I spent the last weeks traveling to Singapore and Miami to present my Xenpwn
research about double fetch vulnerabilities in paravirtualized devices at
Infiltrate and Syscan360. You can find my slides
here. Both conferences had great
organization, very technical talks and a cool audience. In the following I want
to give a short recap of some of the talks I liked the most:
Sean Heelan – Automatic Root-Cause Identification for Crashing Executions (Infiltrate)
Sean Heelan talked about his work on automated root cause analysis. The goal of
this research is to give a human researcher a detailed analysis of the potential
root causes (in the form of violated predicates) that triggered a crash during a
fuzzing run. Sean summarizes the core idea of his research much better than I
would be able to in his
blog post,
which also contains a link to his slides. I’m always a big fan of his talks
because he is one of the few peoples working in the intersection between the
academic program verification community and the IT security industry.
As part of my research on the security of paravirtualized devices, I reported a
number of vulnerabilities to the Xen security team, which were patched
today. All of them are double
fetch vulnerabilities affecting the different backend components used for
paravirtualized devices. While the severity and impact of these bugs varies
heavily and is dependent on a lot of external factors, I would recommend
patching them as soon as possible. In the rest of this blog post I’ll give a
short teaser about my research with full details coming out in the first quarter
of 2016 .
This post is a short wrap-up of our Troopers talk about the research we did on
IBM’s General Parallel File System. If you are interested in all the technical
details take a look at our
slides
or the video recording. We will
also give an updated version of this talk at the
PHDays conference in Moscow next month.
The IBM General Parallel File System is a distributed file system used in large
scale enterprise environments, high performance clusters as well as some of the
worlds largest super computers. It is considered by many in the industry to be
the most feature rich and production hardened distributed file system currently
available. GPFS has a long and really interesting history, going back to the
Tiger Shark file system created by IBM 1993.
Last week Matthias and I went to Singapore to teach our workshop on
Hypervisor Exploitation at
SyScan. After a very unpleasant Lufthansa strike (which
made us arrive late in Singapore) and two intense workshop days, we were free to
attend the “last” SyScan. There are few IT security conferences that have such a
great reputation in the community and so we had high expectations, which were
definitely not disappointed. This year had a lot of really interesting talks so
I will just summarize some of the ones I liked the most.
In my
last blog post,
I gave an overview about recent vulnerabilities discovered in the x86 emulation
layer of Xen. While both of the discussed vulnerabilities only allow for guest
privilege escalation, the complexity of the involved code seemed to indicate
that even more interesting bugs could be discovered. So I spent some time
searching for memory corruption issues and discovered a very interesting bug
that resulted in XSA 123 . This
post gives an overview about the root cause of the bug and a short description
of exploitation challenges. A follow-up post will describe possible exploitation
strategies in more detail.
Developing a secure and feature rich hypervisor is no easy task. Recently, the
open source Xen hypervisor was affected by two interesting vulnerabilities
involving its x86 emulation code:
XSA 110 and
XSA 105. Both bugs show that the
attack surface of hypervisors is often larger than expected. XSA 105 was
originally reported)
by Andrei Lutas from BitDefender. The patch adds missing privilege checks to the
emulation routines of several critical system instructions including LGDT and
LIDT. The vulnerable code can be reached from unprivileged user code running
inside hardware virtual machine (HVM) guests and can be used to escalate guest
privileges. XSA 110 was reported by Jan Beulich from SUSE and concerns
insufficient checks when emulating long jumps, calls or returns.
As every year some of us used the holidays to visit the Chaos Communication
Congress to socialize with like-minded people and to hear interesting talks.
I mean what other reasons than learning about security might exist to leave
behind all your lovely in-laws you’ve been sharing some relative’s house with
the days before … 😉
Here is a short recap of some of the talks we found most interesting:
Mining for Bugs with Graph Database Queries by Fabian Yamaguchi Video
One of my favorite talks at this years congress was about the open source tool
joern, a code analysis platform for C/C++
applications. Fabian, the main author of joern, presented his work on
vulnerability discovery in large code bases. One of the key points of his work
is robustness, meaning that the resulting tools should produce meaningful
results in large and noisy real world projects even if this results in a loss of
accuracy. The second important point is that tools should assist human auditors,
not replace them, which seems to be one of the more interesting current research
directions (see also
this paper).
At its core joern combines standard compiler technology with modern graph
databases to offer auditors a powerful way to search for certain code
constructs. To do this joern parses source code into an AST (Abstract Syntax
Tree) and creates the corresponding CFG (Control Flow Graph), as well as a Data
Dependency Graph (PDG) for all functions. This creates the Code Property Graph
which combines all three representation forms into a single unified layer.
The Code Property Graph is stored inside a graph database (joern uses
neo4j), which can be queried using a powerful graph
traversal language named gremlin
(https://github.com/tinkerpop/gremlin/wiki). The combination of gremlin with
some wrapper tools included in joern gives an auditor the possibility to
construct powerful search queries against the code base. Fabian presented
different queries he used to search for vulnerabilities in the VLC video player,
as well as the Linux kernel that resulted in really impressive results (and a
high number of discovered vulnerabilities). Joern is definitely a tool you
should check out and I’m looking forward to more impressive research by its
author.
– Felix
One interesting observation we make when testing complex environments is that at
the bottom of huge technology stacks, there is usually a handful of shell
scripts doing interesting stuff. More often than not these helper scripts are
started as part of cron jobs running as root and perform basic administrative
tasks like compressing and copying log files or deleting leftover files in
temporary directories. Of course, these high privileges make them an interesting
target for privilege escalation attacks and one class of vulnerability we
reliably encounter in shell scripts is unsafe handling of globbing or filename
expansions.
The below post was originally written on February 9th as a little educational
exercise & follow-up to my
BinDiff post.
(This research was actually triggered by a relative asking about that strange
Fritz!Box vulnerability he heard about on the radio). Once we realized the full
potential of the bug we decided against publishing the post and contacted
several parties instead. Amongst others this contributed to the German BSI
press release.
Given the
cat is out of the bag
now anyway, we see no reason to hold it back. We will further take this as an
opportunity to lay out our basic vulnerability disclosure principles in a future
post. This topic will also be discussed in the panel “Ethics of Security Work &
Research” at Troopers
When teaching courses on topics like Reverse Engineering or Malware Analysis we
always emphasize the need to minimize unneeded work. Because reversing an
unknown binary is a time consuming and complex process, tools that simplify the
RE process are invaluable when working under time pressure. In this blogpost
series I will present multiple tools and techniques that can help to reverse an
unknown binary. Please note that these articles do not contain cutting edge
research but rather target at newcomers. However, I hope to also provide some
useful and interesting information for moreexperienced practitioners.
