Cатсн²² (in)sесuяitу / ChrisJohnRiley

Because we're damned if we do, and we're damned if we don't!

ShmooCon 2012: Raising The White Flag

Raising The White Flag

:: Bypassing Application White Listing

– Curt Shaffer and Chris Cuevas

NOTE: The video of this talk has now been made available over at the ShmooCon website.

More and more people are seeing application whitelisting in their environments. Despite what marketing people say, these solutions don’t stop APT and other advanced threats. This talk is designed to shine a light on the issues with whitelisting.

Whitelisting is often touted as a replacement for AV. Despite the fact that something better than AV is needed, application whitelisting isn’t the solution. Their purpose seems good, for the execution is lacking. Things are headed in the right direction, but using simple bypass techniques it’s possible to bypass these whitelisting protections.

The following application whitelisting tools were tested.

  • Bit9 Parity 6.0.0
  • McAfee Application Protection
  • Microsoft Applocker

Methodology

  • Windows File Protection
  • File Naming Fun
  • Iexpress packagng
  • Java Exploits/Malware
  • Flash Exploits/Malware
  • Adobe Exploits/Malware
  • JavaScript
  • VBA
  • Raw Shellcode
  • Powershell
Some other things were excluded due to time constraints (including HTML5, CD-ROM ISO masquerading, Digitally Signed Malware).

Bypassing Techniques Attempted

  • ActiveX
  • PDF attacks
    • Spawning shell
  • Office documents
    • VBscript Macros
  • Shellcodexec
    • Inject shellcode into memory
  • JAVA
    • Applet
    • Exploit
  • JavaScript
    • BeEF hook
    • Firefox Extension
  • Powershell
    • Run script by piping into powershell.exe
    • DLL Injection
    • Shellcode injection
    • Chrome Extension
  • Man-in-the-Middle
    • Sniff, modify, replay
This is all know. We’ve been pissing on AV for a long time. Time to piss on whitelisting as well.

Results

McAfee

Most things worked, except Windows File Protection and Iexpress.

Bit9

Inconsistent results with Windows File Protection, and again Iexpress failed. However everything else works.

What Worked

JavaScript

Injecting BeEF into a browser process

Windows Help Files

Compiled HTML, but needs a degree of social engineering to get people to click

Can run cmd.exe and game over

Office Documents

Lots of work in this area by Didier Stevens

Powershell

Powershell code injection into any 32bit or 64 bit

Powershell syringe

Man-in-theMiddle

Get between the client and server

ARP spoof, iptables redirect

It’s HTTPS, but it doesn’t check the cert

Enables you to drop level from enforce blocks to only alert

Self protection

Abilty to inject code into the actual whitelisting exe (in this case parity.exe of Bit9)

Bit9 deny this is an issue.

[ demo of shellcode exection within the Bit9 Notifier process ]

Metasploit module for this will be released to demo this.

Stopping this attack

To protect this on Bit9, go to the admin control panel and add memory rules to protect the notifier.exe process. The memory protection menu is only available in versions above 6.0.1.

Links:

  • Talk abstract –> HERE
  • (NEW) Further Information from the talk –> HERE
  • (NEW) Video of the talk –> HERE
About these ads

9 responses to “ShmooCon 2012: Raising The White Flag

  1. Wes Miller (@getwired) January 29, 2012 at 00:42

    I’m assuming you meant AppLocker (whitelisting), not BitLocker (disk encryption). Might want to change the text.

  2. ChrisJohnRiley January 29, 2012 at 15:53

    Yeah thanks… typing quicker than thinking (not difficult in my case) ;)

  3. Pingback: Week 4 in Review – 2012 | Infosec Events

  4. Hungry Man February 1, 2012 at 18:00

    Any results for AppLocker?

  5. ChrisJohnRiley February 2, 2012 at 13:54

    The speakers didn’t cover the specifics on AppLocker, hopefully they’ll release some further information soon.

Follow

Get every new post delivered to your Inbox.

Join 126 other followers

%d bloggers like this: