1 00:00:00,000 --> 00:00:04,680 - Hello and welcome to the three o'clock track Three talk. 2 00:00:04,680 --> 00:00:06,420 You Have One New Appwntnent- 3 00:00:06,420 --> 00:00:10,170 Hacking Proprietary ICalendar Properties by Eugene Lim. 4 00:00:10,170 --> 00:00:12,300 Before we begin, I have two announcements. 5 00:00:12,300 --> 00:00:14,130 Number one, please wear your masks 6 00:00:14,130 --> 00:00:15,750 while you're sitting in the room. 7 00:00:15,750 --> 00:00:17,250 That's they're still required. 8 00:00:17,250 --> 00:00:19,200 And number two, please, don't sit around 9 00:00:19,200 --> 00:00:20,970 or stand around the edge of the room. 10 00:00:20,970 --> 00:00:22,200 Please come in and find a seat. 11 00:00:22,200 --> 00:00:24,840 Come on a little closer and check out the stock. 12 00:00:24,840 --> 00:00:25,673 Welcome Eugene. 13 00:00:26,563 --> 00:00:28,980 (Audience clapping) 14 00:00:28,980 --> 00:00:29,813 - Hi everyone. 15 00:00:30,840 --> 00:00:31,980 Thank you so much for coming. 16 00:00:31,980 --> 00:00:33,750 I know it's day two of DEFCON. 17 00:00:33,750 --> 00:00:35,850 So you guys have survived. 18 00:00:35,850 --> 00:00:38,400 You guys just have to survive my talk and one more day 19 00:00:38,400 --> 00:00:39,750 and you guys will be home free. 20 00:00:39,750 --> 00:00:41,370 So thank you very much for coming 21 00:00:41,370 --> 00:00:43,320 and I'm really excited to speak today. 22 00:00:43,320 --> 00:00:45,630 I'll be talking about You Have One New Appwntment, 23 00:00:45,630 --> 00:00:48,270 Hacking Proprietary ICalendar Properties. 24 00:00:48,270 --> 00:00:49,200 And before I begin, 25 00:00:49,200 --> 00:00:52,500 I just wanna give a quick introduction to myself. 26 00:00:52,500 --> 00:00:55,710 I'm Eugene and I go by space raccoon online. 27 00:00:55,710 --> 00:00:56,640 That's my Twitter handle 28 00:00:56,640 --> 00:01:00,540 because someone has Twitter handle for space raccoon. 29 00:01:00,540 --> 00:01:02,160 So if you're that guy come up to me, 30 00:01:02,160 --> 00:01:04,010 we can work something out after this. 31 00:01:04,958 --> 00:01:07,770 I can't pay much, but we'll figure something out. 32 00:01:07,770 --> 00:01:09,210 I work at the cyber security group 33 00:01:09,210 --> 00:01:11,280 at the government technology agency of Singapore. 34 00:01:11,280 --> 00:01:12,270 So I'm from Singapore. 35 00:01:12,270 --> 00:01:14,970 And what I do is mostly def sec ops. 36 00:01:14,970 --> 00:01:16,950 I work on protecting citizen's data, 37 00:01:16,950 --> 00:01:18,930 and government systems and applications 38 00:01:18,930 --> 00:01:20,730 before they get out into the public. 39 00:01:22,440 --> 00:01:25,560 So how many of you guys have gotten a appointment reminder 40 00:01:25,560 --> 00:01:27,570 in the last week or so? 41 00:01:27,570 --> 00:01:29,910 maybe a ping or mobile notification. 42 00:01:29,910 --> 00:01:30,900 Yeah, most of you guys do. 43 00:01:30,900 --> 00:01:34,710 Because especially in the COVID post COVID or well era, 44 00:01:34,710 --> 00:01:36,930 we have a lot of calendars invitations 45 00:01:36,930 --> 00:01:38,190 kind of floating around. 46 00:01:38,190 --> 00:01:40,350 Reminding you to go for something or another. 47 00:01:40,350 --> 00:01:42,000 And you might be wondering, 48 00:01:42,000 --> 00:01:43,980 What's going on behind the scenes? 49 00:01:43,980 --> 00:01:45,180 When you get an invitation 50 00:01:45,180 --> 00:01:47,430 and you have that little convenient button in outlook 51 00:01:47,430 --> 00:01:50,820 that says accept invitation or decline the invitation. 52 00:01:50,820 --> 00:01:51,720 What's happening right? 53 00:01:51,720 --> 00:01:54,660 Or in your Apple calendar or your iOS device, 54 00:01:54,660 --> 00:01:56,460 you might also have that convenient button. 55 00:01:56,460 --> 00:01:59,040 So what really happens when you get an invitation 56 00:01:59,040 --> 00:01:59,883 and it pops up? 57 00:02:01,500 --> 00:02:03,930 And you might also wonder, what happens if instead of 58 00:02:03,930 --> 00:02:05,950 just accepting an invitation 59 00:02:06,900 --> 00:02:09,750 checking on the application invitation that you've gotten, 60 00:02:09,750 --> 00:02:12,000 what happens if you started doing something strange, right? 61 00:02:12,000 --> 00:02:15,270 Your mobile phone starts having a few popups. 62 00:02:15,270 --> 00:02:17,160 You might start a call, 63 00:02:17,160 --> 00:02:19,050 something might be going on in a background 64 00:02:19,050 --> 00:02:20,940 and you don't start the meeting, right? 65 00:02:20,940 --> 00:02:23,463 instead of shower something might have started. 66 00:02:24,360 --> 00:02:26,940 So what really goes on behind the scenes 67 00:02:26,940 --> 00:02:29,160 when you have an invitation like that, 68 00:02:29,160 --> 00:02:31,140 is that you have an email with an ICS attachment, 69 00:02:31,140 --> 00:02:32,910 which is the eye calendar attachment. 70 00:02:32,910 --> 00:02:34,620 And before we carry on, I just wanna clarify. 71 00:02:34,620 --> 00:02:37,050 I think maybe a misconception some might have, 72 00:02:37,050 --> 00:02:40,230 is that eye calendar is not explicitly Apple format 73 00:02:40,230 --> 00:02:42,120 because you might think iPhone iPad. 74 00:02:42,120 --> 00:02:43,950 But the ICalendar format is actually the name 75 00:02:43,950 --> 00:02:46,680 for a standardized format defined by RFC. 76 00:02:46,680 --> 00:02:49,410 There's interoperable between various email 77 00:02:49,410 --> 00:02:51,120 and calendar clients, 78 00:02:51,120 --> 00:02:53,520 from Microsoft outlook to Google calendar, 79 00:02:53,520 --> 00:02:55,170 to Apple calendar. 80 00:02:55,170 --> 00:02:57,000 And it's something I'm gonna dive a bit more into 81 00:02:57,000 --> 00:02:59,370 because for those of you in red teams, 82 00:02:59,370 --> 00:03:02,460 you might be pretty familiar with using calendar invitations 83 00:03:02,460 --> 00:03:03,720 as a phishing deal. 84 00:03:03,720 --> 00:03:05,700 And that's something that a lot of people have done, 85 00:03:05,700 --> 00:03:07,260 but was more interested in, 86 00:03:07,260 --> 00:03:09,240 was looking into exploit scenarios 87 00:03:09,240 --> 00:03:11,070 with the eye calendar format. 88 00:03:11,070 --> 00:03:13,110 Ways that it could be used and abused. 89 00:03:13,110 --> 00:03:14,940 Ways that passes can be broken 90 00:03:14,940 --> 00:03:16,710 in order to get an exploit out. 91 00:03:16,710 --> 00:03:19,350 And this was fairly fruitful research, 92 00:03:19,350 --> 00:03:21,600 even though I threw the net pretty wide. 93 00:03:21,600 --> 00:03:24,570 So this kind of covered a number of vulnerabilities from 94 00:03:24,570 --> 00:03:28,050 VMware boxer to Synology Calendar, Apple Calendar, 95 00:03:28,050 --> 00:03:31,680 Microsoft Outlook, Google Calendar, and NextCloud Calendar. 96 00:03:31,680 --> 00:03:34,950 So if you look at the list of targets, 97 00:03:34,950 --> 00:03:36,330 it's actually a fairly broad range 98 00:03:36,330 --> 00:03:38,190 because it went from mobile to web, 99 00:03:38,190 --> 00:03:40,200 to desktop, to IOT devices. 100 00:03:40,200 --> 00:03:42,870 And this really shows you even from a very brief survey 101 00:03:42,870 --> 00:03:46,260 that I did across every single client 102 00:03:46,260 --> 00:03:47,700 I could get my hands on. 103 00:03:47,700 --> 00:03:50,190 I didn't really go too deep into one or another 104 00:03:50,190 --> 00:03:52,980 that you can find a lot of interesting things. 105 00:03:52,980 --> 00:03:55,620 And this brought up a few interesting ideas. 106 00:03:55,620 --> 00:04:00,620 So we really have to begin, I think about 24 years now, 107 00:04:01,080 --> 00:04:04,800 back in 1998, when the RFC 2445, 108 00:04:04,800 --> 00:04:07,950 which is the internet calendar object specification 109 00:04:07,950 --> 00:04:10,350 was first published by two guys, 110 00:04:10,350 --> 00:04:14,577 Dawson from Lotus and also Stanson from Microsoft. 