Vista’s Despised UAC Nails Rootkits

PC World – Business Center: Vista’s Despised UAC Nails Rootkits, Tests Find

PCWorld has a story about test conducted AV-Test.org that was supposed to rate the most popular anti-virus products ability to detect rootkits.  For people that don’t know, a rootkit is a program that takes complete control of a system, and tries to hide itself deep within the operating system.  They are notoriously difficult to detect once they are installed.  The most interesting result from this test wasn’t necessarily the results about which product detected what, but the revelation that Vista’s security framework, specifically User Access Control (UAC) was really effective at preventing rootkit infection.  The test took 30 rootkits written for Windows XP and tested various anti-malware and anti-rootkit suites.  Some of them scored fairly well, but none were perfect.  Of the 30 XP rootkits, only 6 would actually run on Vista, and in order to get them to run UAC had to be disabled.  This means that UAC has significantly raised the bar of entry for rootkits on Windows.  This shouldn’t really come as a surprise to anyone familiarly with this area, but there seems to be a lot of loud mouths shouting that UAC is worthless and should be disabled.  I have an anecdote that tells a different story.

The last product that I worked on was essentially a rootkit.  It was a component of a broader intrusion detection system which needed real-time information about what was going on in the system.  We wrote a simple device driver that intercepted all events within the kernel and logged them out to a database.  This means that every file, registry key, key pressed, port opened, etc, was visible to this program and logged.  We originally wrote it to work on XP, and an application to install it as a service, which involved a couple of calls to the Service Controller to install it.  If the user was running with an Administrator account (which everyone in XP does) then the driver would be loaded completely invisibly.  That means that any program that you have ever installed could very easily be spying on everything you, or any other user on your machine does.  I say it could be “very easily” doing this, not because the code is particularly easy to write, but that the Internet is absolutely littered with rootkit code, especially the .cn domain.  A little while ago we decided to update our driver to work under Vista.  Since rootkits are essentially an extension of the operating system, they become very dependent on certain structures and features of an OS and tend to only work under that version.  So we had to change the code a little bit to get it to run, but for the most part, it was the same program.  The only real difference between the two version was that on Vista, even if the user is logged in as Administrator, the installation of the service would fail if it wasn’t elevated with a UAC prompt.  Privileges in Windows works with tokens; each user and group has a token, there is a system level administrator token, etc.  When a program starts, it is given the token of the user, and is run with what ever permissions that the user has.  So, users of the Administrator group in XP would pass along Administrator, or system level, permissions to any applications.  The difference between XP and Vista, is that when a user is in the Administrators group their token in Vista is not a complete system access token.  For an application to receive system level access, it must be spawned by a system level user group (SYSTEM, LOCAL SERVICE, etc) or being elevated by an administrator with a UAC prompt.  This prompt assures that the user behind the keyboard is aware that they are giving this application complete access to the system.  Sure, it can get a little annoying from time to time, but I’d rather have a prompt alerting me every so often as opposed to a rootkit silently being installed.

Making it Mesh

Microsoft has a series of lectures on campus called The Breakfast Series where guest speakers will give a presentation about current products, technologies, or anything really relevant to the company.  This week’s was about Live Mesh and I thought it was a really interesting product, so I wanted to share it with you all.

As everyone should have noticed by now, computing is moving away from a desktop centric model, to a cloud (Internet) based system.  Microsoft has been trying for the last few years to figure exactly how they plan to adapt their products to incorporate more web based services.  They have numerous ventures into this arena, but nothing complete and cohesive.  Live Mesh really seems like it is their final solution. 

Basically, the idea with Mesh is to have a central system for synchronizing programs, data, and settings across multiple machines, devices, and web storage.  Sure, products like this have been done before.  In fact, I can think of two separate tools for this already made by Microsoft.  What separates Mesh from the other tools is it’s broad scope and extensibility.  Mesh isn’t design to simply be an application that syncs files, it is supposed to be a platform the provides syncing as simple service for applications to build on.

By the time this reaches beta testing it will run on many different devices.  XP, Vista, OSX, WinMobile, and some WAP enabled devices should all have a version of the client.  The demo shown during the presentation showed a person taking a picture with their smart phone, and it was immediately delivered to the home pc, as well as someone’s laptop who was traveling.   I thought it was kind of neat.

