掛馬免殺 DRIVESPLOIT DRIVESPLOIT CIRCUMVENTING AUTOMATED AND AUTOMATED AND MANUAL DETECTION OF BROWSER EXPLOITS OF BROWSER EXPLOITS Wayne Huang, Cofounder & CTO Fyodor Yarochkin Antonio Rohman Fernandez Antonio Rohman Fernandez Chris Hsiao Armorize Technologies, Inc. @waynehuang @ i wayne@armorize.com
108
Embed
Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection
DRIVESPLOIT: CIRCUMVENTING BOTH AUTOMATED AND MANUAL DRIVE-BY-DOWNLOAD DETECTION
This year saw the biggest news in Web security ever--Operation Aurora, which aimed at stealing source code and other intellectual properties and succeeded with more than 30 companies, including Google. Incidence response showed that the operation involved an IE 0-day drive-by-download, resulting in Google's compromise and leak of source code to jump points in Taiwan. The US Government is so concerned that they issued a demarche to the Chinese government.
Using real, live examples, we will show how easy it is to exploit injection-based, XSS-based, and CSRF-based vulnerabilities in FaceBook, Google, Digg, LinkedIn, and other popular websites, and inject drive-by downloads.
If drive-bys are so easy to inject into high-traffic websites, then the question becomes, how easy it is to make them undetectable by automated malware scanning services (such as Google's) and by human manual inspection? We will demonstrate how easy it is to defeat automated detection mechanisms and overview commonly used techniques.
We will reveal for the first time, in this conference, some very advanced techniques that are almost impossible to overcome by automated analysis in the past, now, and in the future. We will release Drivesploit, a drive-by download exploit framework implemented on top of Metasploit. We will go into depth on two particular techniques supported by Drivesploit's a) javascript obfuscation based on behavior-based fingerprinting, and b) javascript timelock puzzles. We will have live demos to show how this technique easily defeats both automated AND manual detection.
At the very beginning of our talk, we will be giving out a digg.com page, which we have infected with a drive-by download created with Drivesploit. Visiting this page with the right browser will trigger the exploit and download a malware that steals browser cookie files. The whole process will be undetectable by antivirus. The actual javascript drive-by code contains a secret phrase. We will give out an ipad to whomever from the audience that is able to correctly deobfuscate the javascript and give out the secret phrase.
Finally, we will present case studies on systems and processes that the largest organizations have put in place in order to fight against Web-based malware. We will also present case studies of our incidence response efforts with organizations hit by Web malware injections such as Google's aurora incident. Based in Taiwan, Co-speaker Wayne has been personally involved in such incidence response efforts since the late 90's.
All source codes related to POC exploits against FaceBook, Google, Digg, LinkedIn, etc, as well as source code of Drivesploit, will be released as open source at the conference.
Attendees will gain the following:
1. Understanding of drive-by downloads and associated terminologies.
2. Information about various drive-by download infection vectors.
3. Appreciation of tools helpful for drive-by analysis, including Malzilla, spikermonkey, rhino, burp and wepawet
4. Realize why drive-by downloads are hard to analyze and detect. Why antivirus fail, why behavior-based approaches fail, and why even manual efforts are difficult
5. Learning the Drivesploit framework and how it can be used to develop poc drive-bys
6. Learning two new deadly techniques: behavior-based browser finterprinting and javascript timelock puzzles
7. Learning how to implement above two using Drivesploit to defeat both automated and manual drive-by analysis
8. Knowledge about the available countermeasures to this threat
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
d l d<script>var sc = unescape("%u9090%u19eb%u4b5b%u3390%u90c9%u7b80%ue901%u0175%u66c3%u7bb9%u8004%u0b34%ue2d8%uebfa%ue805%uffe2%uffff%u3931%ud8db%u87d8%u79bc%ud8e8%ud8d8%u9853%u53d4%uc4a8%u5375%ud0b0%u2f53%ud7b2
var arr = new Array; for (var i = 0; i < sss.length; i ++ ){ arr[i] = String.fromCharCode(sss[i]/7); } varcc=arr.toString();cc=cc.replace(/ ,/ g, "" ); cc = cc.replace(/@/g, ","); eval(cc); var x1 = new Array(); for (i = 0; i <
13
200; i ++ ){ x1[i] = document.createElement("COMMENT"); x1[i].data = "abc"; } ; var e1 = null; function ev1(evt){ e1 = document.createEventObject(evt); document.getElementById("sp1").innerHTML = ""; window.setInterval(ev2, 50); } function ev2(){ p = " \
Dissecting Drive-By Downloads
Page + BrowserExploit!