111 00:04:16,800 --> 00:04:19,590 And what these guys came out with was basically 112 00:04:19,590 --> 00:04:22,830 a format for the I calendar specification, 113 00:04:22,830 --> 00:04:24,870 which would define an event or calendar 114 00:04:24,870 --> 00:04:27,810 that could be shared between various office applications. 115 00:04:27,810 --> 00:04:30,930 And back in 1998, that was the context was 116 00:04:30,930 --> 00:04:34,350 that it was a huge office was right? 117 00:04:34,350 --> 00:04:35,820 because all of these companies were coming out 118 00:04:35,820 --> 00:04:37,230 with their own office suites. 119 00:04:37,230 --> 00:04:38,940 They were creating their own specifications, 120 00:04:38,940 --> 00:04:40,230 their own way of doing things. 121 00:04:40,230 --> 00:04:42,930 And they're not all compatible with each other. 122 00:04:42,930 --> 00:04:44,910 But this is a terrible thing for the end user, 123 00:04:44,910 --> 00:04:47,760 because it doesn't make sense if you, as a user, 124 00:04:47,760 --> 00:04:50,280 have an event and you're inviting someone 125 00:04:50,280 --> 00:04:53,040 and it doesn't matter what kind of client they're using 126 00:04:53,040 --> 00:04:54,540 or what kind of application they're using, 127 00:04:54,540 --> 00:04:57,570 You want them to be able to accept or invite and attend it. 128 00:04:57,570 --> 00:04:59,220 But if you're all using different formats, 129 00:04:59,220 --> 00:05:00,570 that's not gonna work out. 130 00:05:00,570 --> 00:05:02,670 So that's what these companies did. 131 00:05:02,670 --> 00:05:04,710 They came together, built a format, 132 00:05:04,710 --> 00:05:08,010 and they decided to use that as a standard operating format 133 00:05:08,010 --> 00:05:09,060 between each of them. 134 00:05:10,740 --> 00:05:12,870 And so that's really the plan they have for today. 135 00:05:12,870 --> 00:05:14,460 I'm gonna give you kind of a background 136 00:05:14,460 --> 00:05:16,020 to the ICalendar format, 137 00:05:16,020 --> 00:05:17,318 some interesting things 138 00:05:17,318 --> 00:05:18,510 that might have came up in my research 139 00:05:18,510 --> 00:05:21,660 and what people might have exploited. 140 00:05:21,660 --> 00:05:23,670 Before diving into standard implementations 141 00:05:23,670 --> 00:05:26,130 of ICalendar that are not so standard. 142 00:05:26,130 --> 00:05:27,540 So even though you have a standard, 143 00:05:27,540 --> 00:05:28,920 I think you'll be more than familiar 144 00:05:28,920 --> 00:05:31,500 that companies don't do things that way. 145 00:05:31,500 --> 00:05:34,500 They have used it in very interesting and strange ways 146 00:05:34,500 --> 00:05:36,770 that have left vulnerabilities. 147 00:05:36,770 --> 00:05:38,220 And then I'll move on to proprietary extensions 148 00:05:38,220 --> 00:05:39,360 that ICalendar standard. 149 00:05:39,360 --> 00:05:41,040 I'll talk a bit more about that later, 150 00:05:41,040 --> 00:05:42,510 but basically, the ICalendar standard 151 00:05:42,510 --> 00:05:44,280 supports a nonstandard way, 152 00:05:44,280 --> 00:05:46,080 a standard way of doing nonstandard things. 153 00:05:46,080 --> 00:05:48,130 So companies can add their own extensions, 154 00:05:48,130 --> 00:05:49,500 their way of passing, 155 00:05:49,500 --> 00:05:52,260 and that's gonna be supported by the format. 156 00:05:52,260 --> 00:05:53,093 And then finally, 157 00:05:53,093 --> 00:05:55,200 I'll talk about some protocol interactions. 158 00:05:55,200 --> 00:05:58,440 Because ICalendar doesn't exist in a vacuum 159 00:05:58,440 --> 00:06:00,960 when you respond to an invitation and emails being sent, 160 00:06:00,960 --> 00:06:03,030 so it's working with the SMTP format. 161 00:06:03,030 --> 00:06:05,610 There's also the CalDAV format protocol, 162 00:06:05,610 --> 00:06:06,840 which helps to update 163 00:06:06,840 --> 00:06:10,740 and create calendar files on the web service. 164 00:06:10,740 --> 00:06:14,310 And that's all kind of things that add additional complexity 165 00:06:14,310 --> 00:06:17,160 to using I calendar and has led to vulnerabilities. 166 00:06:17,160 --> 00:06:19,230 And I'll give some takeaways, quick takeaways, 167 00:06:19,230 --> 00:06:21,810 mostly for builders, but also for breakers, 168 00:06:21,810 --> 00:06:22,643 if you're interested, 169 00:06:22,643 --> 00:06:25,740 I'll be also putting up a small database of these stuff 170 00:06:25,740 --> 00:06:28,170 that I found that you can also take it a bit further, 171 00:06:28,170 --> 00:06:29,310 because as I mentioned, 172 00:06:29,310 --> 00:06:31,350 I've done a really broad survey 173 00:06:31,350 --> 00:06:33,450 found really kind of surface level stuff. 174 00:06:33,450 --> 00:06:34,470 But from what I've seen, 175 00:06:34,470 --> 00:06:36,090 I think if you want to take it further, 176 00:06:36,090 --> 00:06:38,493 there's definitely a rich source of bugs. 177 00:06:39,900 --> 00:06:42,510 All right, so let's start with the background 178 00:06:42,510 --> 00:06:43,890 for the eye calendar standard. 179 00:06:43,890 --> 00:06:46,260 So I showed you the 2445 RFC. 180 00:06:46,260 --> 00:06:48,270 That was way back in 1998. 181 00:06:48,270 --> 00:06:51,690 And it was kind of superseded by what is 5545, 182 00:06:51,690 --> 00:06:55,020 which was in 2009 done by someone from Oracle 183 00:06:55,020 --> 00:06:55,853 and more recently, 184 00:06:55,853 --> 00:06:58,860 where we have seen also a couple more updates. 185 00:06:58,860 --> 00:07:00,450 The most recent one was also from Apple, 186 00:07:00,450 --> 00:07:01,680 engineer from Apple. 187 00:07:01,680 --> 00:07:04,410 But you also have a bunch of other ICS that kind of update 188 00:07:04,410 --> 00:07:06,450 or add kind of interoperability 189 00:07:06,450 --> 00:07:11,220 things that basically extend the format to more platforms. 190 00:07:11,220 --> 00:07:13,320 But when you're thinking about the ICalendar format, 191 00:07:13,320 --> 00:07:15,750 you really want to go with RFC 5545, 192 00:07:15,750 --> 00:07:17,220 because that's a core specification 193 00:07:17,220 --> 00:07:19,870 that tells you exactly what goes on into this format. 194 00:07:21,090 --> 00:07:22,920 So there's enough of talking of the RFC. 195 00:07:22,920 --> 00:07:25,650 So what actually goes on in a calendar? 196 00:07:25,650 --> 00:07:27,510 You get a calendar invite, what's going on? 197 00:07:27,510 --> 00:07:30,090 you get an email with an ICS attachment 198 00:07:30,090 --> 00:07:32,290 and what does that ICS attachment look like? 199 00:07:33,960 --> 00:07:37,500 So that's what it looks like is a pretty interesting format, 200 00:07:37,500 --> 00:07:38,430 a very simple format, 201 00:07:38,430 --> 00:07:40,920 something that you might come up with back in 1998, 202 00:07:40,920 --> 00:07:43,650 when you had lost space and network restrictions, 203 00:07:43,650 --> 00:07:47,700 it's a text file, commonly limited and new line limited. 204 00:07:47,700 --> 00:07:50,310 And it's a bit similar to say XML, 205 00:07:50,310 --> 00:07:52,740 because there are some opening and closing text, 206 00:07:52,740 --> 00:07:54,300 you have the opening of a Vcalendar, 207 00:07:54,300 --> 00:07:56,700 and you have opening of a VEvent. 208 00:07:56,700 --> 00:08:00,210 And those are things that are similar to XML, 209 00:08:00,210 --> 00:08:01,620 but it's also different from XML 210 00:08:01,620 --> 00:08:04,290 because it also has key value pairs. 211 00:08:04,290 --> 00:08:07,410 You have stuff like the date time start, 212 00:08:07,410 --> 00:08:09,870 the end, the location, the URL, 213 00:08:09,870 --> 00:08:11,550 and these are all standard properties 214 00:08:11,550 --> 00:08:13,860 to help describe the event you're attending. 