CSSR: Automatic Detection of Unsafe Component Loadings MURI Earl T. Barr Taeho Kwon Zhendong Su. Helix

Transcription

1 CSSR: Automatic Detection of Unsafe Component Loadings MURI 2010 Earl T. Barr Taeho Kwon Zhendong Su Helix

2 Helix Integration Metamorphic Shield Precise Signatures, Patches, Re-Diversification, Validated Repairs, Fast Signatures, Reconfiguration,... S o f t w a r e Proactive Actions Innate Response Adaptive Response Analysis Transforms Deployed System Detection Rapid Response Diagnosis Repair Application Information Repository 2

3 Dynamic Component Loading System level mechanism for component interoperation Lazily load components as needed Modularity In memory component (library) sharing Customization Plugin Architecture: Steinberg s Virtual Studio Technology (VST) 3

4 Component Interoperation ADLL A.DLL LoadLibrary ( B.DLL ) 1. Resolution B.DLL 3. Usage B.foo() 2. Loading B.DLL Software 4

5 Component Hijacking ADLL A.DLL Intended B.DLL LoadLibrary ( B.DLL ) 3. Usage B.foo() 1. Unintended resolution Malicious B.DLL 2. Loading Malicious B.DLL Software 5

6 Remote DLL load Hijacking Attack (MS09 014) 1. Connect to malicious web server Malicious web server 2. Automatically download a DLL onto Desktop Safari web browser Carpet Bomb Attack Internet Explorer 3. Load and execute that DLL (Remote Code Execution) DLL load Hijacking Benign web server 6

7 No Trivial Solution Restricting searchable directories Impedes customization Steinberg s Virtual Studio Technology Breaks backward compatibility C:\Windows\System \ Vs. C:\Windows\System 32 9X/ME NT/2K/XP/Vista Does not address resolution failures 7

8 Contributions First automated technique to detect unsafe component resolution Extensive study of unsafe DLL resolution in Microsoft Windows Unsafe DLL resolution is prevalent Remote attacks exist 8

9 Component Resolution Fullpath LoadLibrary( C:\Windows\System32\kernel32 C:\Windows\System32\kernel32.dll dll ) ) Resolved component: C:\Windows\System32\kernel32.dll Filename LoadLibrary( midimap.dll ) Directory search order = C:\Program Files\itunes; C:\Windows\system32;C:\Windows\system; C:\Windows;.;$PATH Resolved component: C:\Windows\system32\midimap.dll 9

10 Unsafe Component Resolution A.DLL No B.DLL Malicious Resolution Failure Malicious B.DLL Intended B.DLL directory directory directory Directory search order Resolution Hijacking 10

11 Detection Framework executables Resolution Tracer profiles Unsafe Resolution Checker Result Dynamic Profile Generation Offline Profile Analysis Dynamic Profile Generation Captures DLL resolutions into profiles Instrument program execution Offline Profile Analysis Checks safety conditions of each resolution 11

12 Example Resolution Failure Resolution failure Resolving HPProfiler.dll fails Hijacking: Place the HPProfiler.dll into any searched directory 12

13 Example Resolution Hijacking Resolution searches the itunes directory before finding midimap.dll Hijacking: Place midimap.dll dll in C:\Program Files\iTunes 13

14 Evaluation Goals Prevalence and severity of unsafe resolution Implementation A tool for Microsoft Windows XP SP3 / Vista SP1 28 applications from major vendors MS Office, browser, PDF reader, messenger, image viewer, multimedia player, and others 14

15 Prevalence Software XP Vista Software XP Vista Access Google Talk Beta Excel Pidgin Onenote Skype Outlook Windows Live Messenger PowerPoint P t Yh Yahoo!!Messenger Visio IrfanView Word Picasa Chrome Itunes Firefox Quick Time Internet Explorer Realplayer Opera Winamp Safari Windows Media Player Acrobat Reader Google Desktop Foxit Reader Google Earth

16 Unsafe Resolution Distribution Resolution Failure: 39 Resolution Failure: 55 Resolution Hijacking: 747 Resolution Hijacking: 927 Windows XP: 786 Windows Vista:

17 Resolution Failures Type Fullpath Filename XP Vista XP Vista Application DLL Third party component DLL Language support DLL Unsupported system DLL Google Desktop / HP Printer Pi driver di make MS Word vulnerable WinampandDWMAPI and DWMAPI.DLL DLL inwindows XP Only supported in Windows Vista Foxit and RPAWINET.DLL in Windows Vista Not included in default Windows Vista release 17

18 Resolution Hijacking DLL hijackable directory XP Vista Application directory Application library directory System directory 2 4 Current directory 1 1 Part of $PATH 1 1 Plug in directory 6 7 WBEM directory Di Driver directory System hook source directory Resolved directory XP Vista System directory Application library directory Application plug in directory 1 3 Application directory

19 Remote Resolution Hijacking Attacks Condition for attack Ability to remotely write a malicious DLL into a hijackable directory Most Windows users run as administrator Focused on resolution failures involving the current directory (. ) 19

20 Document with Component Attack 1. Send the archive to victim Attacker MS Word document + HPProfiler.DLL HP Printer user 4. Load the DLL 2. Extract the archive 3. Open the document 20

21 Discovered Vulnerabilities OS Software DLL name Precondition XP/Vista Microsoft Word/ PowerPoint 2007 HPProfiler.dll GoogleDesktopCommon.dll HP Printer Driver Google Desktop Vista Foxit Reader 3.0 rpawinet.dll Microsoft has confirmed these Word and PowerPoint vulnerabilities Third party components arethe root cause 21

22 Shortcut with Component Attack OS Software DLL name Precondition XP/Vista itunes Opera 9.64 RealPlayer 10.5 Ipodvoiceover.dll aspell 15.dll GoogleDesktopCommon.dll RIO300.dll or RIO500.dll Internet texplorer 8 rpawinet.dll Google Desktop Vista itunes RealPlayer 10.5 Quick Time Player rpawinet.dll rpawinet.dll rpawinet.dll 22

23 Helix Integration Metamorphic Shield Precise Signatures, Patches, Re-Diversification, Validated Repairs, Fast Signatures, Reconfiguration,... S o f t w a r e Proactive Actions Innate Response Adaptive Response Analysis Transforms Deployed System Detection Rapid Response Diagnosis Repair Application Information Repository 23

24 Training Phase executables Resolution Tracer profiles Resolution Checker whitelist Dynamic Profile Generation OfflineProfile Analysis 24

25 Helix Integration Metamorphic Shield Precise Signatures, Patches, Re-Diversification, Validated Repairs, Fast Signatures, Reconfiguration,... S o f t w a r e Proactive Actions Innate Response Adaptive Response Analysis Transforms Deployed System Detection Rapid Response Diagnosis Repair Application Information Repository DLL directory resolution whitelist