start	end	text
34240	36200	Okay, we're streaming.
37780	41620	Everyone, welcome back to, I guess, the very first talk of...
41620	43020	Okay, we're streaming.
45610	52370	...speakers. This is the How to Hack Windows Machines with Printing Protocols.
52370	54910	I forgot the most important part of that, right? Evil Printer.
54950	57830	How to Hack Windows Machines with Printing Protocols.
57830	62610	Would you guys mind introducing yourselves, since I've already said that it's really late where y'all are at?
62610	67530	Okay, so we are speakers from Beijing, China.
67530	70830	And we work at Tencent Security Chef Lab.
71170	77910	And this is the main speaker, or the author of the presentation, Jim Hongbo.
78990	81770	He is the senior researcher on this project.
81770	91330	And I'm the co-author of the presentation, slash translator for this talk, slash voice cast for the talk, actually.
92710	98370	For anyone who maybe didn't get a chance to finish watching the talk, or just got overwhelmed with how many there are already,
98370	104170	would you be willing to just kind of give us a brief overview of what all your talk, your presentation, entails?
105150	113110	So basically we are showcasing a vulnerability we've discovered in Windows Printing Protocol.
113110	120910	And this vulnerability can basically pose locally privileged escalation.
120910	125130	So maybe from sandbox apps to normal user.
125170	132930	And also escalate from normal user to system root on Linux.
132990	134710	System on Linux.
135570	140830	And basically we can also do it remotely as remote code execution.
141550	147170	Maybe you can affect other users who are connecting to the printer.
147170	155030	And when the user connects to that printer, it automatically gets code executed on their machine.
156950	164430	First question we had come in is, why would a sandbox app, like a browser, even need access to the printer server?
166070	169850	Well, browser, as you can see, is a very complex app.
169850	176630	When you use the browser, you actually have many different needs for different users.
177210	187690	Many of the users would like to print documents that they are using a, for example, PDF reader in the browser.
187750	190850	And you may want to print that PDF document.
191290	198810	And that's when the browser needs to talk to a printer through the Windows Printing Protocol.
200470	214470	And that opens up a channel from the sandbox app or the browser to the privileged service, the Windows Printing Service, the Print Spooler.
214470	221730	So that's why this vulnerability can affect a sandbox app like browsers.
222030	225930	Is this throughout all of the Windows Suite that's out there?
225930	229850	Are there certain versions that are susceptible that others aren't?
230110	237310	Well, we did test through Windows 10 to legacy Windows 7.
237570	242950	Theoretically, it does affect even older versions like Windows 2000.
244090	246790	But we haven't tested that yet.
246790	258790	The Windows Spooler service, which is a very patient or legacy service, exists in more than 25 years.
258790	263570	So that really does affect a lot of versions in between.
264970	270650	Is this still research that you guys are planning on going further down? Is this going to pivot into something else?
271410	280230	Well, we've been doing this research on Windows Privileged Escalation for many years now.
280230	290910	So we did research other parts of the Windows operating system, and this is one of our latest findings, actually.
291910	302130	By the way, we did discover another Privileged Escalation vulnerability just after finishing the talk.
302130	305350	Are you ready to talk about it here?
305350	313990	Not really, because Microsoft decided it will postpone the fix to December.
314830	316890	Maybe next year.
316890	323290	I think they're teasing us, guys, like, hey, if you want us back next year, we've got more to drop on y'all.
323810	332870	Yeah, actually, we did write a lot about how to find similar bugs, or similar kinds of logical bugs.
333650	337830	We did a submission this year, but unfortunately...
338570	340370	Maybe next year.
340570	344870	How to do logical bug finding generically.
344870	347250	Maybe I'll just put you guys on the spot a little bit.
347250	354150	Will you give us a little bit of teaser, a 1,000-mile overview of how you would go about finding interesting bugs like this?
354150	356750	Not your full talk, but...
356750	365150	Well, I can basically summarize into a few things.
365390	371090	First thing is you have to have in-depth knowledge about operating system kernels.
371090	379190	So sometimes even more in-depth than the person who is actually writing the operating system components.
379190	387350	So basically more knowledge than the average Microsoft employee, or average Microsoft engineers.
387690	395430	That's how deep you are going to get to actually find the interesting bugs in Windows operating system.
395430	401750	And second is, I think, the tooling is very important.
401750	410850	So you have to have your own tooling for the research that you want to make.
411610	420730	We really recommend you guys check out James' awesome OLU.net.
420730	422430	It's an awesome tool.
422430	427870	But don't just use the tool. Write your own.
428290	434750	You can write the tool. It depends on the other people's tools.
434750	443590	But try to write your own, because writing that tool, you get more knowledge about the kernel stuff, how it works,
443590	449670	and how they decide certain things.
