WEBVTT 00:25.400 --> 00:27.780 My name is Darryl Highland. 00:27.780 --> 00:30.660 Today's presentation is the Insecure Workstation. 00:31.040 --> 00:34.600 I had a lot of fun putting this together and I hope everyone enjoys it. 00:34.720 --> 00:37.400 The Insecure Workstation, Bob Reloaded. 00:38.540 --> 00:43.500 The information provided in this presentation is for educational purposes only. 00:43.500 --> 00:45.260 Just use good judgment. 00:49.010 --> 00:51.790 Today's presentation has two parts. 00:52.130 --> 00:55.270 Rights escalation used in API call vulnerabilities. 00:55.270 --> 00:58.810 This is kind of an old issue that just won't die. 00:58.990 --> 01:01.030 So I thought it was important just to bring it out. 01:01.030 --> 01:03.350 Maybe we can put it to bed eventually. 01:03.690 --> 01:07.770 The second part of this is subverting Windows logon. 01:08.810 --> 01:12.010 A few key takeaways in today's presentation. 01:12.450 --> 01:15.210 A better understanding of desktop security. 01:15.990 --> 01:18.530 Simple desktop console vulnerabilities. 01:18.910 --> 01:23.690 And protecting information assets with layer defense or defense in depth principles. 01:23.690 --> 01:29.930 And of course, since this is DEF CON, subverting desktop security for fun and entertainment. 01:33.040 --> 01:36.820 What is a help API vulnerability? 01:37.420 --> 01:44.600 It's a vulnerability that is exposed when an application running with system level rights makes an API call to the help viewer. 01:44.600 --> 01:49.680 And does not drop any of those privileges before invoking that help viewer. 01:49.680 --> 01:57.160 A user then, using the help viewer, can access other applications which will execute at system level, of course. 01:57.600 --> 02:03.240 And as you can see with the bug track on this, 2003, this is nearly two years old. 02:03.460 --> 02:05.420 So why is it still an issue? 02:07.140 --> 02:10.320 The other question is, how widespread is this vulnerability? 02:11.000 --> 02:14.780 To tell the truth, I'm really not sure how widespread this is. 02:15.240 --> 02:16.860 But I do know one thing. 02:16.860 --> 02:26.560 Over the last eight months, I've discovered one application during product testing that still had the help API vulnerability on it. 02:27.580 --> 02:35.800 Two, I found another vulnerable application running on my company's network that had never been reported yet. 02:35.920 --> 02:45.680 And third, I actually found an application that had been reported in bug track, but it was running on someone else's network unpatched. 02:45.680 --> 02:50.400 So this is a reality, and this is an extremely simple vulnerability. 02:51.240 --> 02:53.760 Now, why do vendors continue down this path? 02:53.760 --> 02:55.680 Of course, the issue is money. 02:55.960 --> 02:58.360 They want to beat the competitors to market. 02:58.360 --> 03:04.180 They're cutting corners and not properly security testing their applications prior to going to market. 03:04.700 --> 03:08.420 Vendors also may presume that users are not abusing their products. 03:08.780 --> 03:11.600 Obviously, they've never been to DEF CON. 03:13.160 --> 03:16.940 Sell first, fix later, make you pay for it. 03:17.400 --> 03:29.140 I don't know about you, but when I get to go back and patch 20,000 systems because of some lame vulnerability that should have never been in the product when it went to market, I'm upset. 03:31.700 --> 03:33.880 Now for a quick demonstration. 03:42.450 --> 03:47.190 The first one on this list, Spy Sweeper, anti-spyware enterprise version. 03:47.190 --> 03:49.370 This was version 1.5. 03:49.950 --> 03:56.110 Since I discovered this, the vendor did release version, I believe, 2.0 that fixed the vulnerability. 03:56.750 --> 04:00.930 But of course, how many people are running 1.5 out there? 04:01.150 --> 04:03.790 So let's take a quick look at how simple this is. 04:13.620 --> 04:19.340 A user just needs to open up the standard Spy Sweeper GUI. 04:25.600 --> 04:27.860 Launch the Help, the Help Viewer. 04:29.360 --> 04:34.160 Within Help Viewer, there's many paths that he can take, but we'll take the simplest one. 04:49.020 --> 04:52.120 Now let's take a look at Task Manager to see how this is running. 04:58.720 --> 05:06.500 So if we look at Task Manager and look at Spy Sweeper, the main application, we can see it's running at system level. 05:08.280 --> 05:14.420 Obviously, when the viewers kicked off, it's running at system level also. 05:15.600 --> 05:21.540 And of course, since we spawned Command-DXE from there, it's running at system level. 05:22.060 --> 05:27.220 This is basically a textbook Help API vulnerability to the T. 05:31.040 --> 05:35.760 So after I found this during product testing, we didn't buy the product. 05:41.450 --> 05:48.710 I started looking at our network and taking a look at Novell's NetWare XenWorks Remote Desktop. 