --> 00:09:47,620
Also, a lot of those features can be locked down.

100
00:09:47,620 --> 00:09:56,460
If you install your applications right out of the box, a lot of times that's how these vulnerabilities get brought into your systems.

101
00:09:57,780 --> 00:10:00,320
And of course, testing all new applications.

102
00:10:00,320 --> 00:10:04,840
You need to go out there, look at all your applications and test them before you deploy them.

103
00:10:04,840 --> 00:10:07,980
Better yet, test them before you purchase them.

104
00:10:08,620 --> 00:10:12,340
Save yourself some money and headache because you're going to have to go back and patch them.

105
00:10:14,940 --> 00:10:17,260
Okay, let's have a little bit of fun now.

106
00:10:17,260 --> 00:10:20,180
This year's project, subverting Windows logon.

107
00:10:24,270 --> 00:10:26,870
This year's research project and what we learned.

108
00:10:26,870 --> 00:10:32,290
I'd like to give credit to some friends of mine that played a big part in helping me with this.

109
00:10:32,290 --> 00:10:34,850
They did some of the coding, helped me with the coding.

110
00:10:34,850 --> 00:10:35,890
I'm not a coder.

111
00:10:35,890 --> 00:10:38,730
I'm in the process of trying to learn it, but I'm not a coder.

112
00:10:38,750 --> 00:10:42,730
So they assisted me in this part here, as part of this project, in their research.

113
00:10:42,730 --> 00:10:44,430
I'd like to give them credit for that.

114
00:10:44,750 --> 00:10:47,150
Three rules that drove this research project.

115
00:10:47,150 --> 00:10:48,770
It must be simple.

116
00:10:48,850 --> 00:10:51,270
I like simple exploits.

117
00:10:51,730 --> 00:10:52,570
Simple hacks.

118
00:10:52,570 --> 00:10:56,510
I like something I could actually go teach my grandmother how to do and she would understand it.

119
00:10:57,950 --> 00:11:00,690
It needs to fit in my pocket, if not in my head.

120
00:11:00,690 --> 00:11:07,070
I like things that, you know, it'll easily fit in a CD or a USB, if not fit in my head.

121
00:11:07,070 --> 00:11:17,110
There's nothing worse than trying to do a proof of concept that somebody's came out with when you've got to put in a 400 megabyte footprint onto a box to actually make it work.

122
00:11:19,970 --> 00:11:22,890
And last, it must be easy to protect against.

123
00:11:22,890 --> 00:11:31,970
If I'm going to go through this trouble to figure out these exploits and these issues and teach people, I want to be able to teach them how to protect themselves also.

124
00:11:31,970 --> 00:11:33,430
That's very important to me.

125
00:11:34,310 --> 00:11:35,870
So let's get started.

126
00:11:37,790 --> 00:11:39,810
Can Windows login be subverted?

127
00:11:40,090 --> 00:11:41,210
Yes, it can.

128
00:11:41,210 --> 00:11:42,150
You'll see.

129
00:11:42,650 --> 00:11:43,410
Curiosity?

130
00:11:43,410 --> 00:11:44,890
Just because it's there?

131
00:11:44,890 --> 00:11:46,770
No, I didn't do this just for curiosity.

132
00:11:46,770 --> 00:11:54,590
Of course, I did it to get a better understanding of the security vulnerabilities that exist in the company's environment where I work and be able to protect them.

133
00:11:54,590 --> 00:11:56,250
That's what I'm being paid to do.

134
00:11:57,030 --> 00:11:58,010
Where?

135
00:11:58,010 --> 00:12:01,830
On XP, Windows 2003, this is where we've tested this at.

136
00:12:01,830 --> 00:12:09,410
Of course, it's so simplistic, as you'll see, it'll easily be carried out on a Windows NT or a 2000 box.

137
00:12:09,810 --> 00:12:10,790
When?

138
00:12:10,790 --> 00:12:12,670
Bob is back on the job.

139
00:12:12,730 --> 00:12:16,730
If anyone's seen my presentation last year, I introduced Bob as a character.

140
00:12:16,730 --> 00:12:27,890
Bob works for his uncle, and he is a hacker, and he likes to subvert desktop security for fun and entertainment and torment his sysadmin in the process.

141
00:12:28,850 --> 00:12:30,350
Now you ask how.

142
00:12:30,350 --> 00:12:33,370
Well, this exploit has two pieces.

143
00:12:33,370 --> 00:12:36,930
There's a methodology, the attack process behind it.