449670	454910	The engineer view of the operating system is very important.
460180	462400	I always end up with audio issues. Sorry about that.
462400	468240	We had a question come in. Have you noticed any easy access for printer memory?
468460	473780	They went on to say, I know that the DoD has been trying to crack down on this for decades.
475940	481240	What do you mean by printer memory? The memory on the actual physical printer?
483020	489580	I think they have a bit of a follow-up for you there, so hopefully he'll get back to us.
489580	495920	In the meantime, though, you've said that you've kind of been investigating all this in privileged escalation for a while.
495920	497620	What got you guys into this track?
497620	502840	What got you excited about digging in to the point where you're writing your own tools for all of this?
503660	515160	Well, as I said, the tooling is very important because it not only lets you know the internals of the operating system,
515160	520760	how it works and why it works, or why they are designed this way.
520760	529960	Also, it will get you further than other people's generic tools don't get.
530960	539260	That's why we are recommending everybody to have their own tools instead of using the generic ones.
541120	552360	And the curiosity in the internals is very important for finding logical bugs.
552780	559720	That's why we started doing logical privileged escalation instead of memory corruptions.
559720	561780	Everybody is working on that.
562860	570000	But logical bugs are quite fun, actually, to find it and to talk about it.
571820	577980	It was definitely a really interesting talk to listen to because I think it's something that can affect everyone, right?
577980	580600	Not just companies, but writing your own home.
580980	586940	Those are always... I don't even know the right word for it. Unsettling? Would that be the correct term?
586940	592960	I'm waiting on Hakai to get back to us on the rest of his questions.
593700	596400	Hakai, can you get that in? I'm not ignoring it.
597820	601080	While we're waiting, I did have a question.
601080	612920	When you were talking about the previous CVE fix where they just simply put a warning up to install the bad driver,
612920	625120	or before they installed drivers, it didn't seem like there was anything other than just telling the user that there's a risk to installing a driver writ large.
625120	629020	There was nothing that said whether a driver could be good or bad.
629020	636280	Was that your take of it? It seems kind of like a punt on Microsoft's part.
637260	645720	Well, because they have certain bars for servicing, or should I say certain bars for vulnerability,
645720	650480	what they are considering vulnerability and what they are not considering vulnerability.
650900	659760	So the most important bar for the vulnerability consideration is user interaction.
659760	667960	If you have more than one user interaction, that doesn't seem to be a vulnerability by their view.
668500	673980	So they put up a warning dialogue and they think maybe it's good enough.
675220	677580	That's how it works.
678240	686880	Yeah, but it's not like they're signed where I can trust these drivers and I can't trust those drivers, right?
686880	697260	Well, actually the newer protocol is basically invented for checking the signatures of the drivers.
697540	705100	So that's the implementation of that protocol, the source of the vulnerability.
705520	708980	So that's quite ironic.
713740	718140	Just clarifying for me on that answer.
718140	726600	So the patches that have come out, are they only affecting Windows printing or are those patches also affecting other services and components?
727680	733800	Well, the patch is for the cabinet instruction part of the system.
734200	747380	So the one thing about the cabinet API in Windows is that when you are calling that API, you're actually handing over a few callback functions to that API.
747380	753680	Basically, the API calls you back when it's extracting the files.
754560	764580	And so the vulnerability is actually not inside the cabinet API but the callback that Windows printing is handling to the API.
765280	775640	So the patch actually did fix that vulnerability and whether or not there's other vulnerabilities regarding the cabinet API
775640	781140	is basically depends on the user of the API itself.
781240	784940	The API seems secure to me.
788620	792000	Seems like famous last words at a conference like this, right?
792420	794640	Somebody out there is going challenge accepted.
796660	800980	I'm sorry, I think I cut you off in the middle of the question earlier there.
803510	809930	I was going to ask about the... I mean, fundamentally, this is a path transversal bug you found.
809930	821130	But I think you answered it earlier in that the architecture itself seems to have some flaws and the way it trusts things.
821170	829050	And if I had to guess, I'd say that your undisclosed vulnerability you found is probably along the same lines.
829050	836910	Do you think just the actual architecture of that driver handshake is flawed?
839420	849720	Well, I would like to say that the design problem is basically you shouldn't have put that service at such a privileged level.
850560	855640	The printer driver is actually not a device driver traditionally.
855640	861060	A traditional device driver is actually a bunch of DL files, dynamic link files.
861580	867640	That's loaded by the driver, by these prints for the process.
867740	874740	So the fundamental problem is you shouldn't have that much of a privilege by design.
877480	884120	And basically, I think Microsoft may be considering, you know, after all these vulnerabilities recently,
884120	889720	they may be considering a redesign or re-architect the entire printing stack.
890480	894880	Maybe that's why we are pushing the patch to some direction.