215 00:08:13,860 --> 00:08:16,500 And in the background, what the clients are doing. 216 00:08:16,500 --> 00:08:19,590 I essentially passing this transparently to the user. 217 00:08:19,590 --> 00:08:20,970 So as a user, most of the time, 218 00:08:20,970 --> 00:08:22,110 you're not gonna see an ICS file. 219 00:08:22,110 --> 00:08:24,210 You might have seen that if you have been sending an invite 220 00:08:24,210 --> 00:08:25,920 to a separate email client, 221 00:08:25,920 --> 00:08:27,900 but you're sending it within the outlook ecosystem. 222 00:08:27,900 --> 00:08:28,860 For example, 223 00:08:28,860 --> 00:08:31,170 what you're gonna see is a very streamlined 224 00:08:31,170 --> 00:08:34,353 and transparent kind of user interface. 225 00:08:35,250 --> 00:08:36,810 And what these clients are doing is that 226 00:08:36,810 --> 00:08:38,970 they're doing some proprietary work in the background. 227 00:08:38,970 --> 00:08:41,370 They are passing it differently from other clients. 228 00:08:41,370 --> 00:08:43,020 They're also adding their own extensions. 229 00:08:43,020 --> 00:08:46,110 And this creates more features because these companies, 230 00:08:46,110 --> 00:08:48,120 they want to differentiate their products. 231 00:08:48,120 --> 00:08:49,770 So you might have gotten a very convenient 232 00:08:49,770 --> 00:08:50,700 join online button. 233 00:08:50,700 --> 00:08:53,460 If you had a team meeting or a Skype meeting, 234 00:08:53,460 --> 00:08:55,080 and what's going on back there, 235 00:08:55,080 --> 00:08:56,820 is that outlook is actually passing. 236 00:08:56,820 --> 00:08:58,740 For example, the URL property, 237 00:08:58,740 --> 00:09:01,890 or maybe the custom proprietary property 238 00:09:01,890 --> 00:09:04,020 that defines the teams meeting URL, 239 00:09:04,020 --> 00:09:07,440 and that's gonna immediately appear in the GUI. 240 00:09:07,440 --> 00:09:08,670 So that's already pretty interesting 241 00:09:08,670 --> 00:09:12,690 because just by modifying some of these unstructured data, 242 00:09:12,690 --> 00:09:14,640 you can create changes in the GUI, 243 00:09:14,640 --> 00:09:16,840 and also the behavior of these applications. 244 00:09:18,660 --> 00:09:21,450 You might have a flight scheduled tomorrow. 245 00:09:21,450 --> 00:09:22,803 I hope it stays on time, 246 00:09:24,330 --> 00:09:26,010 but basically when you have a flight 247 00:09:26,010 --> 00:09:28,170 and it come since as an email, for example, 248 00:09:28,170 --> 00:09:31,050 Apple mail is able to pass that intelligently, 249 00:09:31,050 --> 00:09:32,550 extract some of the features, 250 00:09:32,550 --> 00:09:34,830 and suggest event for you. Right? 251 00:09:34,830 --> 00:09:37,423 And a lot of these data is actually gonna be 252 00:09:37,423 --> 00:09:39,750 a post proprietary data format. 253 00:09:39,750 --> 00:09:42,420 So we can show you things like your travel time. 254 00:09:42,420 --> 00:09:44,280 It can do a bit of a tracking of the flight for you 255 00:09:44,280 --> 00:09:45,270 and the calendar. 256 00:09:45,270 --> 00:09:47,670 And that's all very convenient for the end user. 257 00:09:47,670 --> 00:09:51,030 But with that convenience, it comes some complexity. 258 00:09:51,030 --> 00:09:54,363 And for bug hunters, I think that's where the bugs happen. 259 00:09:55,950 --> 00:09:58,830 So back in, I think 1998, 260 00:09:58,830 --> 00:10:02,520 there was some dangers by default stuff in a specification. 261 00:10:02,520 --> 00:10:07,080 And one of these is the VAlarm property. 262 00:10:07,080 --> 00:10:09,000 So you can specify alarm or trigger 263 00:10:09,000 --> 00:10:10,680 that happens maybe 15 minutes 264 00:10:10,680 --> 00:10:12,360 or one hour before the event happens, 265 00:10:12,360 --> 00:10:14,220 and it can pop it in different ways. 266 00:10:14,220 --> 00:10:17,070 The most obvious way is across the notification way. 267 00:10:17,070 --> 00:10:19,350 So it's just gonna pop up a box or something. 268 00:10:19,350 --> 00:10:20,183 But back then, 269 00:10:20,183 --> 00:10:22,020 they actually allow for several other ways 270 00:10:22,020 --> 00:10:23,280 to create a notification. 271 00:10:23,280 --> 00:10:25,440 One of them is that you could specify an email 272 00:10:25,440 --> 00:10:26,760 that could also have an attachment 273 00:10:26,760 --> 00:10:29,130 from your for local system. 274 00:10:29,130 --> 00:10:30,330 So when it's time for the event, 275 00:10:30,330 --> 00:10:32,820 it's gonna send an email to who knows what, 276 00:10:32,820 --> 00:10:34,980 with whatever attachment you've specified 277 00:10:34,980 --> 00:10:37,020 in your local system. 278 00:10:37,020 --> 00:10:39,600 Or you could even play a sound, a special sound. 279 00:10:39,600 --> 00:10:42,147 So you could load that from a FTP server or HTP server 280 00:10:42,147 --> 00:10:43,650 and a remote server. 281 00:10:43,650 --> 00:10:46,080 And we can see why that is might be an issue today 282 00:10:46,080 --> 00:10:46,913 because you know, 283 00:10:46,913 --> 00:10:49,380 you could play something nasty or dangerous, 284 00:10:49,380 --> 00:10:51,720 and you don't want that to be loading remote content 285 00:10:51,720 --> 00:10:52,830 without your consent. 286 00:10:52,830 --> 00:10:55,290 And that was something that would have been possible 287 00:10:55,290 --> 00:10:56,970 given the way ICalendar works, 288 00:10:56,970 --> 00:10:58,680 because a lot of these systems, 289 00:10:58,680 --> 00:11:00,150 they just taking the I calendar file, 290 00:11:00,150 --> 00:11:02,190 and they automatically add that to your calendar 291 00:11:02,190 --> 00:11:04,040 without you even having to accept it. 292 00:11:04,980 --> 00:11:07,320 But that was back in 1998. 293 00:11:07,320 --> 00:11:08,670 And I think a lot of companies 294 00:11:08,670 --> 00:11:09,993 and also the new updated RFCs, 295 00:11:09,993 --> 00:11:13,410 they have kind of noted these dangerous by default stuff. 296 00:11:13,410 --> 00:11:15,270 They've kind of deprecated it. 297 00:11:15,270 --> 00:11:17,430 But they're still insecure implementations 298 00:11:17,430 --> 00:11:19,770 of standard RFC properties, 299 00:11:19,770 --> 00:11:21,390 and I'll go through them through some of them. 300 00:11:21,390 --> 00:11:22,980 They're really interesting. 301 00:11:22,980 --> 00:11:25,320 So the first one is the description property, 302 00:11:25,320 --> 00:11:27,480 and it's as simple as it gets 303 00:11:27,480 --> 00:11:28,650 exactly what it says on the tin. 304 00:11:28,650 --> 00:11:31,140 It just describes the event that you're going for. 305 00:11:31,140 --> 00:11:34,710 And it's meant to be a raw text file. 306 00:11:34,710 --> 00:11:36,630 It just adds in a little more data 307 00:11:36,630 --> 00:11:39,210 about what's going on with the event. 308 00:11:39,210 --> 00:11:41,160 But even though it describes it as raw text file, 309 00:11:41,160 --> 00:11:44,880 I think vendors implement this very differently. 310 00:11:44,880 --> 00:11:47,580 So Apple and Microsoft, they stop this specification. 311 00:11:47,580 --> 00:11:49,530 They interpret that as plain text. 312 00:11:49,530 --> 00:11:50,970 But Google and VMware, 313 00:11:50,970 --> 00:11:52,860 they actually interpret this as HDML. 314 00:11:52,860 --> 00:11:55,560 So if you can actually include HTML text 315 00:11:55,560 --> 00:11:57,630 and it will be passed as such 316 00:11:57,630 --> 00:12:00,360 Google itself does have their own sanitization procedures. 317 00:12:00,360 --> 00:12:01,860 You might be familiar with those. 318 00:12:01,860 --> 00:12:05,280 VMware did not for one of the applications. 319 00:12:05,280 --> 00:12:06,360 As I mentioned earlier, 320 00:12:06,360 --> 00:12:08,310 the reason why this is a problem, 321 00:12:08,310 --> 00:12:11,460 is just because of the way ICS works. 