Like I said earlier, the real purpose of Mesh isn’t simply to share files, but rather to expose data syncing and cloud functionality to applications.  There will be an API for developers to use to allow their programs to sync what ever they want and however they want to the Mesh system.  From what was demoed, the API looked very simple and straight-forward.  I believed they had a plug in for Firefox that would add FF bookmarks to the Mesh.  This sort of system seems like a good solution because it allows the application developer add cloud based data portability without dealing with the complicated nature of it.  It will be interesting to see how this system is accepted by the community and how many applications will take advantage of it.  I also wonder how it will be used inside of Microsoft.  I would like to see something like Outlook syncing the contents of your inbox into this, or maybe the Common Feed List keeping a global synced feed list.

Currently, Mesh is dogfooding inside MS and there is an CTP that you can register for.  It took about a week for me to get accepted into the CTP.  There should be a public beta coming in the next couple of months, so keep an eye out for it, it’s going to be pretty cool.

Safari Carpet Bomb

When you’re writing a web browser, every bug should be considered a security issue.  Even if the bug seems simple and inconsequential, chances are someone will try to exploit it to harm users.  Nitesh Dhanjani over at ONLamp has a post about three different bugs he has found in Apple’s Safari web browser.  Now, to be clear, I’m not deriding Apple for having bugs in Safari.  These types of programs are very complicated and never bug free.  What I find troubling is their response to the submission.  Nitesh says that he submitted all three bugs that he found to Apple, and they responded by saying that they don’t consider two of the bugs a security related issue at this time.  I must object loudly to this.  Here is the bug:

It is possible for a rogue website to litter the user’s Desktop (Windows) or Downloads directory (~/Downloads/ in OSX). This can happen because the Safari browser cannot be configured to obtain the user’s permission before it downloads a resource. Safari downloads the resource without the user’s consent and places it in a default location (unless changed).

That means that any website can download anything and the user isn’t even notified or asked.  How is this not a security issue?  A large amount of malware relies on getting an executable onto a machine, and then convincing a user to run on it.  How about dropping a worm named Safari.exe, or Word.exe onto someone’s desktop, and the next time they go to open it they infect their machine.  Nitesh demonstrates this bug by littering the users desktop with tons of unwanted files.  While this is annoying, it’s fairly pointless and obvious.  If you think like an attacker for a minute you can come up with more sneaky and nefarious ways to use this hole.  I can’t seem to understand why Apple’s security team doesn’t recognize this as a security concern.  I mean, it’s sort of their job to look at every bug and see how it can be exploited to cause harm.  Nitesh also wanted to congratulate the team on their communication:

Before I get to the details, I want to make it extremely clear that the Apple security team has been a pleasure to communicate with. I sent them a couple of emails asking for clarifications, and they responded quickly and courteously every time

That’s wonderful that they’re talkative, but shouldn’t it bother you that they are dangerously wrong?

Safari Carpet Bomb – O’Reilly ONLamp Blog

Serious flaw in OpenSSL on Debian-based Linux

 

[SECURITY] [DSA 1571-1] New openssl packages fix predictable random number generator

OK, this is kind of a big deal.  It turns out that there is a serious flaw in the OpenSSL packages used on Debian-based Linux distributions, which includes Ubuntu, Xandros, and many others.  The problem appears to be that the random number generator is giving predictable, rather un-random results.

From the bulletin:

It is strongly recommended that all cryptographic key material which has been generated by OpenSSL versions starting with 0.9.8c-1 on Debian systems is recreated from scratch. Furthermore, all DSA keys ever used on affected Debian systems for signing or authentication purposes should be considered compromised; the Digital Signature Algorithm relies on a secret random value used during signature generation.

Debian Linux runs many of the websites out there, and a lot of them rely on cryptographic keys for SSL.  Replacing these keys (getting them re-signed by a Certificate Authority) will surely be a long and expensive process.

Here’s another gem from the bulletin:

OpenSSL’s DTLS (Datagram TLS, basically “SSL over UDP”) implementation did not actually implement the DTLS specification, but a potentially much weaker protocol, and contained a vulnerability permitting arbitrary code execution (CVE-2007-4995).

