Abysssec Research. 1) Advisory information. 2) Vulnerable version
|
|
|
- Roxanne Hensley
- 7 years ago
- Views:
Transcription
1 Abysssec Research 1) Advisory information Title Version Analysis Vendor Impact Contact Twitter CVE : Microsoft MPEG Layer- 3 Audio Stack Based Overflow : l3codeca.acm (XP SP2 XP SP3) : : : Ciritical : shahin [at] abysssec.com, info [at] abysssec.com : CVE ) Vulnerable version Nortel Networks Symposium Nortel Networks Contact Center NCC 0 Nortel Networks Contact Center Manager Server 0 Nortel Networks Contact Center Express Nortel Networks Contact Center Administration 0 Nortel Networks Contact Center - TAPI Server 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 702t Nortel Networks CallPilot 600r Nortel Networks CallPilot 202i Nortel Networks CallPilot 201i Nortel Networks CallPilot 1005r Nortel Networks CallPilot 1002rp Microsoft Windows XP Tablet PC Edition SP3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition SP2 Microsoft Windows XP Professional SP3 Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP3 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP3 Microsoft Windows XP Home SP2 Microsoft Windows Vista Ultimate 64- bit edition SP2
2 Microsoft Windows Vista Ultimate 64- bit edition SP1 Microsoft Windows Vista Ultimate 64- bit edition 0 Microsoft Windows Vista Home Premium 64- bit edition SP2 Microsoft Windows Vista Home Premium 64- bit edition SP1 Microsoft Windows Vista Home Premium 64- bit edition 0 Microsoft Windows Vista Home Basic 64- bit edition SP2 Microsoft Windows Vista Home Basic 64- bit edition SP1 Microsoft Windows Vista Home Basic 64- bit edition 0 Microsoft Windows Vista Enterprise 64- bit edition SP2 Microsoft Windows Vista Enterprise 64- bit edition SP1 Microsoft Windows Vista Enterprise 64- bit edition 0 Microsoft Windows Vista Business 64- bit edition SP2 Microsoft Windows Vista Business 64- bit edition SP1 Microsoft Windows Vista Business 64- bit edition 0 Microsoft Windows Vista Ultimate SP2 Microsoft Windows Vista Ultimate SP1 Microsoft Windows Vista Home Premium SP2 Microsoft Windows Vista Home Premium SP1 Microsoft Windows Vista Home Basic SP2 Microsoft Windows Vista Home Basic SP1 Microsoft Windows Vista Enterprise SP2 Microsoft Windows Vista Enterprise SP1 Microsoft Windows Vista Business SP2 Microsoft Windows Vista Business SP1 Microsoft Windows Server 2008 for x64- based Systems SP2 Microsoft Windows Server 2008 for x64- based Systems 0 Microsoft Windows Server 2008 for 32- bit Systems SP2 Microsoft Windows Server 2008 for 32- bit Systems 0 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Advanced Server SP4 Microsoft MPEG Layer- 3 codecs 0 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Messaging Application Server 0 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0
3 3) Vulnerability information Class 1- Code execution Impact Successfully exploiting this issue allows remote attackers to cause denial-ofservice conditions. Remotely Exploitable Yes Locally Exploitable Yes 4) Vulnerabilities detail The flaw exists because of not properly checking a malformed AVI contains MPEG Layer- 3(mp3) audio contents. In l3codecx.ax module which is a vulnerable codec there is sub_72cd1ef0 function responsible for processing data for movi section of AVI file (According to MPEGLAYER3WAVEFORMAT structure). sub_72cd1ef0 function takes 4 arguments, first argument is address of MPEGLAYER3WAVEFORMAT structure. Second is the address of part of AVI file data which is related to mp3 file frames. Third argument is length of data. And the last argument is an address that usually equals to zero. In part of the function value of nblocksize field of MPEGLAYER3WAVEFORMAT structure is checked not to be 1. 