05:48.710 --> 05:52.050 It puts a little icon in the lower right-hand corner of your screen. 05:52.910 --> 05:54.290 Right here it is. 05:54.290 --> 05:58.730 I'm not going to run it because it's a textbook Help API vulnerability. 05:58.730 --> 06:03.290 I contacted NetWare and they quickly released a patch. 06:03.390 --> 06:08.230 But of course, how many people are running the unsecured version of it out there? 06:08.730 --> 06:11.930 The third one in here, McAfee AV4051. 06:12.370 --> 06:20.390 As you can see, the bug track was actually reported on this in September 15, 2004. 06:20.390 --> 06:23.550 And McAfee quickly released a fix for this. 06:23.550 --> 06:29.150 It's a fairly old version, but you run into many companies, you typically run older versions. 06:29.150 --> 06:33.250 You can't afford to constantly upgrade every time the vendor comes out with something. 06:33.390 --> 06:34.710 This one is a little different. 06:34.710 --> 06:35.610 I want to show it to you. 06:35.610 --> 06:40.530 Because it doesn't have the Help API vulnerability, that was actually fixed in it. 06:56.010 --> 06:59.270 If you go to the Help viewer from here, it's going to be fine. 06:59.270 --> 07:05.470 But, interesting thing about this product, I was actually taking a security class. 07:05.810 --> 07:07.450 A security class. 07:07.470 --> 07:11.010 And in the class, at lunch time, I decided to have a little fun. 07:11.010 --> 07:16.110 So I started playing around with their desktop systems in the security class. 07:16.770 --> 07:20.530 And I found this vulnerability. 07:20.530 --> 07:23.590 Of course, it had already been reported, but I didn't know it. 07:23.590 --> 07:27.830 How many of us are capable of reading all bug tracks and remembering them all? 07:27.830 --> 07:33.810 So, if you drill down in this thing and go to... 07:43.250 --> 07:48.310 If we go to Reports, we get a nice little browser button. 07:48.350 --> 07:49.610 These are always fun. 08:04.820 --> 08:06.540 Of course, right click on it. 08:09.920 --> 08:11.880 Go open, and there it is. 08:12.100 --> 08:15.660 Now, if we look at Task Manager, this is going to be running at system level also. 08:29.560 --> 08:32.020 So, how do you tell if your systems are vulnerable? 08:32.020 --> 08:34.420 Just like I did there, just take a look at them. 08:34.760 --> 08:41.800 Look at Task Manager, take a close look at all the services running in Task Manager with system level. 08:41.820 --> 08:44.980 Do any of those interact with the desktop? 08:44.980 --> 08:50.440 If they interact with the desktop, there is always a possibility that a vulnerability could exist in there. 08:50.440 --> 08:51.640 Take a close look. 08:51.640 --> 08:54.200 What icons are running in the system tray? 08:54.200 --> 08:58.020 Do they launch applications that are running at system level also? 08:58.020 --> 09:03.220 And of course, what applications need higher rights to function properly? 09:03.840 --> 09:13.880 Antivirus, antispyware, remote management tools, auditing tools or auditing applications may need to run at higher rights. 09:13.880 --> 09:16.700 So, scrutinize those applications a little closer. 09:17.480 --> 09:20.980 How do I protect myself from help API vulnerability? 09:20.980 --> 09:22.420 Group policies. 09:22.700 --> 09:27.540 If you sat through my presentation last year, you may not think group policies is a good solution. 09:27.540 --> 09:34.820 But I think it works in this scenario right here and has features that you can use to shut down some of these holes. 09:34.840 --> 09:36.860 Remove the icon from the system tray. 09:36.860 --> 09:44.840 A lot of these applications have the ability to go ahead and remove the icons from the system tray so the viewer can't do it. 09:44.840 --> 09:47.620 Also, a lot of those features can be locked down. 09:47.620 --> 09:56.460 If you install your applications right out of the box, a lot of times that's how these vulnerabilities get brought into your systems. 09:57.780 --> 10:00.320 And of course, testing all new applications. 10:00.320 --> 10:04.840 You need to go out there, look at all your applications and test them before you deploy them. 10:04.840 --> 10:07.980 Better yet, test them before you purchase them. 10:08.620 --> 10:12.340 Save yourself some money and headache because you're going to have to go back and patch them. 10:14.940 --> 10:17.260 Okay, let's have a little bit of fun now. 10:17.260 --> 10:20.180 This year's project, subverting Windows logon. 10:24.270 --> 10:26.870 This year's research project and what we learned. 10:26.870 --> 10:32.290 I'd like to give credit to some friends of mine that played a big part in helping me with this. 10:32.290 --> 10:34.850 They did some of the coding, helped me with the coding. 10:34.850 --> 10:35.890 I'm not a coder. 10:35.890 --> 10:38.730 I'm in the process of trying to learn it, but I'm not a coder. 