897880	902580	Kind of off-topic, but you made me wonder, you know, if they're rethinking the design of this,
902580	910520	have you done any investigation on how this would impact or is implemented on other operating systems like Linux or Mac OS?
912680	915940	Printing is really a legacy thing.
915940	920640	All operating system kinds of implement is in their place.
920640	926440	We did the research on a few operating systems, but not all.
929410	932220	We did find a few issues.
942940	946840	So basically, yeah, that's all I've got to say.
947820	951120	So I think what we're getting is if you want the real meat and bones about this,
951120	954140	you're going to have to keep inviting us back to different dot-coms.
954980	956380	I didn't say that.
957400	962200	No, it sounds like there's definitely a lot more to the research that you guys are doing.
962200	964940	I'm a little scared right now, though, being a Linux user.
965420	970020	Into the research that you guys are doing, what's your next big project?
970020	974060	What is the next thing after this talk is out of the way that you guys are going to delve into?
976300	979640	Operating system has a lot of attacks of this.
980820	983440	Printing is a very small fraction of it.
983440	991600	We did have different kinds of research on, for example, the ALPC,
991600	998580	which is a pretty advanced inter-process communication channel on Windows.
999020	1007200	We also have COM, which is another IPC channel, a legacy channel on Windows.
1007380	1013060	And we did find a lot of bugs regarding those two channels.
1015380	1026000	Basically, we started research from the browser aspect.
1026000	1030940	So that's how to get out of the browser sandbox.
1030940	1033160	We started research from there.
1033160	1041180	And we gradually became more generic, doing research in other parts of the system.
1042100	1049520	So we did a lot of normal-to-system privilege escalations, basically.
1049900	1054880	So that's expanding our research throughout the parts of the system.
1057180	1060480	Obviously, there is a lot more to be researched here.
1060480	1063900	And I know earlier you said the key point is you have to be curious.
1063900	1066960	You can't rely on other people's tools.
1066960	1068180	You have to be willing to write your own.
1068180	1072500	And you need to know the fundamentals better even than the developers do.
1072600	1074280	But if somebody out there is going like,
1074280	1076180	OK, you know what, I'm really interested in this.
1076180	1077980	This is something that I want to get into.
1077980	1082660	What resources, recommendations would you give them as a starting point?
1082660	1085920	You know, you guys started in the browser, but you already had that fundamental knowledge.
1085920	1087440	Where could they get started?
1088680	1093760	Well, the starting point can be anywhere you like to.
1093760	1096940	But the curiosity part is the most important thing.
1096940	1101220	You have to have a curiosity in how things work.
1101220	1105080	How they work internally.
1105280	1111820	And just play with the tool and get used to it.
1111820	1117840	And just looking at other parts of the system.
1117840	1119400	Just look away.
1119640	1125660	You have to have in-depth research than average engineers.
1125660	1135260	The engineers basically have different types of requirements.
1135260	1141060	They basically want to complete a certain feature in a certain time frame.
1141360	1143000	Within a certain budget.
1143000	1144940	But security research is different.
1146340	1151140	They do have the requirement of getting deeper than others.
1151140	1152760	Other competitors.
1154720	1158380	The more deep you get, the more bugs you can find.
1161320	1165420	That's a great way to just sum up what a security researcher does right there.
1166300	1169080	We're kind of coming to the end of our time together.
1169080	1172560	And I was wondering, is there anything that maybe didn't make it into y'all's talk?
1172560	1177440	Or anything that you wish you would have focused more around that you're hoping to let people know about now?
1178600	1184480	Well, we actually did two submissions, as I said earlier.
1184480	1192740	And that part that didn't make it into this talk was, how do I find these similar bugs?
1192740	1193800	Generically.
1195440	1197060	Even with automation.
1197060	1201920	Like, without even intervention.
1201920	1205240	That's the thing I want to talk about.
1205560	1206880	Maybe next time.
1206880	1209480	Or other places.
1211380	1215540	But that's a really fun thing to talk about.
1216440	1223140	If people have more questions or anything they'd like to get a hold of you with about, what's the best way for them to reach out to you?
1223140	1228160	You can add us as friends on Discord or maybe Twitter.
1228160	1232160	Twitter accounts are on the slides.
1233280	1239000	You can DM us any questions or thoughts.
1239260	1243760	You can DM us and we are glad to answer.
1244160	1245440	That sounds great.
1245440	1247800	Well, I don't see any more questions coming in.
1247800	1249560	And we're kind of already towards the end of time anyway.
1249560	1252440	So thank you guys for coming and sharing your talk with us.
1252440	1255220	And scaring us about all the other things you haven't released yet.
1255220	1256200	That would be great.
1257740	1259020	Y'all have a great night.
1259020	1263360	Thank you.