72CD1F03 72CD1F07 72CD1F0F 72CD1F13 MOV AX,WORD PTR DS:[ESI+18] MOV DWORD PTR SS:[ESP+10],0 CMP AX,1 JE l3codecx.72cd2079 Then third argument as length of audio data is divided by value of nblocksize and if remainder of division equals to zero, value of fourth argument ( usually zero ) is substituted from length of data and compared with nblocksize field. In case of greater than nblocksize field the examination is continued. 72CD1F19 MOV ECX,DWORD PTR SS:[ESP+B4]
4 72CD1F20 72CD1F22 72CD1F28 72CD1F2A 72CD1F2C 72CD1F2E 72CD1F30 72CD1F36 72CD1F3D 72CD1F3F 72CD1F41 MOV EBP,EAX AND EBP,0FFFF MOV EAX,ECX XOR EDX,EDX DIV EBP TEST EDX,EDX JNZ l3codecx.72cd2080 MOV EBX,DWORD PTR SS:[ESP+B8] SUB ECX,DWORD PTR DS:[EBX] CMP ECX,EBP JB l3codecx.72cd20ab Then value of mp3 frame header with "41434D00" and next 4bytes after header with " " is compared. If results of these comparisons are positive, we reach in to sub_72cd1da0 function, otherwise skip it. 72CD1FA6 72CD1FAC 72CD1FB2 72CD1FBA 72CD1FBC 72CD1FC2 72CD1FC6 72CD1FC7 72CD1FCD 72CD1FD0 72CD1FD2 72CD1FD3 72CD1FD7 72CD1FD8 72CD1FD9 72CD1FDB CMP EDX,41434D00 JNZ l3codecx.72cd2032 CMP DWORD PTR SS:[ESP+14], JNZ SHORT l3codecx.72cd2032 MOV EAX,DWORD PTR DS:[EDI+DC] LEA ECX,DWORD PTR SS:[ESP+18] INC EAX MOV DWORD PTR DS:[EDI+DC],EAX MOV EDX,DWORD PTR DS:[ESI+4] PUSH EDX MOV AX,WORD PTR DS:[ESI+2] PUSH EAX PUSH ECX MOV ECX,EDI CALL l3codecx.72cd1da0 In fact sub_72cd1da0 function call, means value of nsamplepersec field from WAWFORMATEX structure need more examination. This function takes three arguments. First argument of that address is 144 bytes buffer. Second argument is value nchannels field form WAVEFORMATEX structure. And the third argument is value of nsamplespersec field. In this function known number of 144bytes buffer will be set to zero by REP STOS instruction which acts like memset function. 72CD1DA7 72CD1DAC 72CD1DAD 72CD1DAF 72CD1DB1 72CD1DB6 72CD1DBC 72CD1DC1 72CD1DC3 72CD1DC8 72CD1DCD CMP EAX,2B11 PUSH EDI JA SHORT l3codecx.72cd1ddb JE SHORT l3codecx.72cd1dcd CMP EAX,1F40 JNZ l3codecx.72cd1e88 MOV ESI,48 MOV ECX,800 JMP l3codecx.72cd1e94
5 72CD1DCF 72CD1DD4 72CD1DD6 72CD1DDB 72CD1E88 72CD1E8C 72CD1E90 72CD1E94 72CD1E98 72CD1E9C 72CD1E9F 72CD1EA1 72CD1EA3 72CD1EA5 72CD1EA8 72CD1EAE 72CD1EB1 72CD1EB3 72CD1EB5 72CD1EB7 72CD1EB9 72CD1EBB 72CD1EBE 72CD1EC0 72CD1EC2 72CD1EC5 MOV ESI,34 XOR ECX,ECX JMP l3codecx.72cd1e94 CMP EAX,3E80 MOV ESI,DWORD PTR SS:[ESP+1C] MOV EAX,DWORD PTR SS:[ESP+1C] MOV ECX,DWORD PTR SS:[ESP+1C] MOV EDX,DWORD PTR SS:[ESP+18] MOV EBX,DWORD PTR SS:[ESP+14] SUB EDX,2 MOV EDI,EBX NEG EDX SBB EDX,EDX AND EDX,3 OR EDX,FFFF8840 SHL EDX,6 OR EDX,ECX MOV ECX,ESI MOV EBP,ECX OR EDX,EAX SHR ECX, REP STOS DWORD PTR ES:[EDI] MOV ECX,EBP AND ECX,3 REP STOS BYTE PTR ES:[EDI] If you look at the code carefully, in the value of nsamplespersec field is not equal to values 2B11 EE0 3E DC0 7D00 AC44 and BB80, the count value indicating number of bytes that should be set to zero doesn t checked properly and will be set to value of nsamplespersec field. So if nsamplespersec is greater than 90h or 144, a stack overflow occurs. Here is the vulnerable (secondary) and patched (primary) version of the function. As you see in the first block an instruction is added. The value of esi register at next steps would be nsamplespersec field. In the patched version this value first is initialized by zero so in case of inequality with those exact values, number of bytes that should be null is zero.