322 00:12:11,460 --> 00:12:12,870 For a lot of clients, 323 00:12:12,870 --> 00:12:16,410 they automatically add the ICS attachment to your calendar. 324 00:12:16,410 --> 00:12:18,930 So even if you haven't accepted it or declined it, 325 00:12:18,930 --> 00:12:21,780 it's gonna appear in your calendar or your inbox, 326 00:12:21,780 --> 00:12:23,940 and it's gonna be added as a non-blocking event 327 00:12:23,940 --> 00:12:25,140 until you respond to it. 328 00:12:25,140 --> 00:12:26,790 But it's gonna be that. 329 00:12:26,790 --> 00:12:29,820 And because of that, you can trigger payload remotely 330 00:12:29,820 --> 00:12:31,680 without any user interaction, 331 00:12:31,680 --> 00:12:34,530 depending on of course the exploit scenario 332 00:12:34,530 --> 00:12:35,580 that you have as well. 333 00:12:35,580 --> 00:12:37,880 And that's something that's pretty concerning. 334 00:12:39,120 --> 00:12:41,250 And also what makes it tricky is that, you know, 335 00:12:41,250 --> 00:12:43,710 have so many clients across different platforms, 336 00:12:43,710 --> 00:12:45,870 different frameworks that makes it really difficult 337 00:12:45,870 --> 00:12:47,790 to secure your implementation. 338 00:12:47,790 --> 00:12:50,310 So for VMware, that was an interesting case 339 00:12:50,310 --> 00:12:53,310 because only the iOS application was vulnerable. 340 00:12:53,310 --> 00:12:55,800 Whereas Android has a different way of handling web views 341 00:12:55,800 --> 00:12:57,480 and that was able to sanitize it 342 00:12:57,480 --> 00:13:00,000 and kind of block the exploitation. 343 00:13:00,000 --> 00:13:01,470 Whereas if you look at stuff like 344 00:13:01,470 --> 00:13:02,700 what Microsoft is putting out, 345 00:13:02,700 --> 00:13:05,430 they do have Microsoft teams, windows calendar, 346 00:13:05,430 --> 00:13:07,350 outlook, outlook on the web, 347 00:13:07,350 --> 00:13:09,780 they have mobile, desktop, all kinds of things. 348 00:13:09,780 --> 00:13:12,240 And this works makes it a lot messier for you 349 00:13:12,240 --> 00:13:13,980 to secure things at the end point. 350 00:13:13,980 --> 00:13:15,420 And this is something I've observed as well, 351 00:13:15,420 --> 00:13:18,870 where it kind of pays to test across different platforms 352 00:13:18,870 --> 00:13:23,433 and different versions in order to get what you want to see. 353 00:13:24,600 --> 00:13:25,433 What's interesting as well, 354 00:13:25,433 --> 00:13:27,180 it's not just raw text passing, 355 00:13:27,180 --> 00:13:30,960 Apple does something really weird with this format 356 00:13:30,960 --> 00:13:33,420 because while they stick to raw text, 357 00:13:33,420 --> 00:13:36,390 they actually add their own special template into this. 358 00:13:36,390 --> 00:13:38,640 So it has a magic template, magic bytes. 359 00:13:38,640 --> 00:13:42,480 And if you're creating an application event 360 00:13:42,480 --> 00:13:44,400 with a FaceTime call, 361 00:13:44,400 --> 00:13:46,440 what is actually does behind the scenes is that 362 00:13:46,440 --> 00:13:50,430 it puts in this FaceTime format template 363 00:13:50,430 --> 00:13:53,820 and it transparently interprets that in your clients. 364 00:13:53,820 --> 00:13:54,780 So if you're gonna look at that 365 00:13:54,780 --> 00:13:57,150 on your mobile phone or in mac OS, 366 00:13:57,150 --> 00:13:59,450 it's just gonna show you a simple join button. 367 00:14:00,390 --> 00:14:03,030 At this point, you're kind of like, okay, yeah, 368 00:14:03,030 --> 00:14:05,340 you know, custom URIs are also a thing. 369 00:14:05,340 --> 00:14:07,830 So Apple back then didn't sanitize it. 370 00:14:07,830 --> 00:14:11,670 And this is also a concern because I think in start of 2022, 371 00:14:11,670 --> 00:14:16,140 I think Ryan Pickering had a really good UXS 372 00:14:16,140 --> 00:14:19,320 or custom URI to actually exploit on mac OS. 373 00:14:19,320 --> 00:14:21,510 So this would've been a great delivery mechanism 374 00:14:21,510 --> 00:14:23,790 for that kind of vulnerability. 375 00:14:23,790 --> 00:14:25,680 And really, I think, 376 00:14:25,680 --> 00:14:28,050 when it comes to a lot of the properties I've seen 377 00:14:28,050 --> 00:14:29,280 that involve a URL, 378 00:14:29,280 --> 00:14:32,640 some of them do not check for the custom URI protocol, 379 00:14:32,640 --> 00:14:35,240 and that's where you can also put in the next plate. 380 00:14:37,170 --> 00:14:38,910 Another interesting property for me was the 381 00:14:38,910 --> 00:14:40,410 Attendee Organizer Property. 382 00:14:40,410 --> 00:14:43,230 And what's interesting about this is that it's also tied 383 00:14:43,230 --> 00:14:44,460 to how you respond to it, right? 384 00:14:44,460 --> 00:14:46,110 Because when you respond to an email 385 00:14:46,110 --> 00:14:47,790 saying you're attending or not attending, 386 00:14:47,790 --> 00:14:49,770 it refers to the organizer field, 387 00:14:49,770 --> 00:14:54,770 and it's gonna send invitation response to that organizer. 388 00:14:55,200 --> 00:14:57,000 And then the server at the end of it 389 00:14:57,000 --> 00:14:59,130 is gonna accept the invitation. 390 00:14:59,130 --> 00:15:00,510 And then it's gonna send an update 391 00:15:00,510 --> 00:15:02,640 to all of the invited participants. 392 00:15:02,640 --> 00:15:04,320 So according to RFC, 393 00:15:04,320 --> 00:15:07,800 this value is a URI and has to be a mailed to URI 394 00:15:07,800 --> 00:15:10,590 defined by another RFC. Right? 395 00:15:10,590 --> 00:15:13,020 And sure you're like, okay, that's fine. 396 00:15:13,020 --> 00:15:14,790 That looks good to me. 397 00:15:14,790 --> 00:15:17,040 But I think for those of you who look at RFCs 398 00:15:18,570 --> 00:15:21,483 my condolences, for those of you who read RFCs, 399 00:15:23,430 --> 00:15:26,250 that's a valid RFC approved email actually, 400 00:15:26,250 --> 00:15:27,630 because you put it between double quotes, 401 00:15:27,630 --> 00:15:29,160 it allow special characters, 402 00:15:29,160 --> 00:15:31,500 and that's where you can also inject some of your payloads 403 00:15:31,500 --> 00:15:34,053 that are gonna be used by the application. 404 00:15:34,890 --> 00:15:36,000 So this was something I saw 405 00:15:36,000 --> 00:15:39,150 with the Synology calendar itself. 406 00:15:39,150 --> 00:15:40,530 So for example, 407 00:15:40,530 --> 00:15:42,480 when you add an event, 408 00:15:42,480 --> 00:15:43,950 and I'm just kind of importing it here, 409 00:15:43,950 --> 00:15:45,500 but you can have it synced from a calendar 410 00:15:45,500 --> 00:15:47,790 or from someone inviting you, 411 00:15:47,790 --> 00:15:51,243 that's gonna cause a payload and that's gonna pop. 412 00:15:52,980 --> 00:15:55,710 And you can create a warmer bowl event from this basically 413 00:15:55,710 --> 00:15:56,760 because it's calendar. 414 00:15:56,760 --> 00:15:58,410 And then everyone's invited to the party. 415 00:15:58,410 --> 00:16:00,015 And it's not a good party. 416 00:16:00,015 --> 00:16:00,848 It's the bad party, 417 00:16:00,848 --> 00:16:02,790 the kind that you don't wanna go to at, 418 00:16:02,790 --> 00:16:05,183 I hope you're gone to better parties, that's DEFCON. 419 00:16:06,480 --> 00:16:08,340 And also some of the behavior that Apple does 420 00:16:08,340 --> 00:16:09,360 is also very custom, 421 00:16:09,360 --> 00:16:10,740 very proprietary is non-standard way 422 00:16:10,740 --> 00:16:12,240 of implementing the specification. 423 00:16:12,240 --> 00:16:14,190 That's really interesting. 424 00:16:14,190 --> 00:16:15,870 So for Calendar, 425 00:16:15,870 --> 00:16:18,030 they also have an attached property 426 00:16:18,030 --> 00:16:21,390 and an attached property basically defines most of the time. 427 00:16:21,390 --> 00:16:23,850 It has to be local to your email itself. 