10:38.750 --> 10:42.730 So they assisted me in this part here, as part of this project, in their research. 10:42.730 --> 10:44.430 I'd like to give them credit for that. 10:44.750 --> 10:47.150 Three rules that drove this research project. 10:47.150 --> 10:48.770 It must be simple. 10:48.850 --> 10:51.270 I like simple exploits. 10:51.730 --> 10:52.570 Simple hacks. 10:52.570 --> 10:56.510 I like something I could actually go teach my grandmother how to do and she would understand it. 10:57.950 --> 11:00.690 It needs to fit in my pocket, if not in my head. 11:00.690 --> 11:07.070 I like things that, you know, it'll easily fit in a CD or a USB, if not fit in my head. 11:07.070 --> 11:17.110 There's nothing worse than trying to do a proof of concept that somebody's came out with when you've got to put in a 400 megabyte footprint onto a box to actually make it work. 11:19.970 --> 11:22.890 And last, it must be easy to protect against. 11:22.890 --> 11:31.970 If I'm going to go through this trouble to figure out these exploits and these issues and teach people, I want to be able to teach them how to protect themselves also. 11:31.970 --> 11:33.430 That's very important to me. 11:34.310 --> 11:35.870 So let's get started. 11:37.790 --> 11:39.810 Can Windows login be subverted? 11:40.090 --> 11:41.210 Yes, it can. 11:41.210 --> 11:42.150 You'll see. 11:42.650 --> 11:43.410 Curiosity? 11:43.410 --> 11:44.890 Just because it's there? 11:44.890 --> 11:46.770 No, I didn't do this just for curiosity. 11:46.770 --> 11:54.590 Of course, I did it to get a better understanding of the security vulnerabilities that exist in the company's environment where I work and be able to protect them. 11:54.590 --> 11:56.250 That's what I'm being paid to do. 11:57.030 --> 11:58.010 Where? 11:58.010 --> 12:01.830 On XP, Windows 2003, this is where we've tested this at. 12:01.830 --> 12:09.410 Of course, it's so simplistic, as you'll see, it'll easily be carried out on a Windows NT or a 2000 box. 12:09.810 --> 12:10.790 When? 12:10.790 --> 12:12.670 Bob is back on the job. 12:12.730 --> 12:16.730 If anyone's seen my presentation last year, I introduced Bob as a character. 12:16.730 --> 12:27.890 Bob works for his uncle, and he is a hacker, and he likes to subvert desktop security for fun and entertainment and torment his sysadmin in the process. 12:28.850 --> 12:30.350 Now you ask how. 12:30.350 --> 12:33.370 Well, this exploit has two pieces. 12:33.370 --> 12:36.930 There's a methodology, the attack process behind it. 12:36.930 --> 12:47.590 And a programmatic attack, a simple program that we're going to use and deploy onto a system that gives us the ability to bypass the Windows logon. 12:47.850 --> 12:54.290 Neither one of them can do anything by themselves, but when we bring these two concepts together, we accomplish this goal. 12:55.630 --> 12:56.950 Okay, let's start. 12:56.950 --> 13:00.010 Exploit Part 1, Utility Manager. 13:00.150 --> 13:02.150 What is Utility Manager? 13:02.150 --> 13:06.110 Well, let's take a close look at what Windows has to say about Utility Manager. 13:10.940 --> 13:18.880 Utility Manager enables users to check an accessibility program status and start or stop an accessibility program. 13:18.880 --> 13:24.800 So basically, Utility Manager is an application that you can use to start and stop other applications. 13:25.780 --> 13:26.920 Let's read a little more. 13:28.080 --> 13:33.160 Users can also start accessibility programs before logging onto the computer. 13:33.980 --> 13:39.260 By pressing the Windows logo key and the plus at the welcome screen. 13:39.320 --> 13:48.960 So basically, Utility Manager is an application that I can use to start and stop other applications before I ever log onto the system. 13:53.790 --> 13:56.550 How does it work and how do we access it? 13:56.970 --> 14:04.090 Well, what Windows help said, you hold down the Windows logo key and you hit the U key and up comes Utility Manager. 14:04.090 --> 14:08.550 From within there, you can start and stop accessibility programs. 14:12.090 --> 14:13.490 There you go. 14:13.630 --> 14:14.810 Pretty simple. 14:19.660 --> 14:21.660 Why is it such a problem? 14:22.360 --> 14:27.800 Well, obviously, as I mentioned, a user can start and stop applications before he ever logs on. 14:27.880 --> 14:35.240 Once you are logged on and you use the accessibility program, it runs under your user ID and runs under your credentials. 14:35.240 --> 14:36.440 Not an issue. 14:36.440 --> 14:40.880 But, if you are not logged on to the system, it runs as local system. 14:41.000 --> 14:48.840 So, we can start and stop applications prior to ever logging on to Windows and we can get them to run at local system level rights. 14:53.740 --> 15:12.700 So, when we started this, we thought, okay, well, does that mean if I can take example, let's say, command.exe, cmd.exe, and rename it osk.exe, which is the on-screen keyboard, would Windows let me launch this or would it give me an error? 