full-disclosure - Re: Binary Planting Goes "Any File Type"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <38DB4C30-BDB1-408E-AC3C-FA4BA69D719A@acrossecurity.com>
Date: Sat, 9 Jul 2011 16:37:37 +0200
From: Mitja Kolsek <mitja.kolsek@...ossecurity.com>
To: Mario Vilas <mvilas@...il.com>
Cc: "security@...ossecurity.com" <security@...ossecurity.com>,
	"si-cert@...es.si" <si-cert@...es.si>, "cert@...t.org" <cert@...t.org>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Binary Planting Goes "Any File Type"

Hi Mario -

> Actually you *can* launch an executable that way, if you add a couple
> more clicks afterwards, or you right click on the file and choose a
> non default menu option. It's no more ridiculous than any other social
> engineering that requires people to hit a hotkey they probably never
> heard of and browse all the way to your malicious file...

This example merely provided one of possible alternatives to double-clicking a file, which I understood was one of Dan's major objections. Yes the example was over the top but also yes, it would work against some users who otherwise wouldn't double-click on a file. Attackers care about that.

Sure these attacks require some social engineering, but the research is not over. I'd like to refer you to http://blog.acrossecurity.com/2011/06/com-server-based-binary-planting-proof.html?m=1 for an example of how further research can reduce social engineering to mere visiting of malicious web page and two clicks on links on that page.

> IMHO what you're reporting is a great way to improve social
> engineering attacks. But you should flag it as such rather than
> calling it a 0day just for the sake of the fancy word. This is not a
> demerit of your work in any way, it's just a matter of using the
> proper vocabulary.

I fail to find the word "0day" in the blog post or my emails. Am I missing something?

Cheers,
Mitja


> 
> On Sat, Jul 9, 2011 at 1:11 AM, Mitja Kolsek
> <mitja.kolsek@...ossecurity.com> wrote:
>> Ok, Dan, just for you:
>> 
>> Launch Internet Explorer 9 on Windows 7 (probably other IE/Win works too), go to File->Open (or press Ctrl+O), browse to Test.html and open it. No double-clicking and you couldn't launch an executable this way. Better?
>> 
>> Cheers,
>> Mitja
>> 
>> On Jul 8, 2011, at 9:10 PM, Dan Kaminsky <dan@...para.com> wrote:
>> 
>>> And here's where your exploit stops being one:
>>> 
>>> ===
>>> Suppose the current version of Apple Safari (5.0.5) is our default web
>>> browser. If we put the above files in the same directory (on a local
>>> drive or a remote share) and double-click Test.html, what happens is
>>> the following:
>>> ===
>>> 
>>> At this point, Test.html might actually be test.exe with the HTML icon
>>> embedded.  Everything else then is unnecessary obfuscation -- code
>>> execution was already possible the start by design.
>>> 
>>> This is a neat vector though, and it's likely that with a bit more
>>> work it could be turned into an actual RCE.
>>> 
>>> On Fri, Jul 8, 2011 at 10:38 AM, ACROS Security Lists <lists@...os.si> wrote:
>>>> 
>>>> We published a blog post on a nice twist to binary planting which we call "File
>>>> Planting." There'll be much more of this from us in the future, but here's the first
>>>> sample for you to (hopefully) enjoy.
>>>> 
>>>> http://blog.acrossecurity.com/2011/07/binary-planting-goes-any-file-type.html
>>>> 
>>>> or
>>>> 
>>>> http://bit.ly/nXmRFD
>>>> 
>>>> 
>>>> Best regards,
>>>> 
>>>> Mitja Kolsek
>>>> CEO&CTO
>>>> 
>>>> ACROS, d.o.o.
>>>> Makedonska ulica 113
>>>> SI - 2000 Maribor, Slovenia
>>>> tel: +386 2 3000 280
>>>> fax: +386 2 3000 282
>>>> web: http://www.acrossecurity.com
>>>> blg: http://blog.acrossecurity.com
>>>> 
>>>> ACROS Security: Finding Your Digital Vulnerabilities Before Others Do
>>>> 
>>>> 
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>> 
>> 
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>> 
> 
> 
> 
> -- 
> “There's a reason we separate military and the police: one fights the
> enemy of the state, the other serves and protects the people. When the
> military becomes both, then the enemies of the state tend to become
> the people.”
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/