![72cd1e94 CMP EAX,3E80 MOV ESI,DWORD PTR SS:[ESP+1C] MOV EAX,DWORD PTR SS:[ESP+1C] MOV ECX,DWORD PTR SS:[ESP+1C] MOV EDX,DWORD PTR SS:[ESP+18] MOV EBX,DWORD PTR SS:[ESP+14] SUB EDX,2 MOV EDI,EBX NEG](/docs-images/47/20873582/images/page_5.jpg "EDX SBB EDX,EDX AND EDX,3 OR EDX,FFFF8840 SHL EDX,6 OR EDX,ECX MOV ECX,ESI MOV EBP,ECX OR EDX,EAX SHR ECX, REP STOS DWORD PTR ES:[EDI] MOV ECX,EBP AND ECX,3 REP STOS BYTE PTR ES:[EDI] If you look at")
Abysssec Research. 1) Advisory information. 2) Vulnerable version
Abysssec Research 1) Advisory information Title Version Discovery Vendor Impact Contact Twitter CVE : Apple QuickTime FlashPix NumberOfTiles Remote Code Execution Vulnerability : QuickTime player 7.6.5
TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com
TitanMist: Your First Step to Reversing Nirvana TitanMist mist.reversinglabs.com Contents Introduction to TitanEngine.. 3 Introduction to TitanMist 4 Creating an unpacker for TitanMist.. 5 References and
Heap-based Buffer Overflow Vulnerability in Adobe Flash Player
Analysis of Zero-Day Exploit_Issue 03 Heap-based Buffer Overflow Vulnerability in Adobe Flash Player CVE-2014-0556 20 December 2014 Table of Content Overview... 3 1. CVE-2014-0556 Vulnerability... 3 2.
Violating Database - Enforced Security Mechanisms
Violating Database - Enforced Security Mechanisms Runtime Patching Exploits in SQL Server 2000: a case study Chris Anley [chris@ngssoftware.com] 18/06/2002 An NGSSoftware Insight Security Research (NISR)
http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention
http://www.nologin.org Bypassing Windows Hardware-enforced Data Execution Prevention Oct 2, 2005 skape mmiller@hick.org Skywing Skywing@valhallalegends.com One of the big changes that Microsoft introduced
Disassembly of False Positives for Microsoft Word under SCRAP
Disassembly of False Positives for Microsoft Word under SCRAP We evaluated Word application of Microsoft Office 2010 Suite using a 54 KiB document [1] under the SCRAP configuration S 7,4 for one billion
Windows XP SP3 Registry Handling Buffer Overflow
Windows XP SP3 Registry Handling Buffer Overflow by Matthew j00ru Jurczyk and Gynvael Coldwind Hispasec 1. Basic Information Name Windows XP SP3 Registry Handling Buffer Overflow Class Design Error Impact
Software Fingerprinting for Automated Malicious Code Analysis
Software Fingerprinting for Automated Malicious Code Analysis Philippe Charland Mission Critical Cyber Security Section October 25, 2012 Terms of Release: This document is approved for release to Defence
How To Hack The Steam Voip On Pc Orchesterian Moonstone 2.5 (Windows) On Pc/Robert Kruber (Windows 2) On Linux 2.2.2 (Windows 3.5) On A Pc
ReVuln Ltd. http://revuln.com @revuln info@revuln.com Revision 3 STEAM VOIP SECURITY BY LUIGI AURIEMMA Overview and details about the security issues found in the Steam voice framework. TABLE OF CONTENTS
Return-oriented programming without returns
Faculty of Computer Science Institute for System Architecture, Operating Systems Group Return-oriented programming without urns S. Checkoway, L. Davi, A. Dmitrienko, A. Sadeghi, H. Shacham, M. Winandy
Software Vulnerabilities
Software Vulnerabilities -- stack overflow Code based security Code based security discusses typical vulnerabilities made by programmers that can be exploited by miscreants Implementing safe software in
1. General function and functionality of the malware
1. General function and functionality of the malware The malware executes in a command shell, it begins by checking to see if the executing file contains the MZP file extension, and then continues to access
Buffer Overflows. Security 2011
Buffer Overflows Security 2011 Memory Organiza;on Topics Kernel organizes memory in pages Typically 4k bytes Processes operate in a Virtual Memory Space Mapped to real 4k pages Could live in RAM or be
Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail
![Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail](/thumbs/31/15336358.jpg "Hacking Techniques & Intrusion Detection. Ali Al-Shemery arabnix [at] gmail")
Hacking Techniques & Intrusion Detection Ali Al-Shemery arabnix [at] gmail All materials is licensed under a Creative Commons Share Alike license http://creativecommonsorg/licenses/by-sa/30/ # whoami Ali
Cloud Security Is Not (Just) Virtualization Security
