Recent content on Jon Oberheide
As a two-factor authentication vendor, reporters often ask us about the state of strong authentication. A common question that comes up is: How many people actually use two-factor authentication? What is the largest two-factor deployment? Well, the largest scale deployments of two-factor are often consumer use cases. Despite having very low adoption rates in terms of % of total users, large…
Safely patch the Master Key vulnerabilities on your rooted Android device. Avoid waiting months or years for your carrier to deliver a security update. Created by your friendly neighborhood security experts at NEU and Duo Security. What is ReKey? Earlier this month, RFP from BlueBox published a sneak preview of his upcoming BlackHat talk, detailing a vulnerability in the Android platform that…
TL;DR - An attacker can bypass Google’s two-step login verification, reset a user’s master password, and otherwise gain full account control, simply by capturing a user’s application-specific password (ASP). (With all due respect to Google’s “Good to Know” ad campaign) Abusing Google’s (not-so-) Application-Specific Passwords Google’s 2-step verification…
Later this week, on Friday, I’ll be presenting the preliminary results from our X-Ray project at Rapid7’s United Summit conference in San Francisco. X-Ray is Duo’s mobile app that performs “vulnerability assessment” on Android devices. Instead of scanning for malicious apps installed on the device like a mobile antivirus app would do (a nearly-intractable problem),…
The first public of X-Ray is now available! X-Ray 1.0 supports 8 of the most common privilege escalation vulnerabilities that affect the Android platform. What is X-Ray? X-Ray allows you to scan your Android device for security vulnerabilities that put your device at risk. X-Ray was developed by the security experts at Duo Security. We hope that X-Ray will empower users with knowledge of…
It’s been a few months since our analysis of the new ASLR support in Android ICS 4.0. Given that ICS 4.0 is old news now with the recent release of Jelly Bean 4.1, I thought it was about time to give an update on the ASLR capabilities as well as cover some of the other improvements in exploit mitigations present in Jelly Bean. As a quick recap of the current state of ASLR in Android ICS:
At SummerCon this year, Charlie Miller and I gave a talk on Android\’s Bouncer. Our presentation materials are now publicly available. The week before our presentation, we also posted a teaser video showing our remote connect-back shell that we used to explore the Bouncer environment: Enjoy!
Today, we’re excited to announce the public launch of VPN Hunter! VPN Hunter is a service that discovers and classifies the VPNs and other remote access services of any organization. Given only an organization’s domain name (eg. msu.edu), VPN Hunter can find a wide range of remote access services associated with that organization, such as: SSL VPNs: VPN Hunter will seek out SSL VPNs…
When I first saw the release notes for the new Android Ice Cream Sandwich (ICS) platform, I was excited to see that Google mentioned that \“Android 4.0 now provides address space layout randomization\”: For the uninitiated, ASLR randomizes where various areas of memory (eg. stack, heap, libs, etc) are mapped in the address space of a process. Combined with complementary mitigation…
My challenge for this year\’s NYU Poly CSAW CTF finals was a Linux kernel exploitation challenge disguised as a crypto challenge. The challenge and solution are described below. The Challenge Each team is given unprivileged remote shell access to a Linux VM. There is a custom kernel module, SqueamishOssifrage.ko, loaded.The full source code of the kernel module is provided to the team.…
I\’m releasing a couple tools I use internally for Linux kernel exploit development: ksymhunter and kstructhunter. They\’re probably only useful for like ten people on the planet, but oh well, enjoy! ksymhunter Kernel symbols are definitely a useful resource when writing Linux kernel exploits. Whether you\’re looking for particular structures in kernel memory or pulling the old…
Last month at SummerCon, Dan Rosenberg and I talked about our stackjacking technique for exploiting kernel vulnerabilities on grsecurity/PaX-hardened Linux kernels, in a presentation titled \“Stackjacking and Other Kernel Nonsense.\” While we covered a lot of material from our original stackjacking presentation, we also presented on a couple new items extending the original…
