Steganographic AVI Filesystems for fun and profit. Paul Sebastian Ziegler HITB KL 2011

Transcription

1 Steganographic AVI Filesystems for fun and profit Paul Sebastian Ziegler HITB KL 2011

2 Introduction

3 Introduction In 30 seconds or less

4 Paul Sebastian Ziegler

5 Pentester

6 01_okladka_FR.indd , 15:09:37 Cross-Site Scripting Paul Sebastian Ziegler Cross-Site Scripting (XSS) ist die Schwachstelle in Webanwendungen schlechthin. Wie kaum eine andere Technik kombiniert diese Technik einfache Methoden und Ansätze zu letztendlich verheerenden Angriffen. Jedoch ist das Wissen um diese Schwachstelle und die damit verbundenen Angriffe derzeitig lediglich Sicherheitsexperten vorbehalten. Es existieren zwar umfangreiche Berichte und Dokumentationen, aber diese können zumeist nur von Insidern verstanden werden. Der normale Programmierer oder Nutzer, der sich mit Cross-Site Scripting auseinandersetzen muss, bleibt in der Regel außen vor. Dieses TecFeed ist bemüht, das zu ändern. In einfachen Schritten führt Sie der Autor in das komplexe Thema ein. Sie werden lernen, was Cross-Site Scripting ist und wie man mit seiner Hilfe Webanwendungen angreifen kann. Nach der Lektüre dieses TecFeeds werden Sie in der Lage sein, Schwachstellen zu erkennen und zu beheben. INHALT Einleitung 2 Aufbau eines XSS-Angriffs gegen eine ungesicherte Webanwendung 2 Effekte, die ein Angreifer durch XSS hervorrufen kann 8 Schutzmechanismen, die zu kurz greifen 19 Der Aufbau starker Schutzmechanismen Escapen und listenbasiertes Filtern 36 Das Gefahrenpotenzial von XSS heute und in naher Zukunft 47 Zusammenfassung 52 Anhang A Liste verschiedener Angriffsvektoren 53 Anhang B safehtml 54 Über den Autor 72 Danksagung 72 TecFeeds

7 Ninja Penguin Limited

8 Chief Executive Penguin Trainer

9 Artificial Intelligence

10 Make my computers act on their own.

11 That s what HE thinks!

12 Write code Hack stuff Things I do Train ninja penguins Write books & articles

13 Visit observed.de for more l33t-cred

14 Steganographic AVI File Systems

15 Securing your Data

16 I don t want anyone to be able to access my data!

17 Great!

18 Cryptography!

19 Many algorithms to choose from Cryptography!

20 Variable strength Many algorithms to choose from adapts to your needs Cryptography!

21 Variable strength Many algorithms to choose from adapts to your needs Cryptography! Algorithms are rarely (*cough*) broken

22 Variable strength Many algorithms to choose from adapts to your needs Cryptography! Crypto Cascade + Algorithms are rarely (*cough*) broken Secure Passphrase = Secured data for 5 years

23

24 Me?

25

26 Airport

27 Airport Yeah, well need to check your computer.

28 Solutions

29 Don t possess the passphrase

30 Transmit data through separate channel

31 Physically hide the data

32 Thou shall not pass!

33 (That, or the wrench)

34 Introducing Super Hero #1

35 Steganography

36 Hey, Truecrypt does that!

37 Truecrypt 7.0a - Hidden partitions - Hidden volume within crypto container - Hidden OS

38 3 Problems

39 Need for fake outer partition

40

41 Partition Overwriting

42 Cool. Just write one gig of data to that disk and we ll let you go.

43 Transporting lots of data

44 I always travel with 5 1-terabyte-disks containing only 15MB each!

45 Introducing Super Hero #2

46 File-Based Steganography!

47 Plausible Deniability

48 What? That picture I got from flickr contained a hidden message? Great Scott!

49 Carrying lots of data

50 Scenario: Male TB of data

51 Scenario A: Male TB of data 5 1-terabyteharddrives containing 150MB each

52 Scenario B: Male TB of data 5 terabytes of miscellaneous video files

53 Sharing through open channels

54

55 Problem?

56 Yes, actually.

57 Storing and accessing data is tiresome

58 Carrying specialized tools for access

59 Don t mind my 400GB picture collection and the folder labeled steganographic imaging toolset

60 Can t be modified while hidden

61 Files need to be decloaked to be accessed

62

63 Let s address some of these issues

64 Introducing MariaFS

65 Put your money where your mouth is!

66 -- Cut at the perforated line --

67 -- Cut at the perforated line --

68 Goals

69 Easy to use Goals Reasonably fast Unsuspicious in airport setting Clear language

70 Problem Solution Hiding Files Carrying Lots of Files Steganography File Based Steganography Specialized Toolset Hard to use Needs to decrypt to alter Hard to alter, adapt, extend