These bugs beg the question, why is the Debian team making changes to OpenSSL?  Cryptography is hard, and the OpenSSL team has one of the most accurate and respected libraries to date.   They should stick to what they’re good at, like package management, and leave cryptography to the people who know what they’re doing.  As it stands, I’m not sure if I can trust any SSL connection anymore…

Sharing a Secret

There is more to cryptography than simply hiding information.  One very useful extension of the field is into the area of information dissemination.  Imagine that you run a retail store with several employees.  This store has a code for it’s alarm system that must be set every night and cleared every morning.  Obviously, you can’t trust just any employee with the alarm key, because then they could enter the store at any time!  But you’re also a very busy person that can’t be bothered with actually opening and closing the store every day.  You would like to make a rule that there needs to be at least two people present at the store during opening and closing to prevent theft.  How are you going to implement this rule?  Fortunately you learned enough algebra is high school to do this!  You can split the key code into even but distinct halves, and then hand one out to each employee.  This way two employees would have to join their part together in order to open or close the door. 

That example isn’t very interesting.  How about enforcing the following rule:  four employees can open a door, or two employees and one manager, or two managers.  Now we need to split the key more finely, so that each manager gets two shares, each employee gets one, and it requires four parts to reassemble the key.  Now that we understand the problem, let’s discuss the math.

The trick is called the Shamir Threshold scheme and uses LaGrange Interpolation and the knowledge that two points are required to infer a line, three points for a quadratic, etc.  You simply define a polynomial with the secret number as the 0 root coefficient, and random numbers for the rest.  Let w be the number of participants in the system, and t be the number of shares needed to reassemble a secret message M.  Construct the follow polynomial:

This polynomial defines a graph and the shares of the secret will be points along the graph.  Calculate a point for each person (w):  (1, f(1)) (2, f(2)) (3, f(3)) … (w, f(w)).  Each person now has a unique point on this graph.  They can then take t number of points and calculate the LaGrange coefficients to reassemble the polynomial, thus yielding the secret.

LaGrange states that given a set of x,y points

then

where

Wikipedia has a good page on LaGrange interpolation if you need more of an explanation that what I gave.

Let’s see an example.  We will take the first scenario I outlined:  there are 10 employees, at least two must be present to lock and unlock the door.  Let’s say the key code for the door is 25.

First we generate a polynomial:  f(x) = 25 + 73x^1.  The first coefficient is the secret, the second is a random number.

The second step is to generate unique points for each participant:
(Note:  All of the arithmetic here is done modulus some random n)

Modulus n: 163

(1, 98)
(2, 8)
(3, 81)
(4, 154)
(5, 64)
(6, 137)
(7, 47)
(8, 120)
(9, 30)
(10, 103)

As you can see, none of the participants know the secret number, but if you take two of their points you can calculate the secret.  Taking points (1,98) and  (2,8) gives the set of LaGrange constants as {-324, -1}.  Multiply -324 by 98, -1 by 8 and mod them by n=163 and you will be left with the secret, 25.

A more complicated example:  10 participants, 4 shares are required to reassemble.  Same secret, 25.

Modulus n: 181

Polynomial: 25 + 119x^1 + 159x^2 + 106x^3

(1, 47)
(2, 118)
(3, 150)
(4, 55)
(5, 107)
(6, 37)
(7, 119)
(8, 84)
(9, 25)
(10, 35)

Now if you try to reassembly the secret with only 3 points, then you will get an incorrect value.  Points (1, 47) (25, 107) (9, 25) will calculate a secret value of 40.  Point (3,150), and (6, 37) will give you 82.  Only if you select four or more point along the graph will you be able to calculate the correct secret.

Here is some Java code if you would like to play with this.

If you just want to see the program run, here is a pre-built JAR.

To run the JAR, use the command ‘java -jar secret.jar” provided you have a version of the JRE installed.

Unaccountable Authority

I have a problem with certificate authorities.  I hate that most people have no idea what they are even though they deal with them every time they browse the web.  Show of hands, does anyone understand what these dialogs are talking about?

  

  

I’m going to venture a guess that not many people raised their hands.  So you’re all told to look for certain visual cues when browsing sensitive sites (banking, etc) but I’m sure no one ever told you what they mean or why they’re necessary.  I’m about to tell you why it is all utterly stupid.

SSL

This all pertains to sites which deal with sensitive information, like your bank’s website, or any log in screen.  The goal is to establish a unique encryption session between your computer and the server, so that eavesdroppers aren’t able to steal your valuable information as it gets sent along the line.  This is accomplished by using the Secure Socket Layer (SSL) protocol.  SSL uses public-key cryptography to securely establish a session (symmetric) key that is used to protect the subsequent data.  This is how it works:

• Client (you and your browser) connects to a server over https:// (port 443)
• Server sends you it’s public certificate – This certificate contains the server’s public key .
• Client generates a random number, encrypts it with the server’s certificate and sends it - This number is the premaster key
• Server takes the premaster key along with some other random numbers that were exchanged and generates the session key

Now that you and the server have agreed on the same key all the data sent from this point forward will be encrypted.