So…RSA happened. We haven’t commented much on the RSA breach, primarily because, instead of ambulance chasing, we’ve been busy working on some technology to prevent RSA-style attacks from impacting our Duo Push authentication, which is the subject of today’s post. However, I think there are a couple interesting points that can be drawn from the RSA breach: First, the RSA…
We’re excited to announce that we’ve officially launched Duo Push, a new authentication method that leverages modern smartphones to provide two-factor authentication that’s both resistant to the latest threats and is actually enjoyable to use! But first, some background… When we first started Duo, we set out to create a two-factor authentication platform that was not only…
It\’s been about six months since I reported a vulnerability in the Android mobile platform that allowed the unprompted installation of arbitrary applications with arbitrary permissions on a victim\’s device. While the vulnerability has long been fixed on Android handsets around the world, I\’ve yet to write up any technical details about it, and it\’s unlikely…
This April at Hackito Ergo Sum in Paris and Immunity\’s Infiltrate in Miami, Dan Rosenberg and I presented on a technique to exploit grsecurity/PaX-hardened Linux kernels. Read on for a brief overview of our presentation and a link to the full slides and PoC code. The Stackjacking Technique In our slides, we presented a technique to exploit a grsecurity/PaX-hardened Linux kernel (eg.…
No, seriously. The good: Google has patched a serious vulnerability I discovered in the Android web market. The bad: Since the Android web market was launched earlier this year, it was possible to remotely install arbitrary applications with arbitrary permissions onto a victim\’s phone simply by tricking them into clicking a malicious link (either on their desktop OR phone). The exploit…
In this post, I\’ll introduce an exploitation technique for kernel stack overflows in the Linux kernel. Keep in mind this does not refer to buffer overflows on the kernel stack (whose exploitability is well understood), but rather the improper expansion of the kernel stack causing it to overlap with critical structures which may be subsequently corrupted. This is a vulnerability class in the…
The finals for NYU Poly\’s CSAW CTF was this past weekend in New York City. I thought I would post the kernel exploitation challenge I developed for the final round. Feel free to try your hand at solving it! The Setup Each team is given unprivileged remote shell access to a Linux VM. There is a vulnerable kernel module (csaw.ko) loaded into memory: csaw@csaw ~ $ lsmod Module Size Used by…
A vulnerability in the pktcdvd driver in the Linux kernel allows for the disclosure of 4 bytes of kernel memory. In this post, I\’ll describe the tad bit of magic that\’s necessary to exploit the vulnerability on both 32-bit and 64-bit hosts to disclosure an arbitrary amount of kernel memory. The Vulnerability The vulnerability was first introduced in 2.6.10 (way back in 2004) and was…
Ben Hawkes discovered a vulnerability in the Controller Area Network (CAN) packet family in the Linux kernel that results in a controllable overflow of a SLUB-allocated structure. As there\’s not a whole lot of modern, public examples of SLUB overflow exploits, I\’ll describe my exploit of the CAN vulnerability in detail. The Vulnerability Ben provides the full details of the…
I got my hands on a copy of the recent Android SMS trojan that commits toll fraud via SMS messages to premium Russian shortcodes. What follows is a brief teardown of the APK and disassembly of the trojan\’s dexcode and description of its malicious functionality. It\’s incredibly simple in nature so there\’s not much detail to go into. Package: RU.apk Package Name:…
This posts aims to peek inside the Android GTalkService connection and observe its protocol. In particular, we\’re interested in the INSTALL_ASSET message and whether or not it is protected by any additional cryptographic signatures beyond the intended guarantees provided by the SSL transport. A Brief Introduction to the GTalkService If you haven\’t read the previous post on the…
In this post, I\’ll talk about the REMOVE_ASSET and INSTALL_ASSET mechanisms that can be invoked by Google via Android\’s GTalkService to not only remotely remove applications from an Android device but also remotely install new applications. RootStrap Background So if you didn\’t check out my slides from SummerCon last week in NYC, I talked a bit about a program called RootStrap…
SummerCon was absurdly fun. Thanks for redpantz for putting on a great event and all the NY guys for making it a blast. My talk was on a few random Android topics...slides are available below. I threw everything together about 12 hours before my talk so it\’s a little rough around the edges and a few slides have been redacted for now.