144
00:12:36,930 --> 00:12:47,590
And a programmatic attack, a simple program that we're going to use and deploy onto a system that gives us the ability to bypass the Windows logon.

145
00:12:47,850 --> 00:12:54,290
Neither one of them can do anything by themselves, but when we bring these two concepts together, we accomplish this goal.

146
00:12:55,630 --> 00:12:56,950
Okay, let's start.

147
00:12:56,950 --> 00:13:00,010
Exploit Part 1, Utility Manager.

148
00:13:00,150 --> 00:13:02,150
What is Utility Manager?

149
00:13:02,150 --> 00:13:06,110
Well, let's take a close look at what Windows has to say about Utility Manager.

150
00:13:10,940 --> 00:13:18,880
Utility Manager enables users to check an accessibility program status and start or stop an accessibility program.

151
00:13:18,880 --> 00:13:24,800
So basically, Utility Manager is an application that you can use to start and stop other applications.

152
00:13:25,780 --> 00:13:26,920
Let's read a little more.

153
00:13:28,080 --> 00:13:33,160
Users can also start accessibility programs before logging onto the computer.

154
00:13:33,980 --> 00:13:39,260
By pressing the Windows logo key and the plus at the welcome screen.

155
00:13:39,320 --> 00:13:48,960
So basically, Utility Manager is an application that I can use to start and stop other applications before I ever log onto the system.

156
00:13:53,790 --> 00:13:56,550
How does it work and how do we access it?

157
00:13:56,970 --> 00:14:04,090
Well, what Windows help said, you hold down the Windows logo key and you hit the U key and up comes Utility Manager.

158
00:14:04,090 --> 00:14:08,550
From within there, you can start and stop accessibility programs.

159
00:14:12,090 --> 00:14:13,490
There you go.

160
00:14:13,630 --> 00:14:14,810
Pretty simple.

161
00:14:19,660 --> 00:14:21,660
Why is it such a problem?

162
00:14:22,360 --> 00:14:27,800
Well, obviously, as I mentioned, a user can start and stop applications before he ever logs on.

163
00:14:27,880 --> 00:14:35,240
Once you are logged on and you use the accessibility program, it runs under your user ID and runs under your credentials.

164
00:14:35,240 --> 00:14:36,440
Not an issue.

165
00:14:36,440 --> 00:14:40,880
But, if you are not logged on to the system, it runs as local system.

166
00:14:41,000 --> 00:14:48,840
So, we can start and stop applications prior to ever logging on to Windows and we can get them to run at local system level rights.

167
00:14:53,740 --> 00:15:12,700
So, when we started this, we thought, okay, well, does that mean if I can take example, let's say, command.exe, cmd.exe, and rename it osk.exe, which is the on-screen keyboard, would Windows let me launch this or would it give me an error?

168
00:15:12,700 --> 00:15:15,720
Would it give me a security error to prevent me from running it?

169
00:15:15,720 --> 00:15:27,920
So, we went ahead and we overwrote the osk.exe and we executed it and at first, before we logged on, and nothing seemed to happen.

170
00:15:27,920 --> 00:15:35,720
Well, further investigation, we found out that it did execute with no errors, but it was running in a non-interactive mode.

171
00:15:35,720 --> 00:15:36,980
It was in the background.

172
00:15:36,980 --> 00:15:39,080
We did not have access to it.

173
00:15:39,080 --> 00:15:48,100
But, if you could hold some questions to the end, because we're going to be really tight to get through this presentation, I apologize.

174
00:15:48,320 --> 00:15:57,180
And if I can't answer them at the end because we don't have time, we'll take it offline and I will try to answer your questions and if I don't have the answers, I will try to get those answers for you.

175
00:15:57,180 --> 00:15:58,040
How's that sound?

176
00:16:00,020 --> 00:16:09,360
So, we went ahead and did that and it didn't seem to work, but when we looked at it, we found out it was running at system level, but in the background in a non-interactive mode.

177
00:16:09,360 --> 00:16:14,120
So, over the next couple of slides, we'll explain what we did.

178
00:16:15,620 --> 00:16:18,500
Exploit part two, the log on screen.

179
00:16:18,680 --> 00:16:24,080
User interface objects are managed using Windows stations and desktops.

180
00:16:24,520 --> 00:16:29,080
Windows stations come in two flavors, interactive and non-interactive.

181
00:16:29,100 --> 00:16:35,550
The only interactive Windows station that can be defined in an application is when stay zero.

182
00:16:36,330 --> 00:16:41,410
Also, Windows has what's known as multiple desktops.

