S&P'12 : Safe Loading - A Foundation for Secure Execution of Untrusted Programs

"Safe Loading - A Foundation for Secure Execution of Untrusted Programs" is the paper publish in S&P'12. Paper authors are Mathias Payer,Tobias Hartmann and Thomas R. Gross ,from ETH Zurich, Switzerland ETH.

There are many sanbox system employ BT(binary translation) to instrument application's system call. Libdetox, Vx32, Strata all belong to this type. To make decision if the program can be executed, research about policy-based system call authorization have been published. Moreover , full system virtualization, system call interposition also can isolate application.

This paper proposes a system to solve two problem that current SFI(software-based fault isolation) frameworks have. First is that sanbox can be attacked through dynamic loader.The second is that application inside sanbox must have privilege to map code into memory.

First problem presents due to complexity of loader. Current standard loader employ many functionality like debugging and  call tracing. Exploiting bug of loader , privilege escape can be achieve with SUID program.  
Secondary, the standard loader is responsible to map code include BT itself to memory which leaks information about BT. In addition, sanbox has no information about executable and data layout in memory.

In order to solve these two problems , this paper proposed SFI framework that replace standard loader by a lightweight secure loader and move secure loader into sandbox. Sandbox divide application into two domain, sandbox domain(secure loader and sandbox) and application domain. In sandbox domain, it can ensure only checked code loaded. Every applications run in application domain must be examined first and indirect control flow transfer will be checked by sandbox domain.

This framework have following three benefits:

1. Restricting Privilege Escalation Attack
   The light-weight loader will not suffer from complexity of standard loader.Without feature like debugging, backwards compatibility, secure loader only need to relocate code and thus reduce attack vector.
2. Protecting All Executed Application Code
   All code run in application domain must use well-define API communicating to sandbox domain which can reduce attacker gathering information about loader.
3. Opening the Loader Black Box
   With information shared by loader, sandbox can distinguish code region and data region.Therefore sandbox can provide trusted execution. 

 

HIT2012 Wargame Writeup : Binary 7

This is Binary 1 writeup in HITCON 2012. Binary1 is the easiest binary problem. This problem give an executable and make you read the key.
It is easy to use IDA pro to inspect program flow which create 10 thread and write something to file "key.txt". So it is easy to guess that content wrote in "key.txt" is the answer.

Flow of t100.exe

There are decompile code that each thread.

Those threads sleep some times of a random number then print some characters to file.But without give rand function a seed, all random number produced in each thread is the same.So we can easily sort the characters in each thread by there sleep and get the key.

Hook CreateFile by pydbg

For malware analysis , file access is an important factor to understand what malware do. Therefore in this article, I write a small program that can hook windows createfile API.

TOOL

 I use pydbg to develop this program. pydbg is an subproject of paimei which is a well-known reverse engineering tool.

https://github.com/OpenRCE/pydbg/

https://github.com/OpenRCE/paimei/

It is not easy to install pydbg. During installing pydbg, I have encountered following error, and there are some articles solve those problems.

1.      pydasm not found

        Because pydbg need a decompiler, so we need to install pydasm first. Pydasm source can be found here. https://code.google.com/p/libdasm/. Then remove pydasm.pyd in pydbg source.

2.      unable to find vcvarsall.bat

This is due to lower version of VS compiler. We can solve this problem by install higher version of VS or use mingw instead.

http://sourceforge.net/projects/mingw/

3.  gcc: error: unrecognized command line option '-mno-cygwin'

   Option '-mno-cygwin' has been removed in gcc options.So we just remove '-mno-cygwin' in ‘distutils\cygwinccompiler.py’

http://stackoverflow.com/questions/6034390/compiling-with-cython-and-mingw-produces-gcc-error-unrecognized-command-line-o

http://code.google.com/p/malware-analysis/wiki/Installation

http://netsec.ccert.edu.cn/bobo/2012/06/12/%E5%AE%89%E8%A3%85pydbg-pydasm/

http://www.diybl.com/course/3_program/python/20110829/559096.html

program review

Due to dynamic link of createfile API, we cannot resolve address of createfile at program start. Therefore we need to hook createfile API once kernel32.dll loaded.

