Digital Forensics Incident Response Reverse Engineering Vulnerability Research
There are many CVE IDs assigned for various issues resulting in missing or improper Mark-of-the-Web (MOTW) propagation when extracting files from archives (#1, #2, #3, #4, #5, #6, and so on). Some of these issues are disputed using the same template (inserted by MITRE): Microsoft treats MOTW in their software as a defense-in-depth feature which Continue reading Mark-of-the-Web: the rules changed,…
TL;DR: The Windows Event Logging Service contains a bug (use of uninitialized memory) that sometimes results in recently deleted (cleared) log entries being stored in other (unrelated) *.evtx journal files. This happens once a rarely-updated *.evtx journal file is cleared: it s newly allocated and empty (i.e., containing zero log entries) ElfChnk area is filled with Continue reading Windows event…
Recently, IEEE released the P1619/D12 (October 2024) draft that changes the XTS mode of operation of the AES cipher. In particular, there is a new requirement: The total number of 128-bit blocks in the key scope shall not exceed 2^44 (see D.6). For optimum security, the number of 128-bit blocks in the key scope should Continue reading Disk encryption: wide-block modes, authentication tags aren t…
Background Let s take a look at the following piece of code: This is a oversimplified routine from a typical antivirus scanner — it takes a file path, checks data of that file using malware signatures, and removes the file if it s infected . However, if the remove_file() routine follows symlinks (i.e., it deletes a symlink target, Continue reading Symlink attacks without code execution
Please, refer to this Wikipedia article if you need some theory My paper is here. Background: attacks on AES-CBC Do you remember code execution attacks against full-disk encryption implementations using AES-CBC? Like that one described in the Code Execution In Spite Of BitLocker article or another one detailed in the Practical malleability attack against CBC-Encrypted Continue reading…
Background The same malformed file system structures can cause problems in independently developed file system parsers For example, missing boundary checks when parsing the NTFS update sequence array resulted in two vulnerabilities disclosed before: one in the ntfsck tool (from the ntfs-3g package) – CVE-2021-46790, one in the 7-Zip archiver – CVE-2023-52168. Now, there is Continue reading…
As I demonstrated before, the same malformed file system structures can cause overflows/over-reads in independently developed software. Here is a recent example: a buffer overflow vulnerability found in 7-Zip — CVE-2023-52168. This vulnerability is similar to one previously discovered by me in the ntfsck tool (from the NTFS-3G driver) — CVE-2021-46790. And even more: a Continue reading…
Have you ever seen files like Op-EXPLORER.EXE-03C49D11-000000F5.pf ? TL;DR: these are operation-based prefetch files. An application can ask the NT kernel to record I/O traces for specific operations, either on a per-application or per-thread basis. Then, these traces will be used to prefetch file access requests for that application. The idea behind prefetching is to load Continue reading…
One can set a password to protect the boot menu entries and the command-line shell of the GRUB boot manager (see the official manual and the Red Hat manual). This is an additional security measure to be used along with a BIOS/UEFI password (e.g., to protect corporate computers from unprivileged users trying to leverage their Continue reading CVE-2023-4001: a vulnerability in the (downstream) GRUB…
Modern operating systems provide a way to increase the size of a given file without writing to it. In Unix-like operating systems, this is achieved through the truncate() and ftruncate() system calls. These calls allow programs to decrease or increase the file size. If the file size is decreased, data beyond the new end-of-file position Continue reading Bringing unallocated data back: the…