183
00:16:41,590 --> 00:16:48,110
The default desktop is the desktop after you log in where you do your work on a day-to-day basis on a Windows system.

184
00:16:48,530 --> 00:16:52,410
The screen saver is also defined as a separate desktop.

185
00:16:52,570 --> 00:16:55,350
Haven't really played with that yet, but we probably will.

186
00:16:55,790 --> 00:17:00,790
The win log on screen also is a completely separate functioning desktop.

187
00:17:00,790 --> 00:17:16,990
So, basically what we decided we needed to do, we need to get the program that we replaced the OSK EXE with, we need to get it to launch interactive mode and we need to get it to launch interactive mode on the win log on desktop.

188
00:17:17,390 --> 00:17:27,390
So, basically we put together a simple program that would spawn command EXE under win stay zero win log on desktop.

189
00:17:27,830 --> 00:17:29,510
So, let's move in that direction.

190
00:17:30,570 --> 00:17:32,850
Exploit part three of the code.

191
00:17:33,170 --> 00:17:37,270
This code we put together poses no security issues by itself.

192
00:17:37,510 --> 00:17:42,610
Basically, we're just setting the create process thread to run under the win log on desktop.

193
00:17:43,770 --> 00:17:46,030
The security breakdown is how we use it.

194
00:17:46,030 --> 00:17:47,330
It's the methodology.

195
00:17:47,330 --> 00:17:54,190
Basically, we've discovered an architectural issue with the way utility managers run on the system.

196
00:17:54,330 --> 00:17:59,530
And the ability to run it prior to ever logging on and get it to launch at system level.

197
00:18:00,490 --> 00:18:02,110
And the code is extremely simple.

198
00:18:02,110 --> 00:18:04,290
So, let's look at the entire code.

199
00:18:05,490 --> 00:18:06,670
That's it.

200
00:18:09,930 --> 00:18:24,410
And as you can see, if you go down through there, right above where it says create process, see Windows system 32, right above that line, is where we define the win stay zero, the interactive desktop, and the win log on as the desktop that we want to run this at.

201
00:18:25,870 --> 00:18:32,850
If you go out and look at, I know there's plenty of coders in the room, I mean this is just a simple code snippet.

202
00:18:33,930 --> 00:18:36,570
I've seen this in a hundred different applications.

203
00:18:36,670 --> 00:18:42,750
The only thing is we're different is most of the applications I've seen define default instead of win log on.

204
00:18:42,750 --> 00:18:44,630
That's the only thing different with this code.

205
00:18:46,770 --> 00:18:50,370
So, we come to the final part of this, the delivery.

206
00:18:51,030 --> 00:18:57,730
Now, when I first started this project and we got around to this point, I said, oh my gosh, how am I going to deliver this code to the system?

207
00:18:57,810 --> 00:19:00,290
This has to be the most difficult part.

208
00:19:00,490 --> 00:19:04,490
Well, it turned out to be the most trivial part.

209
00:19:04,490 --> 00:19:08,810
And we're going to cover some high level concepts here.

210
00:19:09,130 --> 00:19:11,810
Admin access, well you can overwrite it with admin access.

211
00:19:11,810 --> 00:19:13,970
That's when we did our first test we did that.

212
00:19:14,030 --> 00:19:18,350
But we already have admin access to the system, so that really accomplishes nothing.

213
00:19:18,670 --> 00:19:22,950
We can use some of the help API vulnerabilities I showed you to overwrite the file.

214
00:19:22,950 --> 00:19:26,910
But, you know, if I'm already system level and logged in, you know, what's the point?

215
00:19:27,870 --> 00:19:30,330
Bit level modification of the hard drive.

216
00:19:30,330 --> 00:19:42,670
We actually took a DOS boot disk and some old DOS utilities and identified the track sector where OSK was and overwrite the first part of the application and got that to work.

217
00:19:43,190 --> 00:19:49,130
But somewhat complex and it goes against my theory moving forward of keeping it simple.

218
00:19:49,550 --> 00:19:52,650
The one thing is maintenance boot disk.

219
00:19:52,970 --> 00:19:55,530
This is a fairly broad category.

220
00:19:56,990 --> 00:20:00,210
Linux is a possible solution moving forward.

221
00:20:00,330 --> 00:20:04,310
There's a lot of work going on in writing to NTFS file systems.

222
00:20:05,490 --> 00:20:13,050
Another solution, an attacker could actually have a stolen or pirated copy of Windows PE.

223
00:20:13,050 --> 00:20:16,610
Windows pre-installation disk is a possible solution.