We write a call back function load_dll () which is triggered when dll load. And we use dbg.set_callback(LOAD_DLL_DEBUG_EVENT, load_dll) to register callback of DLL loading. In function load_dll (), we should check if kernel32.dll was loaded and hook createfile API(CreateFileW) .

file_hook.py

from pydbg import *

from pydbg.defines import *

import utils

import sys

import os

from ctypes import *

is_hook = 0

def FileCreateHook( dbg, args ):

    buffer  = ""

    offset  = 0

    while 1:

        byte = dbg.read_process_memory( args[0] + offset, 2 )

        if not ( ord(byte[0])==0 and ord(byte[1])==0) :

            buffer  += byte

            offset  += 2

            continue

        else:

            break

    print unicode(buffer,"utf-16")

    return DBG_CONTINUE

########################################################################################################################

def load_dll (pydbg):

    last_dll = pydbg.system_dlls[-1]

    print "loading:%s into:%08x size:%d" % (last_dll.name, last_dll.base, last_dll.size)

    global is_hook

    if is_hook==0 :

        

        global hooks   

        hooks = utils.hook_container()

        hook_address  = pydbg.func_resolve_debuggee("kernel32.dll","CreateFileW")

        print hook_address

        if hook_address:

            res = hooks.add( pydbg, hook_address, 7, FileCreateHook, None)

            is_hook =1

            print res

            print "[*] CreateFileW hooked at: 0x%08x" % hook_address

        else:

            print "[*] Error: Couldn't resolve hook address."

    return DBG_CONTINUE

dbg = pydbg()

dbg.set_callback(LOAD_DLL_DEBUG_EVENT, load_dll)

dbg.load(sys.argv[1])

is_hook =0

hooks=None

dbg.debug_event_loop()

reference

http://hi.baidu.com/fandango/item/f0b88f92a4bcb518934f4140

http://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx

http://www.openrce.org/forums/posts/760

http://paimei.googlecode.com/svn-history/r7/prototype_data_flow_tracker.py

Malware Analysis : Trojan:AutoIt/Ransom.F

This malware has free sample and analysis report in malware.lu. So I try to analysis this sample as practice.
When I am analyzing this  sample , it had detection rate 14/40 at VirusTotal
This malware come with icon as following image , which give us hint that this malware is compiled by AutoIt :

After this sample execution , it will connect to 95.163.104.88 which website was already removed.And this network activity can be cached by our tool. So we can observe that it connect to 95.163.104.88/spielberg/start.php.

Sometimes there is an pop-up windows during execution :

 We can also observe it change some file in following image:

This malware are packed by UPX.  We can easily unpacked it and get origin executable.

Then we use exe2aut to decompile the sample , and retrieve AutoIt scipt.

The most interesting part is at end of script , it install some registry to trigger itself after booting.But this behavior is not detect by our tool. Then it check if explore.exe and taskmgr.exe existed to ensure it's GUI in top of windows.

This sample can not run by both anubis and cwsanbox.

WDK Minifilter Driver

In order to develop a driver for lab project , I try to review code in WDK source. After a very short view , I found there are some example code which are worthy to read.For example, In source code of Minifilter Driver(scanner.c), the author state that "This filter scans the data in a file before allowing an open to proceed.  This is similar to what virus checkers do."

Minifilter can ....