15:12.700 --> 15:15.720 Would it give me a security error to prevent me from running it? 15:15.720 --> 15:27.920 So, we went ahead and we overwrote the osk.exe and we executed it and at first, before we logged on, and nothing seemed to happen. 15:27.920 --> 15:35.720 Well, further investigation, we found out that it did execute with no errors, but it was running in a non-interactive mode. 15:35.720 --> 15:36.980 It was in the background. 15:36.980 --> 15:39.080 We did not have access to it. 15:39.080 --> 15:48.100 But, if you could hold some questions to the end, because we're going to be really tight to get through this presentation, I apologize. 15:48.320 --> 15:57.180 And if I can't answer them at the end because we don't have time, we'll take it offline and I will try to answer your questions and if I don't have the answers, I will try to get those answers for you. 15:57.180 --> 15:58.040 How's that sound? 16:00.020 --> 16:09.360 So, we went ahead and did that and it didn't seem to work, but when we looked at it, we found out it was running at system level, but in the background in a non-interactive mode. 16:09.360 --> 16:14.120 So, over the next couple of slides, we'll explain what we did. 16:15.620 --> 16:18.500 Exploit part two, the log on screen. 16:18.680 --> 16:24.080 User interface objects are managed using Windows stations and desktops. 16:24.520 --> 16:29.080 Windows stations come in two flavors, interactive and non-interactive. 16:29.100 --> 16:35.550 The only interactive Windows station that can be defined in an application is when stay zero. 16:36.330 --> 16:41.410 Also, Windows has what's known as multiple desktops. 16:41.590 --> 16:48.110 The default desktop is the desktop after you log in where you do your work on a day-to-day basis on a Windows system. 16:48.530 --> 16:52.410 The screen saver is also defined as a separate desktop. 16:52.570 --> 16:55.350 Haven't really played with that yet, but we probably will. 16:55.790 --> 17:00.790 The win log on screen also is a completely separate functioning desktop. 17:00.790 --> 17:16.990 So, basically what we decided we needed to do, we need to get the program that we replaced the OSK EXE with, we need to get it to launch interactive mode and we need to get it to launch interactive mode on the win log on desktop. 17:17.390 --> 17:27.390 So, basically we put together a simple program that would spawn command EXE under win stay zero win log on desktop. 17:27.830 --> 17:29.510 So, let's move in that direction. 17:30.570 --> 17:32.850 Exploit part three of the code. 17:33.170 --> 17:37.270 This code we put together poses no security issues by itself. 17:37.510 --> 17:42.610 Basically, we're just setting the create process thread to run under the win log on desktop. 17:43.770 --> 17:46.030 The security breakdown is how we use it. 17:46.030 --> 17:47.330 It's the methodology. 17:47.330 --> 17:54.190 Basically, we've discovered an architectural issue with the way utility managers run on the system. 17:54.330 --> 17:59.530 And the ability to run it prior to ever logging on and get it to launch at system level. 18:00.490 --> 18:02.110 And the code is extremely simple. 18:02.110 --> 18:04.290 So, let's look at the entire code. 18:05.490 --> 18:06.670 That's it. 18:09.930 --> 18:24.410 And as you can see, if you go down through there, right above where it says create process, see Windows system 32, right above that line, is where we define the win stay zero, the interactive desktop, and the win log on as the desktop that we want to run this at. 18:25.870 --> 18:32.850 If you go out and look at, I know there's plenty of coders in the room, I mean this is just a simple code snippet. 18:33.930 --> 18:36.570 I've seen this in a hundred different applications. 18:36.670 --> 18:42.750 The only thing is we're different is most of the applications I've seen define default instead of win log on. 18:42.750 --> 18:44.630 That's the only thing different with this code. 18:46.770 --> 18:50.370 So, we come to the final part of this, the delivery. 18:51.030 --> 18:57.730 Now, when I first started this project and we got around to this point, I said, oh my gosh, how am I going to deliver this code to the system? 18:57.810 --> 19:00.290 This has to be the most difficult part. 19:00.490 --> 19:04.490 Well, it turned out to be the most trivial part. 19:04.490 --> 19:08.810 And we're going to cover some high level concepts here. 19:09.130 --> 19:11.810 Admin access, well you can overwrite it with admin access. 19:11.810 --> 19:13.970 That's when we did our first test we did that. 19:14.030 --> 19:18.350 But we already have admin access to the system, so that really accomplishes nothing. 19:18.670 --> 19:22.950 We can use some of the help API vulnerabilities I showed you to overwrite the file. 19:22.950 --> 19:26.910 But, you know, if I'm already system level and logged in, you know, what's the point? 