224
00:20:17,030 --> 00:20:26,770
But also, if you go out and Google, you'll find out there are other PE or pre-installation available.

225
00:20:26,770 --> 00:20:29,250
Which is basically an open source solution.

226
00:20:29,870 --> 00:20:31,210
Maintenance disk type things.

227
00:20:31,210 --> 00:20:35,030
And I did find a couple other solutions out there that look very viable.

228
00:20:35,190 --> 00:20:37,770
So I'm going to say just kind of pick your own poison.

229
00:20:37,770 --> 00:20:38,870
Go out to Google.

230
00:20:38,870 --> 00:20:40,930
Google for writing NTFS.

231
00:20:40,930 --> 00:20:44,050
Google Linux NTFS.

232
00:20:44,050 --> 00:20:47,290
Google Windows PE or pre-installation.

233
00:20:47,290 --> 00:20:49,770
And you will find a multiple of solutions.

234
00:20:50,270 --> 00:20:52,370
I sat down to try to figure this thing out.

235
00:20:52,370 --> 00:20:54,290
I said, well, there's no sense in re-venting the wheel.

236
00:20:54,290 --> 00:20:57,990
Let me go out on Google and see if anyone's already doing this.

237
00:20:58,250 --> 00:21:01,890
Well, I searched for maintenance disk, maintenance boot disk.

238
00:21:02,650 --> 00:21:07,190
And probably within 15 minutes I had a bunch of solutions.

239
00:21:07,190 --> 00:21:08,730
I downloaded a couple of them.

240
00:21:08,730 --> 00:21:11,350
Within an hour I had a fully functional solution.

241
00:21:11,950 --> 00:21:14,910
So this is a no-brainer here.

242
00:21:15,430 --> 00:21:17,930
So we're going to move on a little further from here.

243
00:21:18,490 --> 00:21:20,390
Okay, Bob reloaded.

244
00:21:20,390 --> 00:21:25,210
So now we're going to go ahead and look at this actual exploit and see how it works.

245
00:21:35,450 --> 00:21:37,330
A little history on Bob.

246
00:21:37,330 --> 00:21:41,890
As I mentioned, Bob works for his uncle.

247
00:21:41,890 --> 00:21:43,810
And he is a hacker.

248
00:21:43,810 --> 00:21:45,870
And he likes to subvert security.

249
00:21:45,970 --> 00:21:51,110
Well, it turns out Bob's uncle has a competitor against his company.

250
00:21:51,630 --> 00:21:57,630
And his competitor is getting ready to release some new products out there.

251
00:21:57,630 --> 00:21:59,910
And Bob's uncle thinks, you know what?

252
00:21:59,950 --> 00:22:03,990
It would be really good if I could steal that information off him.

253
00:22:04,310 --> 00:22:08,970
So what he does is he gets Bob and the competitor happens to be looking for a janitor.

254
00:22:08,970 --> 00:22:13,630
So they send Bob down there to apply for this janitorial job.

255
00:22:13,630 --> 00:22:16,030
And Bob gets the janitorial job.

256
00:22:16,230 --> 00:22:18,770
So Bob shows up to work the first night.

257
00:22:19,210 --> 00:22:21,270
And he brings his cleaning tools.

258
00:22:25,340 --> 00:22:29,560
Just to let you know, I did pre-stage the exploit on here.

259
00:22:29,560 --> 00:22:33,060
Because the disk would obviously whirl for three minutes.

260
00:22:33,060 --> 00:22:35,020
And you would just see a black screen.

261
00:22:35,020 --> 00:22:36,680
So you really accomplished nothing.

262
00:22:36,680 --> 00:22:41,960
If anyone actually wants to see me own a system that hasn't been owned yet, just get with me after this.

263
00:22:41,960 --> 00:22:44,640
And I will run the disk through there so you can see it happen.

264
00:22:47,020 --> 00:22:49,780
So Bob goes through and he scopes out all the offices.

265
00:22:49,780 --> 00:22:50,920
And he finds an office.

266
00:22:50,920 --> 00:22:53,680
He finds John's office, as a matter of fact.

267
00:22:54,420 --> 00:22:57,000
And what he does is he throws his disk in.

268
00:22:57,000 --> 00:22:58,260
He boots John's system.

269
00:22:58,260 --> 00:22:59,820
It spins for a few minutes.

270
00:22:59,840 --> 00:23:02,480
And he pulls the disk out and he reboots it.

271
00:23:02,480 --> 00:23:03,880
And he goes about his way.

272
00:23:03,880 --> 00:23:06,020
The next day, John comes in.