428 00:16:23,850 --> 00:16:26,100 But you can also sometimes specify a URL. 429 00:16:26,100 --> 00:16:28,050 Most clients do not support that, 430 00:16:28,050 --> 00:16:31,380 but this URL specifies attachment to your event. 431 00:16:31,380 --> 00:16:33,540 So stuff like maybe a meeting agenda, 432 00:16:33,540 --> 00:16:35,703 or a cat picture, or something. 433 00:16:36,660 --> 00:16:38,430 And what Apple does is that 434 00:16:38,430 --> 00:16:41,160 it checks if this URLs ends with .icloud.com 435 00:16:41,160 --> 00:16:41,993 and if it does, 436 00:16:41,993 --> 00:16:45,750 it's gonna automatically download that to your computer. 437 00:16:45,750 --> 00:16:47,160 And this might be useful for red teams. 438 00:16:47,160 --> 00:16:50,700 I mean, I think it follows icloud.com, 439 00:16:50,700 --> 00:16:52,440 but it also follows redirects. 440 00:16:52,440 --> 00:16:54,210 So you can load any of your remote data 441 00:16:54,210 --> 00:16:55,530 into someone's computer remotely. 442 00:16:55,530 --> 00:16:57,840 So it's a zero click download, I guess, 443 00:16:57,840 --> 00:17:00,420 and that might be useful for some great teams. 444 00:17:00,420 --> 00:17:02,520 It also does. 445 00:17:02,520 --> 00:17:04,140 If it's on .icloud.com, 446 00:17:04,140 --> 00:17:07,410 you can basically sign up for iCloud folder 447 00:17:07,410 --> 00:17:08,460 and you can also upload that 448 00:17:08,460 --> 00:17:09,990 and that's gonna work with everyone. 449 00:17:09,990 --> 00:17:11,700 So it might be a convenient for the end user 450 00:17:11,700 --> 00:17:14,370 because it helps them quickly attach stuff to iCloud 451 00:17:14,370 --> 00:17:15,660 and send it to each other. 452 00:17:15,660 --> 00:17:18,260 But it's also useful if you wanna deliver a payload. 453 00:17:20,040 --> 00:17:22,170 So that's it for kind of the standard properties 454 00:17:22,170 --> 00:17:23,790 that we've looked at. 455 00:17:23,790 --> 00:17:26,220 And one of the other things that I started to look at 456 00:17:26,220 --> 00:17:29,331 was the proprietary extensions to ICalendar. 457 00:17:29,331 --> 00:17:30,300 And that really makes the meat 458 00:17:30,300 --> 00:17:32,730 of what I'm gonna talk about today. 459 00:17:32,730 --> 00:17:35,010 I love it when companies do things differently 460 00:17:35,010 --> 00:17:37,443 because then bugs happen. 461 00:17:38,460 --> 00:17:42,210 And the RFC has a specification that allows for 462 00:17:42,210 --> 00:17:44,580 a standard mechanism for doing non-standard things. 463 00:17:44,580 --> 00:17:46,590 And what that means is that 464 00:17:46,590 --> 00:17:48,240 if you want to add your own functionality, 465 00:17:48,240 --> 00:17:49,620 you wanna add your own custom property 466 00:17:49,620 --> 00:17:50,850 that's not in the RFC, 467 00:17:50,850 --> 00:17:52,380 something a little extra, 468 00:17:52,380 --> 00:17:53,910 you can just add X in front of that, 469 00:17:53,910 --> 00:17:56,520 and that's gonna be taken up as a nonstandard property. 470 00:17:56,520 --> 00:17:58,260 And there's no registration authority for this. 471 00:17:58,260 --> 00:18:00,720 So it's kind of the wild wild west. 472 00:18:00,720 --> 00:18:03,570 You can maybe add like X, I want to start an app. 473 00:18:03,570 --> 00:18:07,410 And if your client is able to look for that property 474 00:18:07,410 --> 00:18:09,000 and it passes that property, 475 00:18:09,000 --> 00:18:09,930 that's good for you. 476 00:18:09,930 --> 00:18:11,730 It's just not gonna be compatible with other clients 477 00:18:11,730 --> 00:18:13,800 that don't support that property. 478 00:18:13,800 --> 00:18:15,000 And in the better days, 479 00:18:15,000 --> 00:18:19,350 when the office applications were fighting for dominance, 480 00:18:19,350 --> 00:18:21,720 I think Microsoft went ham with this. 481 00:18:21,720 --> 00:18:24,360 So this was a really interesting custom property 482 00:18:24,360 --> 00:18:26,670 that I saw with Microsoft office. 483 00:18:26,670 --> 00:18:30,090 They had this autostartcheck property, custom property, 484 00:18:30,090 --> 00:18:32,340 and they also had the collaboratedoc property. 485 00:18:32,340 --> 00:18:34,440 And what the autostartcheck property did 486 00:18:34,440 --> 00:18:36,180 was that when it's time for the event, 487 00:18:36,180 --> 00:18:39,580 it's gonna automatically start the video conferencing app 488 00:18:40,650 --> 00:18:42,720 and the collaboratedoc property. 489 00:18:42,720 --> 00:18:45,900 It just opens any file 490 00:18:45,900 --> 00:18:48,900 when it's time to start the conference. 491 00:18:48,900 --> 00:18:50,340 So this was interesting, 492 00:18:50,340 --> 00:18:51,780 but it's no longer supported 493 00:18:51,780 --> 00:18:54,570 in more recent versions of outlook. 494 00:18:54,570 --> 00:18:56,760 So I had to perform a bit of necromancy, 495 00:18:56,760 --> 00:19:01,760 I had to find windows XP, get office 2003, 496 00:19:02,040 --> 00:19:04,470 and it did work as described, right? 497 00:19:04,470 --> 00:19:08,160 attacker would send an invitation of a ICS file 498 00:19:08,160 --> 00:19:09,690 with these properties set 499 00:19:09,690 --> 00:19:12,150 and immediately trigger opening any file, 500 00:19:12,150 --> 00:19:16,020 even a remote loaded file on the victim's desktop. 501 00:19:16,020 --> 00:19:17,370 And you might see why that's a problem today 502 00:19:17,370 --> 00:19:19,620 because when we have zoom 503 00:19:19,620 --> 00:19:22,230 or some other video conferencing applications today, 504 00:19:22,230 --> 00:19:23,063 that's a huge concern. 505 00:19:23,063 --> 00:19:26,550 You don't want a render to send you a calendar attachment, 506 00:19:26,550 --> 00:19:28,500 and somehow, suddenly your zoom pops up 507 00:19:28,500 --> 00:19:30,060 and you start talking to them 508 00:19:30,060 --> 00:19:31,610 or they start listening to you. 509 00:19:32,820 --> 00:19:36,030 But this goes to show that even back then, 510 00:19:36,030 --> 00:19:37,860 there were different considerations for the properties 511 00:19:37,860 --> 00:19:39,600 that companies were creating 512 00:19:39,600 --> 00:19:41,013 and this led to some issues. 513 00:19:41,850 --> 00:19:43,650 So yeah, you're saying, okay, that's all in the past, 514 00:19:43,650 --> 00:19:45,780 that's all dead history, right? 515 00:19:45,780 --> 00:19:47,910 But we still have zombie properties coming up 516 00:19:47,910 --> 00:19:48,990 and they still exist. 517 00:19:48,990 --> 00:19:52,260 Because there's stuff like backward compatibility. 518 00:19:52,260 --> 00:19:54,960 The difficulty of dealing with legacy code 519 00:19:54,960 --> 00:19:56,880 makes it difficult to fully excise 520 00:19:56,880 --> 00:19:59,040 some of these old properties. 521 00:19:59,040 --> 00:20:01,860 So Microsoft does have another property called 522 00:20:01,860 --> 00:20:05,010 MWSURL, meeting workspaces URL. 523 00:20:05,010 --> 00:20:07,650 And meeting workspaces If you use office 524 00:20:07,650 --> 00:20:09,840 in maybe like five, 10 years ago, 525 00:20:09,840 --> 00:20:11,250 maybe have been bigger thing, 526 00:20:11,250 --> 00:20:13,500 but basically it's kind of a previous iteration 527 00:20:13,500 --> 00:20:16,770 of the meeting stuff that Microsoft did. 528 00:20:16,770 --> 00:20:18,480 Nowadays, we have teams, we have Skype, 529 00:20:18,480 --> 00:20:20,550 but this was something that happened back then. 530 00:20:20,550 --> 00:20:22,620 And this had really interesting behavior 531 00:20:22,620 --> 00:20:26,400 because when you have this property existing in your event 532 00:20:26,400 --> 00:20:28,020 and you respond to the event, 533 00:20:28,020 --> 00:20:30,420 what it's gonna do is gonna take that URL 534 00:20:30,420 --> 00:20:32,310 and it's gonna send a soap message to that. 535 00:20:32,310 --> 00:20:34,110 And depending on how we respond, 536 00:20:34,110 --> 00:20:37,113 the applications gonna behave in pretty strange ways. 537 00:20:38,070 --> 00:20:40,620 So that's something you can look at as well. 538 00:20:40,620 --> 00:20:43,370 Another thing is that it is gonna show this in the GUI, 539 00:20:44,220 --> 00:20:46,380 as a view meeting workspace button. 