71 Problem Solution Hiding Files Carrying Lots of Files Specialized Toolset Hard to use Needs to decrypt to alter Hard to alter, adapt, extend Steganography Steganography in AVI Containers File System Driver (1 file) Simple CLI usage (once, when mounting) Steganography hidden from user Python

72 PornFS

73 PornFS MariaFS

74 PornFS MariaFS (Ask someone Japanese if you don t get the joke)

75 2_cups_1_girl_starbucks_commercial.avi

76 2_cups_1_girl_starbucks_commercial.avi Mount using custom FUSE driver

77 2_cups_1_girl_starbucks_commercial.avi Mount using custom FUSE driver Provide data to user abstracted as FS

78 FUSE?

79 FUSE? Filesystem in User Space

80 FUSE? Filesystem in User Space Allows fast FS implementation

81 FUSE? Filesystem in User Space Allows fast FS implementation Supports many languages

82 Implemented in FUSE ntfs-3g GmailFS sshfs GVFS (Gnome) s3fs

83 Ideas for Infosec Write custom FS to nail down access policies, log, etc Specialized FS for honeypots Extend existing FS Write custom FS that returns the complete lyrics to Rick Astley s Never gonna give you up for every file read

84

85 AVI?

86 Very common AVI?

87 Very common AVI? Large size differences

88 Gap between Very common data and index AVI? Large size differences

89 Gap between Very common data and index AVI? Large size Easy Structure differences

90 AVI File Structure

91 RIFF Resource Interchange File Format

92 RIFF Length AVI LIST hdrl hdrl data movi movi data idx1 idx1 data

93 RIFF Length AVI LIST hdrl hdrl data movi movi data idx1 idx1 data

94 RIFF Length AVI LIST hdrl hdrl data movi movi data MariaFS Data idx1 idx1 data

95 Internals

96 Requirements

97 FUSE OSXFuse macfuse Requirements

98 FUSE OSXFuse macfuse Python 2.6+ Requirements

99 FUSE OSXFuse macfuse Python 2.6+ Requirements FUSE-Python bindings + PyCrypto

100 FUSE OSXFuse macfuse Python 2.6+ Requirements FUSE-Python bindings + PyCrypto Tons o RAM

101 creating python mariafs.py -c somefile.avi

102 FS Markers "VIDFSBEGIN" Passphrase "VIDFSEND" AES Encrypted Markers Insert before IDX

103 mounting python mariafs.py somefile.avi \ mountpoint/ -o allow_other

104 FS Markers "VIDFSBEGIN" Passphrase "VIDFSEND" AES Encrypted Markers Encrypted Markers in File?

105 deleting python mariafs.py -x somefile.avi

106 FS Markers "VIDFSBEGIN" Passphrase "VIDFSEND" AES Encrypted Markers Delete everything between markers

107 Markers BEGINNING_MARKER_PLAIN = "VIDFSBEGIN" END_MARKER_PLAIN = "VIDFSEND" FILE_NAME_MARKER_PLAIN = "FILENAME" FILE_STATS_MARKER_PLAIN = "FILESTATS" FILE_DATA_MARKER_PLAIN = "FILEDATA"

108 FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA

109 FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA

110 VIDFSBEGIN FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA FILENAMEDATADATADATA FILESTATSDATADATADATA FILEDATADATADATADATA VIDFSEND

111 Stats atime mtime ctime size uid gid

112 Detectability

113 Writing Data

114 File is mmaped Writing Data

115 File is mmaped Writing Data New file created or old one updated with fresh data / stats

116 File is mmaped Writing Data Rebuild mmap New file created or old one updated with fresh data / stats

117 File is mmaped Return Writing Data Rebuild mmap New file created or old one updated with fresh data / stats

118 Speed Read: 0.01 MB/s Write: 0.2 MB/s

119

120 Speed Read: 0.3 MB/s Write: 2.5 MB/s

121 Main Demonstration

122 Limitations

123 Scalability

124 Maximum Number of Files Scalability

125 Maximum Number of Files Scalability RAM Usage

126 Maximum Number of Files Scalability RAM Usage Maximum File Size

127 Non-implemented FS Features

128 Simultaneous Access Non-implemented FS Features

129 Simultaneous Access Non-implemented FS Features Access Controls

130 Simultaneous Access Non-implemented FS Features Access Controls Devices

131 Code:

132 Image Attributions pigpogm (page 4) xkcd (page 10) djwundi (page 34) skampy (page 45) logos of respective companies (page 54) steffenz (page 62) 60 in 3 (page 84) Hyperbole and a half (page 118)

133 Questions? Ideas? Bacon?

134 Thank you for listening!