Just got back from SOURCE Boston. SOURCE was a great event: a great line-up of speakers, fun social events (thanks to Rapid7 and iSEC for sponsoring), and smooth execution (props to Stacy and Zach). My talk was on the topic of Linux kernel security, slides are available here.
A vulnerability in the ReiserFS filesystem of the Linux kernel (versions <= 2.6.34-rc3) allows for the unprivileged reading and writing of objects in the .reiserfs_priv path. Leveraging extended attributes and POSIX file-based capabilities, this vulnerability allows for privilege escalation on systems with a ReiserFS filesystem. The Vulnerability The vulnerability was introduced in May 2009 in…
A recent vulnerability in the Linux kernel (versions <= 2.6.32-rc1) allows the leakage of certain register contents. The x86-64 registers r8-r11 may be leaked to 32-bit unprivileged userspace applications that switch themselves into 64-bit mode. Introduction In order to understand this vulnerability, we first need to talk a bit about the x86-64 architecture (aka amd64). One of the key design…
Dam Burst is a simple utility that allows an unprivileged user to disable the censorship functionality of the Green Dam Youth Escort software. Dam Burst operates by injecting code into a running application and removing the Green Dam hooks that enable it to monitor and block user activity, effectively restoring the running application to its original uncensored state. Unlike other tools that…
In this post, we\’ll look at some kernel stack information disclosures in the getname() functions of several socket AFs recently discovered in the Linux kernel. The Vulnerability The getname() function of an address family in the kernel is used to retrieve information about a given socket. This information, in the form of a sockaddr struct, is accessed from userspace through the…
We just presented our PolyPack research today at the USENIX Workshop on Offensive Technologies (WOOT \‘09) in Montreal, Canada. Links to the paper and presentation materials are after the jump. Paper: /files/woot09-polypack.pdf Presentation: /files/woot09-polypack-pres.pdf From the PolyPack website: \“PolyPack is a research project at the University of Michigan aimed at understanding…
Tinychat is a sweet site that allows for simple chat, video conferencing, and screencasting. In this post, I\’ll detail how to hijack Tinychat screencasts by injecting images of your own. I had played with Tinychat recently and decided to poke at it some more when mubix held a Metasploit-related screencast a couple days ago. Tinychat\’s multimedia features operate with a mix of…
Some information about a trojaned ssh client and sshd server discovered in a recent compromise. I didn\’t find any details on this particular OpenSSH backdoor via Google, so hopefully this information will be of use to anyone who runs into it on their boxes. The compromise of a group of small number of Linux boxes in a University unit was first discovered when the attackers began launching…
A recent bug found by Sebastian Krahmer in udev has considerable security impact across a wide range of Linux distributions. At the core of the vulnerability is the udevd daemon, responsible for receiving and handling various device events from the kernel. These events are delivered to udevd via netlink, a socket family (AF_NETLINK) commonly used for IPC between userspace applications and the…
A bit of information on Panera Bread\’s gift card security, or lack thereof. Traditional gift card security often involves a randomized account number and a scratch-off PIN number. Randomized account numbers prevent attackers from guessing valid accounts numbers to use. Scratch-off PIN numbers prevent attackers from checking/using card numbers and from going in to brick-and-mortar stores to…
Previously we looked at creating ICMP echo requests, parsing a PCAP file, and doing DNS spoofing with the dpkt framework. Today I will show how to parse the AS paths of BGP messages out of MRT routing dumps. Parsing BGP routing information is fun. However, before projects like RouteViews were around, getting a global view of Internet routing in real-time simply wasn\’t possible. But thanks…
ARBSEC 01 was a great success! Thanks for everyone who came out, Bar Louie for hosting, and dugsong for taking some pictures! Be sure to join us for future ARBSEC meetings, the first Wednesday of each month. jose, grue, steiza, svowels, mattbing, and more. honey, jono, olga, bfields, nuxi, and more. Dropping some Barracuda 0-day!