Exploit ServerPage + Browser
ExploitPayload =
d l d<script>var sc = unescape("%u9090%u19eb%u4b5b%u3390%u90c9%u7b80%ue901%u0175%u66c3%u7bb9%u8004%u0b34%ue2d8%uebfa%ue805%uffe2%uffff%u3931%ud8db%u87d8%u79bc%ud8e8%ud8d8%u9853%u53d4%uc4a8%u5375%ud0b0%u2f53%ud7b2
var arr = new Array; for (var i = 0; i < sss.length; i ++ ){ arr[i] = String.fromCharCode(sss[i]/7); } varcc=arr.toString();cc=cc.replace(/ ,/ g, "" ); cc = cc.replace(/@/g, ","); eval(cc); var x1 = new Array(); for (i = 0; i <
14
200; i ++ ){ x1[i] = document.createElement("COMMENT"); x1[i].data = "abc"; } ; var e1 = null; function ev1(evt){ e1 = document.createEventObject(evt); document.getElementById("sp1").innerHTML = ""; window.setInterval(ev2, 50); } function ev2(){ p = " \
Dissecting Drive-By Downloads
Exploit!Exploits / droppers
Exploit ServerDropper executesExploits / droppers
15
Dissecting Drive-By Downloads
Exploits / droppersExploits / droppers
Exploit ServerMalware
Malware Server
16
Dissecting Drive-By Downloads
Exploits / droppersExploits / droppers
Exploit ServerMalware
Malware Server
17Controller
Dissecting Drive-By Downloads
But who would visit?But who would visit?The key now is TRAFFIC
DESKTOP AND API VERSIONSDIFFER GREATLY IN PERFORMANCE
COST != PERFORMANCE
Antivirus vs. Drive-bys
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit ServerMalware
Malware Server
33Controller
Antivirus vs. Drive-bys
URL Generators Landing SiteJAVASCRIPT
Exploits / droppers
Landing SiteJAVASCRIPT
Exploits / droppers
Exploit ServerJAVASCRIPTMalware
PE BINARYMalware Server
PE BINARY
34Controller
Antivirus vs. Drive-bys
URL Generators Landing SiteJAVASCRIPT
Exploits / droppers
Landing SiteJAVASCRIPT
Exploits / droppers
Exploit ServerJAVASCRIPTMalware
PE BINARYMalware Server
PE BINARY
We will detect35Controller
We will detect this part!!