19:27.870 --> 19:30.330 Bit level modification of the hard drive. 19:30.330 --> 19:42.670 We actually took a DOS boot disk and some old DOS utilities and identified the track sector where OSK was and overwrite the first part of the application and got that to work. 19:43.190 --> 19:49.130 But somewhat complex and it goes against my theory moving forward of keeping it simple. 19:49.550 --> 19:52.650 The one thing is maintenance boot disk. 19:52.970 --> 19:55.530 This is a fairly broad category. 19:56.990 --> 20:00.210 Linux is a possible solution moving forward. 20:00.330 --> 20:04.310 There's a lot of work going on in writing to NTFS file systems. 20:05.490 --> 20:13.050 Another solution, an attacker could actually have a stolen or pirated copy of Windows PE. 20:13.050 --> 20:16.610 Windows pre-installation disk is a possible solution. 20:17.030 --> 20:26.770 But also, if you go out and Google, you'll find out there are other PE or pre-installation available. 20:26.770 --> 20:29.250 Which is basically an open source solution. 20:29.870 --> 20:31.210 Maintenance disk type things. 20:31.210 --> 20:35.030 And I did find a couple other solutions out there that look very viable. 20:35.190 --> 20:37.770 So I'm going to say just kind of pick your own poison. 20:37.770 --> 20:38.870 Go out to Google. 20:38.870 --> 20:40.930 Google for writing NTFS. 20:40.930 --> 20:44.050 Google Linux NTFS. 20:44.050 --> 20:47.290 Google Windows PE or pre-installation. 20:47.290 --> 20:49.770 And you will find a multiple of solutions. 20:50.270 --> 20:52.370 I sat down to try to figure this thing out. 20:52.370 --> 20:54.290 I said, well, there's no sense in re-venting the wheel. 20:54.290 --> 20:57.990 Let me go out on Google and see if anyone's already doing this. 20:58.250 --> 21:01.890 Well, I searched for maintenance disk, maintenance boot disk. 21:02.650 --> 21:07.190 And probably within 15 minutes I had a bunch of solutions. 21:07.190 --> 21:08.730 I downloaded a couple of them. 21:08.730 --> 21:11.350 Within an hour I had a fully functional solution. 21:11.950 --> 21:14.910 So this is a no-brainer here. 21:15.430 --> 21:17.930 So we're going to move on a little further from here. 21:18.490 --> 21:20.390 Okay, Bob reloaded. 21:20.390 --> 21:25.210 So now we're going to go ahead and look at this actual exploit and see how it works. 21:35.450 --> 21:37.330 A little history on Bob. 21:37.330 --> 21:41.890 As I mentioned, Bob works for his uncle. 21:41.890 --> 21:43.810 And he is a hacker. 21:43.810 --> 21:45.870 And he likes to subvert security. 21:45.970 --> 21:51.110 Well, it turns out Bob's uncle has a competitor against his company. 21:51.630 --> 21:57.630 And his competitor is getting ready to release some new products out there. 21:57.630 --> 21:59.910 And Bob's uncle thinks, you know what? 21:59.950 --> 22:03.990 It would be really good if I could steal that information off him. 22:04.310 --> 22:08.970 So what he does is he gets Bob and the competitor happens to be looking for a janitor. 22:08.970 --> 22:13.630 So they send Bob down there to apply for this janitorial job. 22:13.630 --> 22:16.030 And Bob gets the janitorial job. 22:16.230 --> 22:18.770 So Bob shows up to work the first night. 22:19.210 --> 22:21.270 And he brings his cleaning tools. 22:25.340 --> 22:29.560 Just to let you know, I did pre-stage the exploit on here. 22:29.560 --> 22:33.060 Because the disk would obviously whirl for three minutes. 22:33.060 --> 22:35.020 And you would just see a black screen. 22:35.020 --> 22:36.680 So you really accomplished nothing. 22:36.680 --> 22:41.960 If anyone actually wants to see me own a system that hasn't been owned yet, just get with me after this. 22:41.960 --> 22:44.640 And I will run the disk through there so you can see it happen. 22:47.020 --> 22:49.780 So Bob goes through and he scopes out all the offices. 22:49.780 --> 22:50.920 And he finds an office. 22:50.920 --> 22:53.680 He finds John's office, as a matter of fact. 22:54.420 --> 22:57.000 And what he does is he throws his disk in. 22:57.000 --> 22:58.260 He boots John's system. 22:58.260 --> 22:59.820 It spins for a few minutes. 22:59.840 --> 23:02.480 And he pulls the disk out and he reboots it. 23:02.480 --> 23:03.880 And he goes about his way. 23:03.880 --> 23:06.020 The next day, John comes in. 23:06.500 --> 23:08.420 He logs on to the computer. 23:08.420 --> 23:10.760 And of course, he's not going to see anything there. 23:10.760 --> 23:13.480 Because he doesn't know about Utility Manager. 23:13.480 --> 23:15.400 He doesn't use Utility Manager. 23:15.400 --> 23:17.520 There's no applications running in memory. 23:17.520 --> 23:20.360 They have to be executed from somebody at the console. 23:21.060 --> 23:23.280 So there's nothing to be detected there. 