540 00:20:46,380 --> 00:20:48,360 And if you have kind of played around 541 00:20:48,360 --> 00:20:51,000 with outlook in the past or office applications, 542 00:20:51,000 --> 00:20:54,390 you would know that Microsoft actually sanitizes 543 00:20:54,390 --> 00:20:55,800 a lot of custom URIs 544 00:20:55,800 --> 00:20:56,940 It does this automatically. 545 00:20:56,940 --> 00:20:58,020 It pops up an alert. 546 00:20:58,020 --> 00:20:59,880 If you're gonna click that saying, 547 00:20:59,880 --> 00:21:02,250 oh, it's not HTP or something like that, 548 00:21:02,250 --> 00:21:04,350 but this was able to kind of bypass the check, I guess, 549 00:21:04,350 --> 00:21:07,083 because it was much older code in the code base. 550 00:21:08,133 --> 00:21:10,320 Unfortunately, this was like two months before Follina. 551 00:21:10,320 --> 00:21:13,200 So I wasn't able to use that for the full chain, 552 00:21:13,200 --> 00:21:16,230 but this is another example of where it would be really nice 553 00:21:16,230 --> 00:21:19,170 if you guys told me your custom URL exploit, 554 00:21:19,170 --> 00:21:20,620 that would be really helpful. 555 00:21:21,570 --> 00:21:23,790 Okay. So that's Microsoft, Apple, 556 00:21:23,790 --> 00:21:27,570 Google patented it, Dell custom property. 557 00:21:27,570 --> 00:21:30,780 Google patented away to IFrame widgets in your calendars. 558 00:21:30,780 --> 00:21:33,000 So some of you guys might have used calendar classic. 559 00:21:33,000 --> 00:21:36,300 You might have used Google homepage back in the day. 560 00:21:36,300 --> 00:21:37,200 And that was really fun. 561 00:21:37,200 --> 00:21:39,633 Adding random widgets to your homepage. 562 00:21:40,530 --> 00:21:43,740 And what Google wanted to do was that they wanted people 563 00:21:43,740 --> 00:21:46,970 to have a way to have a word of the day in their calendar, 564 00:21:46,970 --> 00:21:49,260 or maybe whose famous, 565 00:21:49,260 --> 00:21:51,360 which famous person's birthday is it today 566 00:21:51,360 --> 00:21:52,893 because people like that. 567 00:21:53,970 --> 00:21:55,530 And when you can see photographic over there, 568 00:21:55,530 --> 00:21:56,760 that's what it's supposed to look like. 569 00:21:56,760 --> 00:21:59,020 It's basically an IFrame in your calendar 570 00:22:00,180 --> 00:22:02,670 and how that works in the background is that 571 00:22:02,670 --> 00:22:04,650 it is another custom property called 572 00:22:04,650 --> 00:22:06,390 X Google calendar content. 573 00:22:06,390 --> 00:22:08,580 And that means you can load remote content. 574 00:22:08,580 --> 00:22:12,150 You can load image as well as an IFrame URL. 575 00:22:12,150 --> 00:22:15,870 And in today's context, that's also a bad thing. 576 00:22:15,870 --> 00:22:18,300 When you receive an email, most of the time, these days, 577 00:22:18,300 --> 00:22:19,320 the clients are not gonna load 578 00:22:19,320 --> 00:22:20,850 the remote content immediately. 579 00:22:20,850 --> 00:22:22,470 Because there is a privacy concern. 580 00:22:22,470 --> 00:22:23,850 We think about tracking pixels. 581 00:22:23,850 --> 00:22:25,920 We think about anonymization, 582 00:22:25,920 --> 00:22:28,395 but this was not the case for this. 583 00:22:28,395 --> 00:22:29,843 And also when it comes to IFrames, 584 00:22:31,099 --> 00:22:31,932 IFrames are also an issue 585 00:22:31,932 --> 00:22:34,260 because when you wanna securely display IFrame these days, 586 00:22:34,260 --> 00:22:35,880 most of the time you're gonna put them in a sandbox 587 00:22:35,880 --> 00:22:38,220 to disable scripts, stuff like that. 588 00:22:38,220 --> 00:22:39,570 But Google doesn't do that. 589 00:22:40,560 --> 00:22:43,230 So while Google classic doesn't exist today, 590 00:22:43,230 --> 00:22:45,483 Google Calendar classic doesn't exist today. 591 00:22:46,770 --> 00:22:47,793 Classics never die. 592 00:22:48,780 --> 00:22:51,510 There's still parts of Google calendar that still use this, 593 00:22:51,510 --> 00:22:54,360 that still display this. 594 00:22:54,360 --> 00:22:55,830 I think they patched this, 595 00:22:55,830 --> 00:22:57,930 but this is on Google embedded calendar 596 00:22:57,930 --> 00:23:01,050 and various parts of the Google, 597 00:23:01,050 --> 00:23:03,690 you're gonna find this pop up and it's gonna work. 598 00:23:03,690 --> 00:23:07,860 And that's great because say, for example, 599 00:23:07,860 --> 00:23:09,560 if you're gonna view the calendar, 600 00:23:10,650 --> 00:23:13,500 that's gonna pop some dynamic scripts or content for you. 601 00:23:14,340 --> 00:23:15,720 And that's gonna be an issue as well 602 00:23:15,720 --> 00:23:17,190 because end users are not gonna be aware 603 00:23:17,190 --> 00:23:18,270 of what's actually happening. 604 00:23:18,270 --> 00:23:19,860 And as I mentioned earlier, 605 00:23:19,860 --> 00:23:21,810 you can load this all fully remotely 606 00:23:21,810 --> 00:23:23,060 without user interaction. 607 00:23:26,250 --> 00:23:27,900 One interesting thing that Apple is also doing 608 00:23:27,900 --> 00:23:29,223 with custom properties is that, 609 00:23:29,223 --> 00:23:31,620 it's actually jerry-rigging its own data structures 610 00:23:31,620 --> 00:23:33,030 onto eye calendar. 611 00:23:33,030 --> 00:23:36,960 So while browsing say one of my scheduled events, 612 00:23:36,960 --> 00:23:39,480 flight events on my eye calendar, 613 00:23:39,480 --> 00:23:41,070 I notice a couple of things. 614 00:23:41,070 --> 00:23:44,280 I notice X Apple properties, 615 00:23:44,280 --> 00:23:48,120 one of which is the tightly limited format 616 00:23:48,120 --> 00:23:51,240 that added a bit more rich information to my event, 617 00:23:51,240 --> 00:23:53,550 but I also noticed X Apple structured data. 618 00:23:53,550 --> 00:23:56,910 And that was basically a basic four string 619 00:23:56,910 --> 00:24:00,060 that decoded into the binary property list format. 620 00:24:00,060 --> 00:24:01,440 So for those of you who are more familiar 621 00:24:01,440 --> 00:24:02,910 with mac Os internals, 622 00:24:02,910 --> 00:24:06,600 that is basically a proprietary Apple format 623 00:24:06,600 --> 00:24:09,270 that can be decoded further into the property list format 624 00:24:09,270 --> 00:24:12,990 and a property list format can be decoded further into XML. 625 00:24:12,990 --> 00:24:15,420 So you have four layers of abstraction, 626 00:24:15,420 --> 00:24:16,410 four layers of passing, 627 00:24:16,410 --> 00:24:19,260 and four layers of decoding in ICalendar. 628 00:24:19,260 --> 00:24:21,450 That is pretty interesting. 629 00:24:21,450 --> 00:24:23,282 And if you look at it, 630 00:24:23,282 --> 00:24:24,480 the XML basically contains your 631 00:24:24,480 --> 00:24:26,030 flight reservation information, 632 00:24:26,910 --> 00:24:29,758 and there are some interesting things you could do 633 00:24:29,758 --> 00:24:31,530 to tweak what's displayed on the calendar. 634 00:24:31,530 --> 00:24:33,600 But basically this also is supported remotely. 635 00:24:33,600 --> 00:24:36,608 So if you're gonna send someone a calendar invite 636 00:24:36,608 --> 00:24:37,470 and it contains all of these properties, 637 00:24:37,470 --> 00:24:41,410 that's also gonna be rendered in the application 638 00:24:42,450 --> 00:24:44,010 and this leads to a lot of problems. 639 00:24:44,010 --> 00:24:45,630 So I've been dug too deep into this, 640 00:24:45,630 --> 00:24:48,720 but I would definitely fuzz this a lot more 641 00:24:48,720 --> 00:24:52,050 given the various layers of passing. 