Why we can’t rely on PE detection
• Exploit server domains are often taken down after a few days, but the injected URL generators and the exploit servers live on– Attack reported to the hosting / registrar
– Domain banned by ISPs
Purchased duration was over– Purchased duration was over
• We want to detect the injection so our customers We want to detect the injection so our customers can remove it
• Actually statically detecting javascript exploits is • Actually, statically detecting javascript exploits is quite difficult
36
THE TAO:THE TAO:ECMA SCRIPTSECMA-SCRIPTS
JAVASCRIPTJAVASCRIPTVBSCRIPTVBSCRIPTADOBE JS
ACTIONSCRIPT37
JAVASCRIPT!! (ECMA-SCRIPT)
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit ServerMalware
Malware Server
38Controller
JAVASCRIPT!! (ECMA-SCRIPT)
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit ServerMalware
39Controller
JAVASCRIPT!! (ECMA-SCRIPT)
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit Server
40Controller
JAVASCRIPT!! (ECMA-SCRIPT)
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit Server(METASPLOT)(METASPLOT)
41Controller
JAVASCRIPT!! (ECMA-SCRIPT)
URL Generators Landing Site
Exploits / droppers
Landing Site
Exploits / droppers
Exploit Server(METASPLOT)
PAYLOAD(METASPLOT)meterpreter
(memory(memoryinjection)
42Controller
Drive-By wants to…
• Avoid detection at the victim's desktop
• Avoid detection by UTM/gatewaysAvoid detection by UTM/gateways• Avoid detection
Shellcode <button id='j id'Shellcode <button id j_id onclick='bootstrapper();' style='display:none'></butt
M Corrupt on>
………
Heapspray…
document.getElementById(Trigger'j_id').onclick();
gg
JAVASCRIPT EXPLOIT DISEC
ShellcodeShellcodeOBFUSCATED
M Corrupt BLOB
Heapspray
TriggerDE‐
OBFUSCATORgg OBFUSCATORPrimitiveF
ObfuscatedFForm Form
Dissecting Drive-By Downloads
Page + BrowserExploit!
Exploit ServerPage + Browser
ExploitPayload =
d l d<script>var sc = unescape("%u9090%u19eb%u4b5b%u3390%u90c9%u7b80%ue901%u0175%u66c3%u7bb9%u8004%u0b34%ue2d8%uebfa%ue805%uffe2%uffff%u3931%ud8db%u87d8%u79bc%ud8e8%ud8d8%u9853%u53d4%uc4a8%u5375%ud0b0%u2f53%ud7b2
var arr = new Array; for (var i = 0; i < sss.length; i ++ ){ arr[i] = String.fromCharCode(sss[i]/7); } varcc=arr.toString();cc=cc.replace(/ ,/ g, "" ); cc = cc.replace(/@/g, ","); eval(cc); var x1 = new Array(); for (i = 0; i <
54
200; i ++ ){ x1[i] = document.createElement("COMMENT"); x1[i].data = "abc"; } ; var e1 = null; function ev1(evt){ e1 = document.createEventObject(evt); document.getElementById("sp1").innerHTML = ""; window.setInterval(ev2, 50); } function ev2(){ p = " \
JAVASCRIPT EXPLOIT DISEC
ShellcodeShellcodeOBFUSCATED
M Corrupt BLOB
Heapspray
TriggerDE‐
OBFUSCATORStart gg OBFUSCATORPrimitiveF
ObfuscatedFForm Form
JAVASCRIPT EXPLOIT DISEC
ShellcodeShellcodeOBFUSCATED
M Corrupt BLOB Mutate
HeapsprayMutate
TriggerDE‐
OBFUSCATORStart gg OBFUSCATORPrimitiveF
ObfuscatedFForm Form
JAVASCRIPT EXPLOIT DISEC
ShellcodeShellcodeOBFUSCATED
M Corrupt BLOB Mutate
HeapsprayMutate
TriggerDE‐
OBFUSCATORStart gg OBFUSCATORPrimitiveF
ObfuscatedFPreventForm FormPrevent
MUTATION FEATURESIMPLEMENTEDSO FARSO FAR
1. Javascript Random Variable Auto ReplacementReplacement• Accepts a piece of javascriptp p j p• Parses the javascript according to
grammergrammer• Auto replaces all variable names and
function names with random namesfunction names with random names• Passes back:
a) the new javascriptb) a vector of old-new name mappings) pp g
1. Javascript Random Variable Auto Replacementrandomized =