273
00:23:06,500 --> 00:23:08,420
He logs on to the computer.

274
00:23:08,420 --> 00:23:10,760
And of course, he's not going to see anything there.

275
00:23:10,760 --> 00:23:13,480
Because he doesn't know about Utility Manager.

276
00:23:13,480 --> 00:23:15,400
He doesn't use Utility Manager.

277
00:23:15,400 --> 00:23:17,520
There's no applications running in memory.

278
00:23:17,520 --> 00:23:20,360
They have to be executed from somebody at the console.

279
00:23:21,060 --> 00:23:23,280
So there's nothing to be detected there.

280
00:23:24,380 --> 00:23:26,080
So John comes in.

281
00:23:26,080 --> 00:23:27,500
Of course, he logs in.

282
00:23:27,540 --> 00:23:29,420
He does his thing that day.

283
00:23:29,620 --> 00:23:33,380
And when John's finished, what he does is he does what a lot of us do.

284
00:23:33,380 --> 00:23:35,520
He doesn't log out.

285
00:23:35,520 --> 00:23:38,560
He locks his screen and he goes his merry way.

286
00:23:38,560 --> 00:23:41,960
Or he lets his screensaver kick on, which locks his screen.

287
00:23:42,600 --> 00:23:45,940
So about 9 o'clock, Bob comes rolling.

288
00:23:45,940 --> 00:23:47,560
And let's see what Bob's going to do.

289
00:23:56,380 --> 00:23:58,840
Of course, the system's already been staged.

290
00:23:58,840 --> 00:24:00,820
So set up by Bob.

291
00:24:00,820 --> 00:24:01,860
So Bob comes in.

292
00:24:01,860 --> 00:24:03,580
He goes to Utility Manager.

293
00:24:03,980 --> 00:24:05,780
He brings up Utility Manager.

294
00:24:05,780 --> 00:24:08,440
He goes to the on-screen keyboard.

295
00:24:09,020 --> 00:24:10,620
And he launches it.

296
00:24:30,780 --> 00:24:33,200
After we did this, we started playing around with this.

297
00:24:33,200 --> 00:24:41,500
And the reason why I'm just running a command.exe versus the entire desktop is we found out the resources on the WinLogin desktop are limited.

298
00:24:41,800 --> 00:24:47,560
If you get Explorer up, which is a real hog, the thing will start flaking out and applications won't run properly.

299
00:24:47,580 --> 00:24:50,980
But from here, Bob can pretty much do what he wants.

300
00:24:52,440 --> 00:24:57,700
One of the good things to run is Task Manager.

301
00:24:58,620 --> 00:25:02,860
From Task Manager, you can pretty much stop and start processes.

302
00:25:02,860 --> 00:25:07,500
As a matter of fact, you can see John's processes in there.

303
00:25:08,040 --> 00:25:09,980
And we're running at system level.

304
00:25:17,220 --> 00:25:19,900
Bob could go ahead and several things he could do.

305
00:25:19,900 --> 00:25:21,420
He could use his USB.

306
00:25:27,170 --> 00:25:29,110
Make his job easier.

307
00:25:39,430 --> 00:25:44,050
He could just dump the hashes out, take them offline, and crack the passwords on the system if he wanted to.

308
00:25:44,050 --> 00:25:45,170
That's not a problem.

309
00:25:52,010 --> 00:26:05,110
Another thing Bob could do, and I've had a lot of success testing it, he could take a small memory tool like TinyHexer, run this against all the running processes.

310
00:26:05,110 --> 00:26:12,490
Scan all the running processes for the words password, passwd, pwd.

311
00:26:12,490 --> 00:26:26,090
And I successfully and many times have been able to strip the user's password plain text out of the running processes memory on many occasions for multiple applications.

312
00:26:26,090 --> 00:26:32,230
Specifically if the application requires authentication and it's written in Java.

313
00:26:36,330 --> 00:26:43,950
Now at this point, the reality is that he's trying to steal stuff from this company.

314
00:26:43,950 --> 00:26:48,710
The chances are that information is probably not going to be on this local computer.

315
00:26:48,850 --> 00:26:51,050
He's going to want to go to the network.

316
00:26:52,790 --> 00:26:57,810
So if he looks to see what drives are mapped, he can see there's nothing mapped.

317
00:27:01,300 --> 00:27:03,080
But if we run netstat...

318
00:27:04,100 --> 00:27:05,380
Oh, that stinks.

319
00:27:05,380 --> 00:27:06,160
Okay.

320
00:27:07,100 --> 00:27:09,380
He can see that there's no mapped drives.