642 00:24:52,050 --> 00:24:54,900 And I would definitely recommend that people look at this 643 00:24:57,420 --> 00:24:58,770 and next, I'm gonna talk about 644 00:24:58,770 --> 00:25:00,750 interactions with SMTP and CalDAV. 645 00:25:00,750 --> 00:25:04,380 So given that the Apple calendar ICalendar format 646 00:25:04,380 --> 00:25:07,770 has all of these properties, 647 00:25:07,770 --> 00:25:09,780 it doesn't actually work in a vacuum. 648 00:25:09,780 --> 00:25:11,790 So as I mentioned earlier, 649 00:25:11,790 --> 00:25:13,240 when you accept an invitation 650 00:25:14,422 --> 00:25:16,020 on say outlook or another application, 651 00:25:16,020 --> 00:25:17,370 what it really does is that 652 00:25:17,370 --> 00:25:20,190 your client is going to send an email 653 00:25:20,190 --> 00:25:23,610 with an ICS attachment via whichever protocol users. 654 00:25:23,610 --> 00:25:25,230 Most of the time's gonna SMTP, 655 00:25:25,230 --> 00:25:26,730 but maybe if you're doing on a web app, 656 00:25:26,730 --> 00:25:30,003 it's gonna have its own custom API call to HTP, 657 00:25:31,020 --> 00:25:34,050 and it's gonna send it to the organizer property. 658 00:25:34,050 --> 00:25:36,810 And the organizer is gonna pass that in their server. 659 00:25:36,810 --> 00:25:39,120 It's gonna update their own calendar invitation, 660 00:25:39,120 --> 00:25:42,450 and it's gonna send it out to all of the other invites 661 00:25:42,450 --> 00:25:45,693 so that they know who is attending this event. 662 00:25:47,400 --> 00:25:51,003 So my good friend Inti, when I was discussing this with him, 663 00:25:51,960 --> 00:25:55,680 he's really has done some good work in the mailbox space. 664 00:25:55,680 --> 00:25:59,460 You might wonder what happens to that organizer property. 665 00:25:59,460 --> 00:26:00,603 So for that property, 666 00:26:01,560 --> 00:26:03,540 it's gonna be an email and it's gonna paste that 667 00:26:03,540 --> 00:26:05,220 in a SMTP conversation, 668 00:26:05,220 --> 00:26:09,810 SMTP commands basically have a new line limited 669 00:26:09,810 --> 00:26:10,643 kind of commands. 670 00:26:10,643 --> 00:26:12,840 It's kind of like a FTP session if you think about it. 671 00:26:12,840 --> 00:26:14,220 It starts with the handshake. 672 00:26:14,220 --> 00:26:15,600 It starts with mail from, 673 00:26:15,600 --> 00:26:18,840 and it's gonna paste that organizer property value 674 00:26:18,840 --> 00:26:20,640 into the receipt two command. 675 00:26:20,640 --> 00:26:22,830 So who that email is gonna go to. 676 00:26:22,830 --> 00:26:24,180 And Inti had this great suggestion. 677 00:26:24,180 --> 00:26:26,130 He said, how about new lines? 678 00:26:26,130 --> 00:26:27,840 When I heard that? I was like, yeah. 679 00:26:27,840 --> 00:26:28,673 How about new lines? 680 00:26:28,673 --> 00:26:33,330 Because if you deal with protocols and formats, 681 00:26:33,330 --> 00:26:36,780 this is kind of this first thing you kind of look out for. 682 00:26:36,780 --> 00:26:39,060 And it's true because you can craft a 683 00:26:39,060 --> 00:26:43,350 RFC compliant email address with new lines. 684 00:26:43,350 --> 00:26:47,280 And this allows you to inject basically new SMT commands. 685 00:26:47,280 --> 00:26:49,230 So instead of just when a person, 686 00:26:49,230 --> 00:26:51,360 a victim kind of accepts the invitation, 687 00:26:51,360 --> 00:26:54,390 instead of sending an email to the organizer 688 00:26:54,390 --> 00:26:55,560 or so they think. 689 00:26:55,560 --> 00:26:56,460 What's gonna happen is that 690 00:26:56,460 --> 00:26:58,470 you can inject their own SMTP email. 691 00:26:58,470 --> 00:27:00,300 So they can send an email somewhere else. 692 00:27:00,300 --> 00:27:03,690 They might forge an email on your behalf and so on. 693 00:27:03,690 --> 00:27:05,853 So thanks Inti that was a nice one. 694 00:27:06,840 --> 00:27:08,850 And the impact of this really depends on the 695 00:27:08,850 --> 00:27:11,970 SMTP server support, I guess, 696 00:27:11,970 --> 00:27:15,120 because some of them do have soft failure modes. 697 00:27:15,120 --> 00:27:17,580 Some of them do have additional commands that you can use, 698 00:27:17,580 --> 00:27:20,400 but generally are speaking, when it comes to SMTP injection, 699 00:27:20,400 --> 00:27:22,710 you can modify, say the sender, the receiver, 700 00:27:22,710 --> 00:27:24,390 the contents of your email, 701 00:27:24,390 --> 00:27:26,790 and this can lead to some pretty interesting 702 00:27:26,790 --> 00:27:30,543 or terrible interactions with your victim. 703 00:27:32,250 --> 00:27:36,090 Another interesting protocol that ICalendar interacts with 704 00:27:36,090 --> 00:27:37,110 is CalDAV. 705 00:27:37,110 --> 00:27:40,710 So CalDAV is a super set of WebDav, 706 00:27:40,710 --> 00:27:43,500 which is itself a super set of HTP. 707 00:27:43,500 --> 00:27:47,040 And if you intercept the request from your iPhone, 708 00:27:47,040 --> 00:27:48,150 or maybe your mac OS, 709 00:27:48,150 --> 00:27:49,560 you're actually gonna see a lot of this 710 00:27:49,560 --> 00:27:53,520 because Apple still uses CalDAV to sync calendar objects 711 00:27:53,520 --> 00:27:57,360 between your phone and its servers, the iCloud server. 712 00:27:57,360 --> 00:27:58,920 And it's really kind of a legacy format 713 00:27:58,920 --> 00:28:01,080 because it was used back in the day, again, 714 00:28:01,080 --> 00:28:03,570 when syncing between servers wasn't proprietary, 715 00:28:03,570 --> 00:28:05,640 and people wanted to make it work. 716 00:28:05,640 --> 00:28:07,980 Maybe you might have one email client from Yahoo mail 717 00:28:07,980 --> 00:28:11,190 and you wanna sync it with your outlook mail. Right? 718 00:28:11,190 --> 00:28:14,550 So all them used CalDAV back then, 719 00:28:14,550 --> 00:28:16,440 and companies didn't like that. 720 00:28:16,440 --> 00:28:18,690 They don't want things to be compatible nowadays 721 00:28:18,690 --> 00:28:21,180 because they have market power. 722 00:28:21,180 --> 00:28:24,030 Google tried to deprecate it, I think about five years ago. 723 00:28:24,030 --> 00:28:27,060 And basically the developers kind of rose up 724 00:28:27,060 --> 00:28:28,050 and complained about it. 725 00:28:28,050 --> 00:28:30,180 So they said, okay, we won't deprecate it. 726 00:28:30,180 --> 00:28:31,680 We'll try it next year. 727 00:28:31,680 --> 00:28:33,780 So in the documentation they've been saying, 728 00:28:33,780 --> 00:28:35,940 they're gonna deprecate it for a couple years now. 729 00:28:35,940 --> 00:28:38,160 Hasn't really been totally phased out, 730 00:28:38,160 --> 00:28:39,360 but it's still there. 731 00:28:39,360 --> 00:28:43,170 Microsoft itself, If you're familiar with Azure and stuff, 732 00:28:43,170 --> 00:28:47,010 they work with the graph, the new graph protocol, 733 00:28:47,010 --> 00:28:49,420 and that basically creates objects using JSON 734 00:28:50,460 --> 00:28:53,250 but they still use CalDAV in some of their back, 735 00:28:53,250 --> 00:28:56,580 their backward compatibility with clients. 736 00:28:56,580 --> 00:28:59,310 Lark suite is an application created by ByteDance 737 00:28:59,310 --> 00:29:02,790 and they do have support for CalDAV but it's read only. 738 00:29:02,790 --> 00:29:05,670 I think mostly because they use their own proprietary APIs 739 00:29:05,670 --> 00:29:06,900 to update events, 740 00:29:06,900 --> 00:29:09,000 but they use the read only CalDAV 741 00:29:09,000 --> 00:29:12,990 in order to have compatibility with different male clients. 742 00:29:12,990 --> 00:29:14,140 So when you look at it, 743 00:29:15,119 --> 00:29:15,952 CalDAV just provides you 744 00:29:15,952 --> 00:29:18,030 with additional way to inject your properties. 745 00:29:18,030 --> 00:29:21,480 When it came to say Google, 746 00:29:21,480 --> 00:29:23,790 it was a bit difficult for me to bypass, 747 00:29:23,790 --> 00:29:26,550 say the HTP API to inject some of my payloads 748 00:29:26,550 --> 00:29:28,170 into a calendar object. 