ARBSEC, a CitySec-style meetup for security professionals in the Ann Arbor area, has been officially launched! Our first meeting, ARBSEC 01, will be at 6:00pm on March 4th at Bar Louie in Ann Arbor. What An informal meetup of information security professionals in Ann Arbor. Unlike other meetups, you will not be expected to pay dues, \“join up\“, or present a zero-day exploit to attend.…
In our first and second dpkt tutorials, we looked at the simple construction and parsing of packets respectively. Our third tutorial combines both parsing and construction of packets in a single utility for performing DNS spoofing (a la dsniff\’s dnsspoof). dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of…
Here is a simple python script for batch malware submissions to VirusTotal via its email interface. Simply replace the SMTP-related variables at the top of the script and you\’re ready to rock! Download vtsubmit.py #!/usr/bin/env python # vtsubmit.py # VirusTotal Submission Script # Jon Oberheide <jon@oberheide.org> # http://jon.oberheide.org import os, sys, email, smtplib, hashlib SMTP_HOST…
As we showed in the first dpkt tutorial, dpkt makes it simple to construct packets. dpkt is equally useful for parsing packets and files, so in this second tutorial we will demonstrate parsing a PCAP file and the packets contained within it. dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of using one module, the…
Brace expansion is a nice feature in the Bash interpreter that happened to be exactly what I needed during an audit. A good thing to log away in memory in case you ever find yourself in a pen-test environment with similar constraints. Bash Command Injection During an audit of a popular email appliance, I encountered a scenario where attacker controlled input was improperly sanitized and passed as…
In this dpkt tutorial, I will demonstrate how to construct and send a simple ICMP echo packet. dpkt is a sweet framework for creating and parsing packets. While dpkt doesn\’t have much documentation, once you get the hang of using one module, the rest fall into place fairly easily. I\’ll be doing a number of dpkt tutorials with simple tasks in hopes of providing some…
During Paul Vixie\’s talk at WOOT on some of the operational challenges of deploying source port randomization functonality in BIND, I started thinking of a few simple ways to harden DNS infrastructure against VU#800113 by leveraging the IP TTL value. DNS Cache Poisoning In order to increase the resilience of DNS against Dan Kaminsky\’s cache poisoning attack, source port randomization…
I\’m back from San Jose finally and while I won\’t be breaking down a full review of HotSec and USENIX Security like I did for WOOT, I thought I would point out some of the more interesting presentations I was able to attend. HotSec 2008 Panic Passwords: Authenticating under Duress Jeremy Clark and Urs Hengartner, University of Waterloo Some interesting duress schemes were presented…
Day one of my trip out to San Jose to attend the WOOT, HotSec, and USENIX Security trifecta is over. The 2nd Workshop on Offensive Technologies (WOOT) took place today and I\’ll be breaking it down with \“The Good, The Bad, and The Ugly\“. I\’ll be discussing a few of the presentations at WOOT today: the ones that peaked my interest (The Good), the ones that didn\’t…
The Passive DNS Port Test (PDPT) tool acts as a passive DNS monitor to flag resolvers that may be vulnerable to the cache poisoning issue described in CERT VU #800113. Similar to OARC\’s porttest, this monitor will judge the source port behavior of resolvers based on the standard deviation of observed source ports. The Passive Approach Another VU #800113-related testing tool? Of course,…
While receiving phishing emails in my University inbox is a common occurrence, a recent email caught my eye due to its increased sophistication and University-specific information. Email Contents Dear Umich.edu WEBLOGIN Subscriber To complete your Umich.edu WEBLOGIN account, you must reply to this email immediately and enter your password here (*********) Failure to do this will immediately render…
An easily exploited vulnerability in Google App Engine\’s SDK can put your development servers at risk. While this bug is trivial to fix, engineers at Google have declined to address the vulnerability, so be cautious when using the SDK to develop your web service. The Vulnerability The vulnerability exists in the mail API of the Google App Engine SDK, specifically in…
Just arrived home from Washington, DC where I attended and presented at the Black Hat DC Briefings. I was fairly busy throughout the briefings and didn\’t make it to as many presentations as I hoped, but I thought I\’d detail a few of the more interesting ones. Presentations of Interest Cracking GSM David Hulton and Steve, Pico Computing, Inc. David and Steve\’s presentation on…