5. Fingerprinting-Based Encryption Summary• "This exploit works only for IE6"• This exploit works only for IE6• "Give me an encrypted version of my
j i t l it”javascript exploit”• "Give me javascript to generate the
decoding key"• "The key is only correctly generated if the y y y g
javascript is run under IE6"
94
5. Fingerprinting-Based Encryption Summary
A=Check1();
B=Check3();B=Check3();
C=Check4();
D=Check6();D Check6();
E=Check8();
F=Check9();();
G=Check12();
H=Check14();
95
5. Fingerprinting-Based Encryption Summary
A=Check1();
B=Check3();
A=Check6();
B=Check12();B=Check3();
C=Check4();
D=Check6();
B=Check12();
C=Check8();
D=Check1();D Check6();
E=Check8();
F=Check9();
D Check1();
E=Check4();
F=Check14();();
G=Check12();
H=Check14();
();
G=Check3();
H=Check9();
96
5. Fingerprinting-Based Encryption Summary
A=Check1();
B=Check3();
A=Check6();
B=Check12();One‐time key
B=Check3();
C=Check4();
D=Check6();
B=Check12();
C=Check8();
D=Check1();D Check6();
E=Check8();
F=Check9();
D Check1();
E=Check4();
F=Check14();
Encryptjavascript
l();
G=Check12();
H=Check14();
();
G=Check3();
H=Check9();
exploit
Generatedecoding
97
decodingjavascript
Why not Anti-Virus?
• AV is to install on desktops / notebooksp• Complicated normal behaviors• Strict resource constraints• Strict resource constraints• Therefore, AV and gateway vendors rely
LIGHTWEIGHT and ACCURATE– LIGHTWEIGHT and ACCURATE
• Why can’t such technology used to detect drive-by-downloads?drive-by-downloads?
98
Javascripts are not harmfult th i tto the environment…
99
… so they are usually not reused
AV no good because drive-by-downloads are in:g y• Disposable Javascript• Disposable PDF Adobe JS• Disposable PDF Adobe JS• Disposable Flash actionscript• All ECMA-
scriptsscripts
100you don't usually reuse them…
Javascript Packing Is a NormJavascript Packing Is a Norm• Packing is widely used by legitimate code!
– To protect javascript source codeTo protect javascript source code– To reduce javascript size
• Google Closure Compilerhttp //code google com/clos e/compile /– http://code.google.com/closure/compiler/
• Yahoo Javascript Packer (YUI Compressor)– http://developer.yahoo.com/yui/compressor/ p // p y /y / p /
• Advanced HTML Protector– http://www.creabit.com/htmlprotect/D Ed d ’ P k• Dean Edwards’ Packer– http://dean.edwards.name/packer/
l b ff h3. Little but effective techniques– Sleep(30000); //using SetTimeout– Timelock puzzles
104
Future Work
• Randomly chop up scripts and split into d d l f lindividual files
• Generating VBscript instead of javascriptg p j p• Encrypting
using datausing dataexistingoutside ofHTML– HTTP headers
Discussion
• The Panopticlick experiment by p p yEckersley of EFF– 94.2% of "typical desktop browsers” are uniqueyp p q
• Can fingerprinting-based encryption be integrated with this type of be integrated with this type of individual fingerprinting, to prevent detection and analysis of target detection and analysis of target attacks?
• Sebastian Porst, How to really obfuscate your , y yPDF malware http://www.slideshare.net/cblichmann/how-to-really-obfuscate-your-pdf-malware
• Jeremy Chiu, 0box analyzer: afterdarkJeremy Chiu, 0box analyzer: afterdarkruntime forensics for automated malware analysis and clustering http://www.slideshare.net/wayne_armorize/0-box-analyzer-ft d k ti f i f t t d l l i dafterdark-runtime-forensics-for-automated-malware-analysis-and-
clustering-2
• HeapLib support added to Metasploit 3 http://blog metasploit com/2007/04/heaplib support added tohttp://blog.metasploit.com/2007/04/heaplib-support-added-to-metasploit-3.html