To use Minifilter , first we need to construct a FLT_REGISTRATION  structure.Here is examples in WDK.


const FLT_REGISTRATION FilterRegistration = {
    sizeof( FLT_REGISTRATION ),         //  Size
    FLT_REGISTRATION_VERSION,           //  Version
    0,                                  //  Flags
    ContextRegistration,                //  Context Registration.
    Callbacks,                          //  Operation callbacks
    ScannerUnload,                      //  FilterUnload
    ScannerInstanceSetup,               //  InstanceSetup
    ScannerQueryTeardown,               //  InstanceQueryTeardown
    NULL,                               //  InstanceTeardownStart
    NULL,                               //  InstanceTeardownComplete
    NULL,                               //  GenerateFileName
    NULL,                               //  GenerateDestinationFileName
    NULL                                //  NormalizeNameComponent
};


Third member of FLT_REGISTRATION  is an FLT_CONTEXT_REGISTRATION which define context type. And Callbacks is an FLT_OPERATION_REGISTRATION structure to register call back operator.Following is examples of this two structure.


const FLT_CONTEXT_REGISTRATION ContextRegistration[] = {
    { FLT_STREAMHANDLE_CONTEXT,
      0,
      NULL,
      sizeof(SCANNER_STREAM_HANDLE_CONTEXT),
      'chBS' },

    { FLT_CONTEXT_END }
};
[structure explain]

const FLT_OPERATION_REGISTRATION Callbacks[] = {

    { IRP_MJ_CREATE,
      0,
      ScannerPreCreate,
      ScannerPostCreate},

    { IRP_MJ_CLEANUP,
      0,
      ScannerPreCleanup,
      NULL},

    { IRP_MJ_WRITE,
      0,
      ScannerPreWrite,
      NULL},

    { IRP_MJ_OPERATION_END}
};
[structure explain]

The most interesting part is ScannerPostCreate function.Then we move to ScannerPostCreate function and take a look.
This function check file extension then call ScannerpScanFileInUserMode function. If the return value safe, then we leave it for write check.Otherwise , use FltCancelFileOpen to cancel file open operator.

In function ScannerpScanFileInUserMode ,  it calls FltReadFile function to read file content to buffer then pass it to user space by FltSendMessage.And user space program is responsible for scanning the content.

[How to communicate between user space and kernel space]
 

HIT2012 Wargame Writeup : Binary 1

This writeup is about problem Binary 1 in HITCON 2012.
There is the description about  Binary 1:
Kenny 意外地從探險家手上獲得了一張海外的藏寶圖，但看起來似乎失去了下半部分，你能幫助他找到寶藏嗎??
And there is a kenny.zip  provided , which contain a Keyexe.jpge file inside.

We can observe that Keyexe.jpge can open by double-click , but can not open by image editor such as paint.So we can infer that Keyeze.jpge is not a jpge file but an exe file , which use windows reverse file name method to hind itself.[資料補充~~] 

After change the file name to key.exe, we can open it by debugger(because origin filename include invalid character).

We can find out that jpge file showed is 2.jpge in temp directory. After short analyse , we can find out there are 3 files create while execution.Those files are 1.jpge,2.jpge and SYS. 1.jpge is an image file contain "ioctl: 6666" message.SYS is device driver. Now we can guess next step is to register this device and send 6666 message to it through IOCTL.

By using IDA or ollydbg , we can find device name is Kenny.Then we can write a small program to send message to driver.Then driver will response "Boracay.exe" in debug message. Finally we change the original executable's  filename to Boracay.exe and execute it.The key "hey it nice" will displayed in DebugView.
[補充圖片]


ps. thanks for kost0911's sharing .He's article help me to find out device name , so I can complete this problem.
http://kost0911.pixnet.net/blog/post/91590907  

HIT2012 Wargame Writeup : Mobile 1

There was a new catalog - Mobile added in this year HIT wargame. Although there are two problem in this  catalog , it can point out that mobile security is future trend in security.

Mobile 1 is an easy problem , there are only two things need to do.

First , unzip the apk file. Then open files one by one , then we can find some string in META-INF/CERT.RSA ."What is the guy's nickname in base64 format?" .So we can find the guy's nickname in article and encode it as base64 to get the key.

Reference to wiki , CERT.RSA is the certificate of the application