|
| Home . Services . References . Advisories . Research . News . Company . Blog |
 |
| Binary Planting Home > Attack Vectors |
Binary Planting - Attack Vectors |
(go directly to demonstrations) One of the most practical ways to mount a Binary Planting attack is to lure a user to a remote shared folder (hosting enticing data files and one or more malicious binaries), possibly without triggering any security warnings. The table below shows the feasibility of various attack delivery methods and the number of security warnings triggered by each one of them. (Methods triggering no warnings are marked in red.) Note that there's nothing wrong with the way the listed applications behave, even if they issue no warnings: letting users open a remote share via a hyperlink can be a very useful functionality and should not, by itself, pose any threat. The table does, therefore, not show flaws in individual applications but the feasibility of delivering binary planting attacks through them. (read the commentary on our blog)
* Market share data obtained from http://www.netapplications.com/ on September 20, 2010. O/S market shares were normalized for Windows versions only (i.e., if Windows XP represents 61% of all O/S, it represents 67% of all Windows O/S). Key
Demonstrations (Notes: Any demonstration that results in Windows Explorer displaying the content of the remote shared folder can be used in an attack against your computer. It can take 15 seconds or more for Windows Explorer to open the remote shared folder after you click on a link.) 1) Internet Explorer: Link to remote shared folder With Internet Explorer, click on the following link to open a remote share: REMOTE SHARE. (Update: sometime between April 2011 and August 2011, Internet Explorer started blocking "file://" links from "http://" sites, so clicking on the above link should not work in IE any more. More details here.) 2) All e-mail clients: E-mail with link to remote shared folder Enter your e-mail address and click "Send". When you receive the e-mail, click on the provided link to open a remote share. (Note that this may depend on your default web browser or, in case you're using web mail, the browser you're using for this.) 3) All e-mail clients: E-mail with link to redirection to remote shared folder Enter your e-mail address and click "Send". When you receive the e-mail, click on the provided link to open a remote share. (Note that this may depend on your default web browser or, in case you're using web mail, the browser you're using for this.) 4) Safari: Local HTML file with link to remote shared folder Download binary_planting_sample_safari.html with Safari: right-click on this link and select "Download Linked File". When the file is downloaded, double-click it in the Downloads window: this opens the file in Safari - but from a local drive - which makes it possible for the HTML to redirect to a remote shared folder. To verify this in a relistic attack scenario, e-mail this file to yourself, then open it from the received e-mail with Safari as the default web browser. 5) Various documents containing links to remote shared folder Download these files and open them on your computer, then click on the provided links to see if you're taken to the remote shared folder.
Notes on Protected Mode Internet Explorer 7 and 8 provide additional security against opening a remote shared folder through the Protected Mode, which is enabled by default but is only available on Windows Vista and Windows 7 (a 33% combined Windows market share). Clicking a link to a remote shared folder in IE7 or IE8 on Windows Vista and Windows 7 will result in a security warning that has to be confirmed by the user in order to launch Windows Explorer for displaying the content of the remote share. There are exceptions, though, where there will be no such warning:
Notes on Internet Explorer Internet Explorer 6 can only exist on Windows XP and older Windows versions. It does not feature the Protected Mode. Clicking a link to a remote shared folder in IE6 will result in launching Windows Explorer, which will display the content of the remote share. No security warnings will be presented by IE6. Internet Explorer 7 and 8 support the Protected Mode on Windows Vista and Windows 7. Clicking a link to a remote shared folder in these browsers on Windows Vista and Windows 7 will in most cases result in a security warning that has to be confirmed by the user in order to launch Windows Explorer for displaying the content of the remote share. Notes on Mozilla Firefox Firefox allows the user to browse remote shared folders inside the browser, without using Windows Explorer. When a user clicks on a file, Firefox asks him to select the application to open the file with, or to save it. Even if an application is selected and launched, this application's current working directory is not set to the remote location and will thus not load remote binaries. Notes on Google Chrome Chrome allows the user to browse remote shared folders inside the browser, without using Windows Explorer. When a user clicks on a non-executable file, Chrome downloads the file to the Downloads folder. Once downloaded, the file can be opened by clicking on it in the download bar, and the current working directory of the application opening the file is set to the Downloads folder. This makes at least local binary planting possible, but the malicious binary must also exist in the Downloads directory. So if the user is tricked into downloading the malicious binary before opening the data file, an attack can succeed, but Chrome does warn you about downloading an executable file such as a DLL or an EXE. Note that a proof of concept has been made using clickjacking for executing a DLL planting attack. Watch the video and try out the demo page with Chrome. Notes on Apple Safari Safari offers limited support for opening hyperlinks to remote shared folders, although there is little official documentation available. Our tests show that the latest Safari version (5.0.2) is willing to open a remote shared folder in Windows Explorer if the originating web page comes from a local drive, while a remote web page fails to do the same. This opens up an opportunity for e-mail based attack, where the attacker attaches an HTML file to her message, and opening this attached HTML file opens its temporary local copy in Safari. Since this is a local HTML file, it can redirect to a remote shared folder. Notes on Outlook Express Outlook Express can only exist on Windows XP and older Windows versions. It provides clickable hyperlinks in e-mail messages it displays. Clicking a link to a remote shared folder in a received e-mail will open this link in your default web browser. In case your default browser is Internet Explorer, it will automatically launch Windows Explorer and display the content of the remote share. If your default browser is Firefox, Chrome, Safari or Opera, Windows Explorer will not get launched. In addition, your Internet Explorer might display a security warning due to the Protected Mode; this depends on the versions of both Internet Explorer and Windows, making this attack scenario equally feasible to clicking a link to a remote shared folder in Internet Explorer. Notes on Microsoft Outlook All tested Outlook versions (2003, 2007 and 2010) provide clickable hyperlinks in e-mail messages they display. Clicking a link to a remote shared folder in a received e-mail will launch Windows Explorer and display the content of the remote share. This works regardless of your default web browser setting. Notes on Windows Mail Windows Mail only exists on Windows Vista. It provides clickable hyperlinks in e-mail messages it displays. Clicking a link to a remote shared folder in a received e-mail will launch Windows Explorer and display the content of the remote share. This works regardless of your default web browser setting. Notes on Windows Live Mail Windows Live Mail provides clickable hyperlinks in e-mail messages it displays. Clicking a link to a remote shared folder in a received e-mail will launch Windows Explorer and display the content of the remote share. This works regardless of your default web browser setting. Notes on Mozilla Thunderbird Mozilla Thunderbird provides clickable hyperlinks in e-mail messages it displays. Clicking a link opens it in the default web browser. In case the default web browser is Internet Explorer, clicking on a link to a remote shared folder will launch Windows Explorer and display the shared folder's content. (In addition, your Internet Explorer might display a security warning due to Protected Mode). If the default browser is either Firefox, Chrome, Opera or Safari, the remote shared folder will not get opened. We're assuming most Thunderbird users don't have Internet Explorer as their default web browser. Notes on Microsoft Word and Excel Microsoft Word and Excel provide clickable hyperlinks in the documents. Clicking a link to a remote shared folder in Excel or Ctrl-clicking it in Word will launch Windows Explorer and display the content of the remote share. This works regardless of your default web browser setting. Word 2010 and Excel 2010, however, display documents originating from the Internet or received via email (with Outlook) in the Protected View; opening any hyperlink in this view requires the user to confirm a security warning. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|