749 00:29:28,170 --> 00:29:30,540 But when I used the CalDAV protocol, 750 00:29:30,540 --> 00:29:33,450 I was able to just inject it without much problems. 751 00:29:33,450 --> 00:29:35,460 So if you're working with CalDAV 752 00:29:35,460 --> 00:29:36,750 and you're working with ICalendar, 753 00:29:36,750 --> 00:29:38,600 you might also wanna consider using CalDAV 754 00:29:38,600 --> 00:29:40,440 as a way to deliver your payloads 755 00:29:40,440 --> 00:29:42,611 without having to deal with the hassle 756 00:29:42,611 --> 00:29:46,350 of some kind of proprietary API or file format. 757 00:29:46,350 --> 00:29:48,743 And that was something that was really interesting to me. 758 00:29:51,240 --> 00:29:53,670 So that kind of sums up the number of the bugs 759 00:29:53,670 --> 00:29:55,080 that I put out there. 760 00:29:55,080 --> 00:29:57,450 And you might want to think what's going, 761 00:29:57,450 --> 00:30:00,360 what can you do as a user or a creator, 762 00:30:00,360 --> 00:30:02,223 a developer of the icon format? 763 00:30:03,210 --> 00:30:04,590 So, in my opinion, 764 00:30:04,590 --> 00:30:07,170 it seems like what vendors are doing is that 765 00:30:07,170 --> 00:30:09,900 the evolution of icon is gonna be more jerry-rigging. 766 00:30:09,900 --> 00:30:13,050 What we see here with Microsoft is kind of a bridge 767 00:30:13,050 --> 00:30:17,070 between the icon format and the graph API. 768 00:30:17,070 --> 00:30:20,790 So basically it's JSON nested in ICalendar, 769 00:30:20,790 --> 00:30:21,840 and that's basically another type. 770 00:30:21,840 --> 00:30:25,110 And that's basically another key value format 771 00:30:25,110 --> 00:30:27,090 embedded within another key value format. 772 00:30:27,090 --> 00:30:28,860 A lot of these companies are doing this. 773 00:30:28,860 --> 00:30:31,800 They're basically adding their own ways of passing 774 00:30:31,800 --> 00:30:34,320 a special template, special encoding 775 00:30:34,320 --> 00:30:36,150 that's being put in the value format. 776 00:30:36,150 --> 00:30:38,850 So it's no longer just a pure raw text format, 777 00:30:38,850 --> 00:30:39,683 but you can see again, 778 00:30:39,683 --> 00:30:43,470 how this is an interesting attack factor, 779 00:30:43,470 --> 00:30:45,690 because once you have these additional passing, 780 00:30:45,690 --> 00:30:47,760 you can also do pretty interesting injections 781 00:30:47,760 --> 00:30:50,490 depending on what's going on back then. 782 00:30:50,490 --> 00:30:52,830 And you might also think, how can you secure this, right? 783 00:30:52,830 --> 00:30:54,030 Given that you have so many clients 784 00:30:54,030 --> 00:30:55,860 from so many different platforms and frameworks, 785 00:30:55,860 --> 00:30:58,200 and for Microsoft, what they've done is 786 00:30:58,200 --> 00:31:00,810 they've created their own internal passing standards. 787 00:31:00,810 --> 00:31:01,789 They call it the 788 00:31:01,789 --> 00:31:03,870 ICalendar to appointment object Conversion Algorithm. 789 00:31:03,870 --> 00:31:06,630 And it basically is a standard way for them to pass these 790 00:31:06,630 --> 00:31:10,800 from ICalendar into Calendar or event object. 791 00:31:10,800 --> 00:31:13,980 And this is, I think not a bad way to do things, 792 00:31:13,980 --> 00:31:16,530 especially if you have a huge number of clients 793 00:31:16,530 --> 00:31:19,448 and most of your customers are gonna be using 794 00:31:19,448 --> 00:31:20,550 the clients anywhere, 795 00:31:20,550 --> 00:31:22,900 not kind of bridging between different clients. 796 00:31:24,090 --> 00:31:27,690 Another option is to contribute, to open passing standards. 797 00:31:27,690 --> 00:31:30,870 And this is something that I would recommend people do. 798 00:31:30,870 --> 00:31:34,400 I know the Apple's engineer has pushed out a couple of RFCs 799 00:31:34,400 --> 00:31:35,580 in this front, 800 00:31:35,580 --> 00:31:37,020 but this helps to kind of secure things 801 00:31:37,020 --> 00:31:38,730 across the entire ecosystem. 802 00:31:38,730 --> 00:31:42,270 And because I think the RFC for calendar ICalendar, 803 00:31:42,270 --> 00:31:43,440 is not yet complete, 804 00:31:43,440 --> 00:31:46,170 there's still a lot of things missing in how you're passing 805 00:31:46,170 --> 00:31:48,300 or dealing with the eye calendar format 806 00:31:48,300 --> 00:31:50,460 that needs security considerations, 807 00:31:50,460 --> 00:31:53,760 especially since it was written in 1998 and 2009, 808 00:31:53,760 --> 00:31:55,170 a lot of things are missing 809 00:31:55,170 --> 00:31:58,713 in terms of modern privacy and security standards. 810 00:31:59,880 --> 00:32:01,980 Now, of course, I think as a developer, 811 00:32:01,980 --> 00:32:04,470 you wanna stay frugal with nonstandard behavior, right? 812 00:32:04,470 --> 00:32:05,820 back in the early 2000s, 813 00:32:05,820 --> 00:32:08,700 companies went wild with custom properties. 814 00:32:08,700 --> 00:32:10,080 Because they love widgets, 815 00:32:10,080 --> 00:32:13,080 they love all of these kind of shiny extras. 816 00:32:13,080 --> 00:32:14,940 But what I've seen is also that 817 00:32:14,940 --> 00:32:16,200 a lot of these things are really hard 818 00:32:16,200 --> 00:32:18,990 to get out of your system once you support it. Right? 819 00:32:18,990 --> 00:32:21,390 Because you need to have backward compatibility. 820 00:32:21,390 --> 00:32:23,940 You also need to have some of your legacy code 821 00:32:23,940 --> 00:32:25,140 that might be hard to exercise. 822 00:32:25,140 --> 00:32:25,973 And that's, 823 00:32:25,973 --> 00:32:27,750 I think Google was a kind of case in point, 824 00:32:27,750 --> 00:32:31,260 because it might not exist in modern Google calendar, 825 00:32:31,260 --> 00:32:33,720 but it still exists in other parts of the website 826 00:32:33,720 --> 00:32:36,723 that other people can still access and it's not ideal. 827 00:32:38,070 --> 00:32:39,573 And so for researchers, 828 00:32:40,740 --> 00:32:43,140 there's still a lot more properties to research. 829 00:32:44,070 --> 00:32:47,880 I have open sourced database right now. 830 00:32:47,880 --> 00:32:49,170 For some of these properties, 831 00:32:49,170 --> 00:32:50,550 I've only put up a couple right now, 832 00:32:50,550 --> 00:32:52,680 but I think tomorrow I'm gonna put up the rest. 833 00:32:52,680 --> 00:32:55,290 I would really appreciate any contributions to this. 834 00:32:55,290 --> 00:32:57,300 As we dive into, ICalendar standard, 835 00:32:57,300 --> 00:33:00,000 especially since for the end users themselves, 836 00:33:00,000 --> 00:33:00,833 they might not be aware of 837 00:33:00,833 --> 00:33:01,800 what's going on behind the scenes. 838 00:33:01,800 --> 00:33:03,120 And that's always a concern, right? 839 00:33:03,120 --> 00:33:05,430 Because it's doing all these flashy stuff. 840 00:33:05,430 --> 00:33:07,560 It's not always compatible. 841 00:33:07,560 --> 00:33:09,300 Most of it is not compatible. 842 00:33:09,300 --> 00:33:11,970 Most of it is gonna break when you move between standards. 843 00:33:11,970 --> 00:33:13,980 And a lot of it is not documented. 844 00:33:13,980 --> 00:33:15,900 So I think it really helps to kind of document 845 00:33:15,900 --> 00:33:18,270 some of these custom properties, 846 00:33:18,270 --> 00:33:20,100 whether if you're a builder or breaker, 847 00:33:20,100 --> 00:33:21,903 that's gonna help us out a lot. 848 00:33:22,980 --> 00:33:25,710 So, yeah, that's my URL. 849 00:33:25,710 --> 00:33:28,260 And hopefully I can see some contributions. 850 00:33:28,260 --> 00:33:30,030 So thank you very much. 851 00:33:30,030 --> 00:33:31,920 I really appreciate your attention. 852 00:33:31,920 --> 00:33:33,300 I have some, 853 00:33:33,300 --> 00:33:34,133 (Audience Clapping) thank you.