23:24.380 --> 23:26.080 So John comes in. 23:26.080 --> 23:27.500 Of course, he logs in. 23:27.540 --> 23:29.420 He does his thing that day. 23:29.620 --> 23:33.380 And when John's finished, what he does is he does what a lot of us do. 23:33.380 --> 23:35.520 He doesn't log out. 23:35.520 --> 23:38.560 He locks his screen and he goes his merry way. 23:38.560 --> 23:41.960 Or he lets his screensaver kick on, which locks his screen. 23:42.600 --> 23:45.940 So about 9 o'clock, Bob comes rolling. 23:45.940 --> 23:47.560 And let's see what Bob's going to do. 23:56.380 --> 23:58.840 Of course, the system's already been staged. 23:58.840 --> 24:00.820 So set up by Bob. 24:00.820 --> 24:01.860 So Bob comes in. 24:01.860 --> 24:03.580 He goes to Utility Manager. 24:03.980 --> 24:05.780 He brings up Utility Manager. 24:05.780 --> 24:08.440 He goes to the on-screen keyboard. 24:09.020 --> 24:10.620 And he launches it. 24:30.780 --> 24:33.200 After we did this, we started playing around with this. 24:33.200 --> 24:41.500 And the reason why I'm just running a command.exe versus the entire desktop is we found out the resources on the WinLogin desktop are limited. 24:41.800 --> 24:47.560 If you get Explorer up, which is a real hog, the thing will start flaking out and applications won't run properly. 24:47.580 --> 24:50.980 But from here, Bob can pretty much do what he wants. 24:52.440 --> 24:57.700 One of the good things to run is Task Manager. 24:58.620 --> 25:02.860 From Task Manager, you can pretty much stop and start processes. 25:02.860 --> 25:07.500 As a matter of fact, you can see John's processes in there. 25:08.040 --> 25:09.980 And we're running at system level. 25:17.220 --> 25:19.900 Bob could go ahead and several things he could do. 25:19.900 --> 25:21.420 He could use his USB. 25:27.170 --> 25:29.110 Make his job easier. 25:39.430 --> 25:44.050 He could just dump the hashes out, take them offline, and crack the passwords on the system if he wanted to. 25:44.050 --> 25:45.170 That's not a problem. 25:52.010 --> 26:05.110 Another thing Bob could do, and I've had a lot of success testing it, he could take a small memory tool like TinyHexer, run this against all the running processes. 26:05.110 --> 26:12.490 Scan all the running processes for the words password, passwd, pwd. 26:12.490 --> 26:26.090 And I successfully and many times have been able to strip the user's password plain text out of the running processes memory on many occasions for multiple applications. 26:26.090 --> 26:32.230 Specifically if the application requires authentication and it's written in Java. 26:36.330 --> 26:43.950 Now at this point, the reality is that he's trying to steal stuff from this company. 26:43.950 --> 26:48.710 The chances are that information is probably not going to be on this local computer. 26:48.850 --> 26:51.050 He's going to want to go to the network. 26:52.790 --> 26:57.810 So if he looks to see what drives are mapped, he can see there's nothing mapped. 27:01.300 --> 27:03.080 But if we run netstat... 27:04.100 --> 27:05.380 Oh, that stinks. 27:05.380 --> 27:06.160 Okay. 27:07.100 --> 27:09.380 He can see that there's no mapped drives. 27:09.540 --> 27:13.380 Apparently disconnected, but we can probably get that connected up and then we'll see. 27:14.240 --> 27:23.160 We found out that since we were running in a completely separate desktop, running at system level, we're not John. 27:23.160 --> 27:28.200 We don't have John's network resources and can't get to him, we found out. 27:28.700 --> 27:37.120 So me and my friends started talking about this and what was the possibility of getting the user, John's security token. 27:38.220 --> 27:51.540 So we did some research on this and using standard Windows API calls, we devised a way that we could actually impersonate John and get all of his network resources. 27:53.700 --> 28:02.440 And the way that would work was we wrote a small, simple program which I am not going to release because I think it could be misused. 28:03.060 --> 28:19.850 But if we run this called impersonate and we point at John's running processes, and we'll pick the one for Explorer, 532, it comes up as a success and if you see, it switched over to John now. 28:20.610 --> 28:24.950 One of the quirky things from here though, that if I typed in a command, it would run as system. 28:24.950 --> 28:27.690 The next time I typed in a command, it would run as John. 28:27.690 --> 28:30.970 For some reason on this screen, it would keep switching back and forth. 28:30.970 --> 28:38.370 So to get away from that issue, we'll exit out of the one running as system. 28:38.370 --> 28:41.130 Now we are purely running as John 28:45.940 --> 28:48.640 and now we can see his network drives. 28:48.780 --> 28:53.220 We have full access to all of John's resources on the network. 28:59.890 --> 29:01.570 It shows that it is disconnected. 29:01.570 --> 29:03.190 Let's see if we can get it to reconnect. 