321
00:27:09,540 --> 00:27:13,380
Apparently disconnected, but we can probably get that connected up and then we'll see.

322
00:27:14,240 --> 00:27:23,160
We found out that since we were running in a completely separate desktop, running at system level, we're not John.

323
00:27:23,160 --> 00:27:28,200
We don't have John's network resources and can't get to him, we found out.

324
00:27:28,700 --> 00:27:37,120
So me and my friends started talking about this and what was the possibility of getting the user, John's security token.

325
00:27:38,220 --> 00:27:51,540
So we did some research on this and using standard Windows API calls, we devised a way that we could actually impersonate John and get all of his network resources.

326
00:27:53,700 --> 00:28:02,440
And the way that would work was we wrote a small, simple program which I am not going to release because I think it could be misused.

327
00:28:03,060 --> 00:28:19,850
But if we run this called impersonate and we point at John's running processes, and we'll pick the one for Explorer, 532, it comes up as a success and if you see, it switched over to John now.

328
00:28:20,610 --> 00:28:24,950
One of the quirky things from here though, that if I typed in a command, it would run as system.

329
00:28:24,950 --> 00:28:27,690
The next time I typed in a command, it would run as John.

330
00:28:27,690 --> 00:28:30,970
For some reason on this screen, it would keep switching back and forth.

331
00:28:30,970 --> 00:28:38,370
So to get away from that issue, we'll exit out of the one running as system.

332
00:28:38,370 --> 00:28:41,130
Now we are purely running as John

333
00:28:45,940 --> 00:28:48,640
and now we can see his network drives.

334
00:28:48,780 --> 00:28:53,220
We have full access to all of John's resources on the network.

335
00:28:59,890 --> 00:29:01,570
It shows that it is disconnected.

336
00:29:01,570 --> 00:29:03,190
Let's see if we can get it to reconnect.

337
00:29:03,190 --> 00:29:04,310
There we go.

338
00:29:05,030 --> 00:29:06,230
So they are reconnected.

339
00:29:06,230 --> 00:29:18,090
We also found out if John has access to another system that he is not mapped to, we can actually make mappings to that system and Windows would authenticate us as John to that system.

340
00:29:25,210 --> 00:29:26,750
Now there is one thing I wanted to show you.

341
00:29:26,750 --> 00:29:28,110
There is a couple of other things I wanted to show you.

342
00:29:28,110 --> 00:29:29,470
There is one I wanted to show you.

343
00:29:29,790 --> 00:29:31,770
Just to show you it is true.

344
00:29:32,310 --> 00:29:33,330
There we go.

345
00:29:33,530 --> 00:29:35,050
We can get a full desktop up.

346
00:29:44,770 --> 00:29:47,870
Now if we log in as John, let's go ahead and do that.

347
00:29:48,530 --> 00:29:50,310
Hopefully it won't flake out on me.

348
00:29:52,650 --> 00:29:57,370
It will switch over to his desktop and then we can control-alt-delete and switch back to the other desktop.

349
00:29:57,750 --> 00:29:59,810
So you can see there are multiple desktops.

350
00:30:01,450 --> 00:30:09,390
The one thing we did find out, I did run this against a 2003 server, there doesn't seem to be any resource issues on the Windows logon screen.

351
00:30:09,390 --> 00:30:13,990
So you can run full Explorer desktop from there and run all the applications you want.

352
00:30:14,150 --> 00:30:20,070
I think I had about a dozen up running without any resource issues without ever logging on to the system.

353
00:30:24,140 --> 00:30:26,660
Okay, let me go ahead and shut these down.

354
00:30:26,720 --> 00:30:28,780
There is one other thing I wanted to show you.

355
00:30:31,440 --> 00:30:34,540
This can be used in kind of a different way.

356
00:30:35,500 --> 00:30:37,040
Let's go ahead and log off here.

357
00:30:37,040 --> 00:30:39,000
And we are going to log on as Mary.

358
00:30:40,720 --> 00:30:46,440
Mary's system administrator doesn't like her doing anything so he has her kind of running in restricted mode.

359
00:30:47,340 --> 00:30:56,700
And we thought, you know, if we set this application up to run on the WinLogon desktop, what if we wrote the code to run on the default desktop but executed it from the WinLogon desktop?

360
00:30:56,720 --> 00:31:03,200
Would it spawn a shell on the user's desktop and run it at system level?

361
00:31:13,790 --> 00:31:16,050
So Mary tries to open up the clock.