So, some questions should come to mind:

Can’t someone eavesdrop on the key creation and thus obtain the session key?
    No.  The session key is made up of three random numbers hashed together, two of which will be available to an eavesdropper, and the third (the premaster key) will be encrypted with the server’s public key, so that only you and the server know what it is.

How can I trust the server’s certificate?
   Well, each certificate is signed by a certificate authority.

What’s a certificate authority?
   It’s a company that signs certificates.  You see, a website will generate a public/private key pair and then send out a Certificate Signing Request (CSR) out to a CA who will take the public key and attach a digital signature to it and return it to the site.  Now the website can distribute this signed certificate so it can’t be faked.  When a browser receives a certificate, it verifies that the certificate has been signed by one of it’s trusted CAs

So, where do I get a trusted CA certificate?
   Chances are, you already have them.  Your computer, web browser, and java VM  all ship with root trusted authority certificates in their respective certificate stores.

Wait, who are these CA’s again? 
   Here is a list that I found googling: Catsdeep FreeSSL, Comodo, Digicert, Digi-Sign, Digital Signature Trust Co., Ebizid, Enterprise SSL, GeoTrust, GlobalSign, LiteSSL, Network Solutions, Pink Roccade PKI, ProntoSSL , QualitySSL, Rapid SSL, Real digital certificates, Secure SSL, SimpleAuthority, SSL Certificate Management Site, SSL.com, Thawte Digital Certificates, The USERTRUST Network, Verisign, XRamp Security

That’s a pretty big list full of companies I’ve never heard of.  Why should I trust them?
   Well, they’re big companies, with a lot of money invested in this.  Plus, how can you not trust them, with names like those, they must be secure!

In all seriousness, that last question is exactly the problem I have with certificate authorities. We have absolutely no reason to trust them.  Worse than that fact though is that nobody understands just how much trust we are placing in these companies.  We are taught as users to not be bothered with all of the magic that is going on between the browser, the ca, and the server, and to just assume that if there is a lock on the corner of your screen than you are safe and everything is good.  This gives the CA a level of unaccountable authority because not only are we incapable of noticing any wrong doing on their part, we are completely ignorant of their existence!  It’s a wonder scenarios like this aren’t more prevalent:

http://www.microsoft.com/technet/security/bulletin/MS01-017.mspx

For those that don’t like to click on links, this is a security bulletin about Erroneous VeriSign-Issued Digital Certificates that attackers are using to sign invalid certificates.

The certificate authority is the main point of failure in the X509 and SSL system.  I can’t for the life of me understand why any person in the field of security could conclude that giving a single company that much authority over an entire protocol is a good idea.  They build these massively complicated, mathematically intense systems for protection, and then leave it open to a single entity for trust.

I wrote this post under that assumption that most users don’t know what a certificate authority is, or even vaguely what is happening during a secure connection.  I feel like this illustrates a failure in the security community, much more so than in the individual user.  We walk a fine line in the computer security field, constantly afraid that if we require the slightest bit of effort from a user than they are not going to use the technology.  That’s all understandable, but if you go so far as to completely remove them from the process you leave them incapable of protecting themselves and fill them with a false sense of security.  By not even being aware of the most essential component in SSL security, it is impossible for anyone to know what to do if there is a failure somewhere along the line.  If the connection gets attacked, the protocol will rightly fail and the user will be presented with a choice; proceed anyway, or stop.  How is the user supposed to make the correct decision here?

To illustrate this point, I want to see some comments.  Answer this question:  what do you do when you encounter a website with an invalid certificate?  Do you just click ok and view the site anyway?

MIA

So, I’ve been pretty busy lately and haven’t updated this in awhile.  I haven’t forgotten about it though.  I have a lot of ideas for posts floating around my head, and now that school is done and I have a couple of weeks of downtime I’m going to try and get them on the site.

I’ve also been thinking a lot about what I want this site to be, and the overall point of this.  I’ve decided that I have strayed from the initial purpose considerably.  Be prepared for some significant changes here in the coming months.