29:03.190 --> 29:04.310 There we go. 29:05.030 --> 29:06.230 So they are reconnected. 29:06.230 --> 29:18.090 We also found out if John has access to another system that he is not mapped to, we can actually make mappings to that system and Windows would authenticate us as John to that system. 29:25.210 --> 29:26.750 Now there is one thing I wanted to show you. 29:26.750 --> 29:28.110 There is a couple of other things I wanted to show you. 29:28.110 --> 29:29.470 There is one I wanted to show you. 29:29.790 --> 29:31.770 Just to show you it is true. 29:32.310 --> 29:33.330 There we go. 29:33.530 --> 29:35.050 We can get a full desktop up. 29:44.770 --> 29:47.870 Now if we log in as John, let's go ahead and do that. 29:48.530 --> 29:50.310 Hopefully it won't flake out on me. 29:52.650 --> 29:57.370 It will switch over to his desktop and then we can control-alt-delete and switch back to the other desktop. 29:57.750 --> 29:59.810 So you can see there are multiple desktops. 30:01.450 --> 30:09.390 The one thing we did find out, I did run this against a 2003 server, there doesn't seem to be any resource issues on the Windows logon screen. 30:09.390 --> 30:13.990 So you can run full Explorer desktop from there and run all the applications you want. 30:14.150 --> 30:20.070 I think I had about a dozen up running without any resource issues without ever logging on to the system. 30:24.140 --> 30:26.660 Okay, let me go ahead and shut these down. 30:26.720 --> 30:28.780 There is one other thing I wanted to show you. 30:31.440 --> 30:34.540 This can be used in kind of a different way. 30:35.500 --> 30:37.040 Let's go ahead and log off here. 30:37.040 --> 30:39.000 And we are going to log on as Mary. 30:40.720 --> 30:46.440 Mary's system administrator doesn't like her doing anything so he has her kind of running in restricted mode. 30:47.340 --> 30:56.700 And we thought, you know, if we set this application up to run on the WinLogon desktop, what if we wrote the code to run on the default desktop but executed it from the WinLogon desktop? 30:56.720 --> 31:03.200 Would it spawn a shell on the user's desktop and run it at system level? 31:13.790 --> 31:16.050 So Mary tries to open up the clock. 31:16.050 --> 31:18.670 He comes up and says, you don't have privileges to do that. 31:18.670 --> 31:20.230 So Mary staged the system. 31:20.230 --> 31:21.990 She wants to break out of that. 31:21.990 --> 31:25.170 So she switches over here without logging out. 31:25.170 --> 31:27.370 It just switches to the WinLogon screen. 31:27.550 --> 31:28.570 Windows U. 31:28.570 --> 31:31.690 And she can use the magnifier, which is where she wrote her code. 31:31.770 --> 31:34.850 She can go start, cancel, cancel. 31:36.530 --> 31:40.070 Now she has a command prompt at system level. 31:42.230 --> 31:56.040 She can bring up task manager, kill her Windows Explorer, run another Windows Explorer. 32:01.660 --> 32:03.700 Now she can do what she wants. 32:18.830 --> 32:21.950 So how do I protect myself from this exploit? 32:21.950 --> 32:24.370 Obviously group policies, maybe. 32:24.990 --> 32:28.290 You could remove or disable utility manager. 32:28.290 --> 32:33.150 Just take it off the system, but Bob could probably put it back on there. 32:34.790 --> 32:37.310 Disable booting from CD-ROM. 32:38.030 --> 32:39.390 Disable booting from floppy. 32:39.390 --> 32:40.390 Lock the BIOS. 32:40.390 --> 32:42.210 That would obviously slow him down. 32:43.590 --> 32:49.470 If you're worried about attack against a service system, you can run a host IDS on that system. 32:49.470 --> 32:54.230 That would detect if Bob went into your system and overwrote some of the files. 32:57.070 --> 33:00.430 So how do you prevent backdoor exploits by employees? 33:00.650 --> 33:01.810 Someone like Mary. 33:04.170 --> 33:06.030 Policies, that's always a solution. 33:06.030 --> 33:07.630 If you catch it, you can always fire. 33:08.570 --> 33:10.030 Separation of duties. 33:10.130 --> 33:13.250 Application system verification and testing before deployment. 33:13.250 --> 33:15.850 And the reason why I say that, I want you to think about something. 33:15.870 --> 33:18.970 I don't know how many people in here work for fairly large companies. 33:19.010 --> 33:21.790 Do you have base images of your desktops? 33:23.090 --> 33:24.570 How do you control those? 33:24.570 --> 33:25.510 Where are they at? 33:25.510 --> 33:26.530 Who does it? 33:26.710 --> 33:31.390 Do you have one person that actually builds your base images, sets it all up? 33:31.430 --> 33:33.510 He may keep it on his own hard drive. 33:33.510 --> 33:33.890 I don't know. 33:33.890 --> 33:35.630 He might keep it on a network server. 33:35.630 --> 33:37.590 Do you secure those things? 33:39.750 --> 33:41.090 Separation of duties. 33:41.850 --> 33:47.470 Somebody who sets something up, you don't want them doing the verification and the testing of it, obviously, of course. 