362
00:31:16,050 --> 00:31:18,670
He comes up and says, you don't have privileges to do that.

363
00:31:18,670 --> 00:31:20,230
So Mary staged the system.

364
00:31:20,230 --> 00:31:21,990
She wants to break out of that.

365
00:31:21,990 --> 00:31:25,170
So she switches over here without logging out.

366
00:31:25,170 --> 00:31:27,370
It just switches to the WinLogon screen.

367
00:31:27,550 --> 00:31:28,570
Windows U.

368
00:31:28,570 --> 00:31:31,690
And she can use the magnifier, which is where she wrote her code.

369
00:31:31,770 --> 00:31:34,850
She can go start, cancel, cancel.

370
00:31:36,530 --> 00:31:40,070
Now she has a command prompt at system level.

371
00:31:42,230 --> 00:31:56,040
She can bring up task manager, kill her Windows Explorer, run another Windows Explorer.

372
00:32:01,660 --> 00:32:03,700
Now she can do what she wants.

373
00:32:18,830 --> 00:32:21,950
So how do I protect myself from this exploit?

374
00:32:21,950 --> 00:32:24,370
Obviously group policies, maybe.

375
00:32:24,990 --> 00:32:28,290
You could remove or disable utility manager.

376
00:32:28,290 --> 00:32:33,150
Just take it off the system, but Bob could probably put it back on there.

377
00:32:34,790 --> 00:32:37,310
Disable booting from CD-ROM.

378
00:32:38,030 --> 00:32:39,390
Disable booting from floppy.

379
00:32:39,390 --> 00:32:40,390
Lock the BIOS.

380
00:32:40,390 --> 00:32:42,210
That would obviously slow him down.

381
00:32:43,590 --> 00:32:49,470
If you're worried about attack against a service system, you can run a host IDS on that system.

382
00:32:49,470 --> 00:32:54,230
That would detect if Bob went into your system and overwrote some of the files.

383
00:32:57,070 --> 00:33:00,430
So how do you prevent backdoor exploits by employees?

384
00:33:00,650 --> 00:33:01,810
Someone like Mary.

385
00:33:04,170 --> 00:33:06,030
Policies, that's always a solution.

386
00:33:06,030 --> 00:33:07,630
If you catch it, you can always fire.

387
00:33:08,570 --> 00:33:10,030
Separation of duties.

388
00:33:10,130 --> 00:33:13,250
Application system verification and testing before deployment.

389
00:33:13,250 --> 00:33:15,850
And the reason why I say that, I want you to think about something.

390
00:33:15,870 --> 00:33:18,970
I don't know how many people in here work for fairly large companies.

391
00:33:19,010 --> 00:33:21,790
Do you have base images of your desktops?

392
00:33:23,090 --> 00:33:24,570
How do you control those?

393
00:33:24,570 --> 00:33:25,510
Where are they at?

394
00:33:25,510 --> 00:33:26,530
Who does it?

395
00:33:26,710 --> 00:33:31,390
Do you have one person that actually builds your base images, sets it all up?

396
00:33:31,430 --> 00:33:33,510
He may keep it on his own hard drive.

397
00:33:33,510 --> 00:33:33,890
I don't know.

398
00:33:33,890 --> 00:33:35,630
He might keep it on a network server.

399
00:33:35,630 --> 00:33:37,590
Do you secure those things?

400
00:33:39,750 --> 00:33:41,090
Separation of duties.

401
00:33:41,850 --> 00:33:47,470
Somebody who sets something up, you don't want them doing the verification and the testing of it, obviously, of course.

402
00:33:47,670 --> 00:33:49,310
These are things you need to consider.

403
00:33:49,310 --> 00:33:52,650
How do you prevent non-employee access?

404
00:33:52,970 --> 00:33:54,750
Bob got into this company.

405
00:33:54,890 --> 00:33:58,590
Who is that maintenance man and what do you really know about the night janitor?

406
00:33:59,190 --> 00:34:02,090
Using social engineering to gain physical access.

407
00:34:02,090 --> 00:34:07,850
Do you do security awareness training to your employees, dealing with people gaining physical access to your company?

408
00:34:08,870 --> 00:34:17,010
Another big one, contractual agreements with contractors and outsourcers, whether it's janitorial or application development.

409
00:34:17,390 --> 00:34:22,890
When I was doing this project, these are the things I started thinking about and started asking these questions at work.

410
00:34:23,450 --> 00:34:25,770
We're real big on application development.

411
00:34:25,770 --> 00:34:28,490
We hire an outsourcer to write code for us.