33:47.670 --> 33:49.310 These are things you need to consider. 33:49.310 --> 33:52.650 How do you prevent non-employee access? 33:52.970 --> 33:54.750 Bob got into this company. 33:54.890 --> 33:58.590 Who is that maintenance man and what do you really know about the night janitor? 33:59.190 --> 34:02.090 Using social engineering to gain physical access. 34:02.090 --> 34:07.850 Do you do security awareness training to your employees, dealing with people gaining physical access to your company? 34:08.870 --> 34:17.010 Another big one, contractual agreements with contractors and outsourcers, whether it's janitorial or application development. 34:17.390 --> 34:22.890 When I was doing this project, these are the things I started thinking about and started asking these questions at work. 34:23.450 --> 34:25.770 We're real big on application development. 34:25.770 --> 34:28.490 We hire an outsourcer to write code for us. 34:28.490 --> 34:30.850 We don't let him test and verify it for us. 34:30.950 --> 34:33.570 All at once we just put it into the system. 34:33.570 --> 34:34.730 We don't do that. 34:34.790 --> 34:41.550 We have these contractual agreements to protect your company's assets and hold that company liable. 34:41.610 --> 34:52.690 But yet we turn around and hire janitorial service that basically has full access to every office in your building and we have nothing to protect us from them. 34:54.630 --> 34:59.510 Defense in depth is the only effective method to defending your network. 34:59.950 --> 35:03.890 It's a combination of people, processes, and technologies. 35:03.890 --> 35:05.630 They're applied at each layer. 35:05.630 --> 35:11.110 If one layer is compromised, your entire organization is not compromised. 35:11.670 --> 35:21.610 This consists of policies training, physical access, parameter security, internal networks, host, application, and data. 35:21.710 --> 35:23.730 So let's think about this. 35:25.310 --> 35:38.750 If we would have concerned ourselves with physical access or policies and required a background investigation of Bob, we would have found out he was the nephew of our competitor and probably wouldn't have hired him. 35:40.290 --> 35:42.050 Okay, so that breaks down. 35:42.050 --> 35:43.210 That layer fails. 35:43.210 --> 35:44.990 We let Bob through the door. 35:45.570 --> 35:50.230 The next phase is, let's say, the host machines. 35:50.230 --> 36:07.770 If we had set our host machines up so they couldn't be booted from a floppy or booted from a CD, and we had set other restrictions on there with group policies, we would have caught Bob there or at least slowed him down slow enough that we may have caught him. 36:08.730 --> 36:10.350 Defense in depth. 36:10.890 --> 36:13.010 So let's say that layer fails. 36:13.810 --> 36:15.390 Bob gets through. 36:15.390 --> 36:18.530 Bob gets access to a host system. 36:18.850 --> 36:20.630 Bob puts his code on there. 36:22.230 --> 36:27.790 Now, obviously, the stuff he came in there to steal was research and development stuff. 36:28.250 --> 36:30.630 John had access to research and development. 36:30.630 --> 36:39.730 If this was the heart and soul of that company, how come two-factor authentication wasn't required or the data stored in an encrypted manner? 36:39.850 --> 36:43.310 Because if it had been, Bob would have failed. 36:45.130 --> 36:48.510 So this is the concepts of defense in depth. 36:49.890 --> 36:54.550 Combination of people, processes, and technologies applied at each layer. 36:54.550 --> 36:59.230 If one layer is compromised, your organization is not compromised. 37:02.610 --> 37:03.790 Running early. 37:06.770 --> 37:08.870 Questions, and hopefully I can answer them. 37:08.870 --> 37:12.530 If I can't, I've got business cards here. 37:13.190 --> 37:15.470 I've got my email address up there. 37:15.470 --> 37:17.290 Shoot me the question. 37:17.290 --> 37:20.030 I'd be more than glad to try to answer it for you. 37:20.050 --> 37:23.890 And remember, as you're asking these questions, I'm not a coder. 37:23.890 --> 37:28.370 If it's a coding question, send it to me in the email and I will answer it. 37:28.370 --> 37:29.090 In red. 37:36.270 --> 37:38.210 No, I do not believe so. 37:38.290 --> 37:44.630 So, from a remote desktop, you cannot pass that key combination or will not recognize it or run. 37:45.650 --> 37:51.830 The one thing we haven't tested, though, the impersonation function is one of the things I want to test. 37:51.830 --> 37:56.390 What if I was on a Citrix system with multiple users? 37:56.390 --> 38:03.510 We did find out that that function will not work unless the exploiter is running at system level. 38:03.510 --> 38:11.410 But if he's at system level, gain system level on a Citrix box, could he take over the identity of the other users? 38:11.410 --> 38:14.230 This is one of the things we're going to be testing real soon.