412
00:34:28,490 --> 00:34:30,850
We don't let him test and verify it for us.

413
00:34:30,950 --> 00:34:33,570
All at once we just put it into the system.

414
00:34:33,570 --> 00:34:34,730
We don't do that.

415
00:34:34,790 --> 00:34:41,550
We have these contractual agreements to protect your company's assets and hold that company liable.

416
00:34:41,610 --> 00:34:52,690
But yet we turn around and hire janitorial service that basically has full access to every office in your building and we have nothing to protect us from them.

417
00:34:54,630 --> 00:34:59,510
Defense in depth is the only effective method to defending your network.

418
00:34:59,950 --> 00:35:03,890
It's a combination of people, processes, and technologies.

419
00:35:03,890 --> 00:35:05,630
They're applied at each layer.

420
00:35:05,630 --> 00:35:11,110
If one layer is compromised, your entire organization is not compromised.

421
00:35:11,670 --> 00:35:21,610
This consists of policies training, physical access, parameter security, internal networks, host, application, and data.

422
00:35:21,710 --> 00:35:23,730
So let's think about this.

423
00:35:25,310 --> 00:35:38,750
If we would have concerned ourselves with physical access or policies and required a background investigation of Bob, we would have found out he was the nephew of our competitor and probably wouldn't have hired him.

424
00:35:40,290 --> 00:35:42,050
Okay, so that breaks down.

425
00:35:42,050 --> 00:35:43,210
That layer fails.

426
00:35:43,210 --> 00:35:44,990
We let Bob through the door.

427
00:35:45,570 --> 00:35:50,230
The next phase is, let's say, the host machines.

428
00:35:50,230 --> 00:36:07,770
If we had set our host machines up so they couldn't be booted from a floppy or booted from a CD, and we had set other restrictions on there with group policies, we would have caught Bob there or at least slowed him down slow enough that we may have caught him.

429
00:36:08,730 --> 00:36:10,350
Defense in depth.

430
00:36:10,890 --> 00:36:13,010
So let's say that layer fails.

431
00:36:13,810 --> 00:36:15,390
Bob gets through.

432
00:36:15,390 --> 00:36:18,530
Bob gets access to a host system.

433
00:36:18,850 --> 00:36:20,630
Bob puts his code on there.

434
00:36:22,230 --> 00:36:27,790
Now, obviously, the stuff he came in there to steal was research and development stuff.

435
00:36:28,250 --> 00:36:30,630
John had access to research and development.

436
00:36:30,630 --> 00:36:39,730
If this was the heart and soul of that company, how come two-factor authentication wasn't required or the data stored in an encrypted manner?

437
00:36:39,850 --> 00:36:43,310
Because if it had been, Bob would have failed.

438
00:36:45,130 --> 00:36:48,510
So this is the concepts of defense in depth.

439
00:36:49,890 --> 00:36:54,550
Combination of people, processes, and technologies applied at each layer.

440
00:36:54,550 --> 00:36:59,230
If one layer is compromised, your organization is not compromised.

441
00:37:02,610 --> 00:37:03,790
Running early.

442
00:37:06,770 --> 00:37:08,870
Questions, and hopefully I can answer them.

443
00:37:08,870 --> 00:37:12,530
If I can't, I've got business cards here.

444
00:37:13,190 --> 00:37:15,470
I've got my email address up there.

445
00:37:15,470 --> 00:37:17,290
Shoot me the question.

446
00:37:17,290 --> 00:37:20,030
I'd be more than glad to try to answer it for you.

447
00:37:20,050 --> 00:37:23,890
And remember, as you're asking these questions, I'm not a coder.

448
00:37:23,890 --> 00:37:28,370
If it's a coding question, send it to me in the email and I will answer it.

449
00:37:28,370 --> 00:37:29,090
In red.

450
00:37:36,270 --> 00:37:38,210
No, I do not believe so.

451
00:37:38,290 --> 00:37:44,630
So, from a remote desktop, you cannot pass that key combination or will not recognize it or run.

452
00:37:45,650 --> 00:37:51,830
The one thing we haven't tested, though, the impersonation function is one of the things I want to test.

453
00:37:51,830 --> 00:37:56,390
What if I was on a Citrix system with multiple users?

454
00:37:56,390 --> 00:38:03,510
We did find out that that function will not work unless the exploiter is running at system level.

455
00:38:03,510 --> 00:38:11,410
But if he's at system level, gain system level on a Citrix box, could he take over the identity of the other users?

456
00:38:11,410 --> 00:38:14,230
This is one of the things we're going to be testing real soon.