Mihai Christodorescu, Reiner Sailer, Douglas Lee Schales, Daniele Sgandurra, Diego Zamboni IBM Research Cloud Security Is Not (Just) Virtualization Security Virtualization Enables Many Security Applications
Introduction. Figure 1 Schema of DarunGrim2
Reversing Microsoft patches to reveal vulnerable code Harsimran Walia Computer Security Enthusiast 2011 Abstract The paper would try to reveal the vulnerable code for a particular disclosed vulnerability,
CS412/CS413. Introduction to Compilers Tim Teitelbaum. Lecture 20: Stack Frames 7 March 08
CS412/CS413 Introduction to Compilers Tim Teitelbaum Lecture 20: Stack Frames 7 March 08 CS 412/413 Spring 2008 Introduction to Compilers 1 Where We Are Source code if (b == 0) a = b; Low-level IR code
esrever gnireenigne tfosorcim seiranib
esrever gnireenigne tfosorcim seiranib Alexander Sotirov asotirov@determina.com CanSecWest / core06 Reverse Engineering Microsoft Binaries Alexander Sotirov asotirov@determina.com CanSecWest / core06 Overview
Fighting malware on your own
Fighting malware on your own Vitaliy Kamlyuk Senior Virus Analyst Kaspersky Lab Vitaly.Kamluk@kaspersky.com Why fight malware on your own? 5 reasons: 1. Touch 100% of protection yourself 2. Be prepared
CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis
Your texte here. CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis October 11 th, 2012 Brian MARIANI & Frédéric BOURLA A FEW WORDS ABOUT FLASH PLAYER Your Adobe texte Flash here
x64 Cheat Sheet Fall 2015
CS 33 Intro Computer Systems Doeppner x64 Cheat Sheet Fall 2015 1 x64 Registers x64 assembly code uses sixteen 64-bit registers. Additionally, the lower bytes of some of these registers may be accessed
A Tiny Guide to Programming in 32-bit x86 Assembly Language
CS308, Spring 1999 A Tiny Guide to Programming in 32-bit x86 Assembly Language by Adam Ferrari, ferrari@virginia.edu (with changes by Alan Batson, batson@virginia.edu and Mike Lack, mnl3j@virginia.edu)
Analysis of Win32.Scream
Analysis of Win32.Scream 1. Introduction Scream is a very interesting virus as it combines a lot of techniques written inside of it. In this paper I ll cover all of its features and internals. I ll dissect
REpsych. : psycholigical warfare in reverse engineering. def con 2015 // domas
REpsych : psycholigical warfare in reverse engineering { def con 2015 // domas Warning This serves no purpose Taking something apart to figure out how it works With software Interfacing Documentation Obsolescence
Off-by-One exploitation tutorial
Off-by-One exploitation tutorial By Saif El-Sherei www.elsherei.com Introduction: I decided to get a bit more into Linux exploitation, so I thought it would be nice if I document this as a good friend
Attacking x86 Windows Binaries by Jump Oriented Programming
Attacking x86 Windows Binaries by Jump Oriented Programming L. Erdődi * * Faculty of John von Neumann, Óbuda University, Budapest, Hungary erdodi.laszlo@nik.uni-obuda.hu Abstract Jump oriented programming
Systems Design & Programming Data Movement Instructions. Intel Assembly
Intel Assembly Data Movement Instruction: mov (covered already) push, pop lea (mov and offset) lds, les, lfs, lgs, lss movs, lods, stos ins, outs xchg, xlat lahf, sahf (not covered) in, out movsx, movzx
Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques
Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques By Omri Herscovici & Liran Englender January 04, 2015 Preface In recent years, exploit-kits are one of the most common platforms
INTRODUCTION TO MALWARE & MALWARE ANALYSIS
INTRODUCTION TO MALWARE & MALWARE ANALYSIS by Quick Heal R&D lab Security Simplified INTRODUCTION Very often people call everything that corrupts their system a virus without being aware about what it
Remote Zugang, sicher und einfach
Remote Zugang, sicher und einfach Referent Jürgen Mahler Security Consultant / Engineer Eidg. Dipl. Informatiker FH Itris Enterprise AG +41 58 855 5063 jmahler@itris-enterprise.ch by ITRIS Enterprise AG
Removing Sentinel SuperPro dongle from Applications and details on dongle way of cracking Shub-Nigurrath of ARTeam Version 1.
Removing Sentinel SuperPro dongle from Applications Shub-Nigurrath of ARTeam Version 1.0 September 2006 1. Abstract... 2 2. Possible approaches: emulations vs simulation... 3 2.1. How a dongle works...
For a 64-bit system. I - Presentation Of The Shellcode
#How To Create Your Own Shellcode On Arch Linux? #Author : N3td3v!l #Contact-mail : 4nonymouse@usa.com #Website : Nopotm.ir #Spcial tnx to : C0nn3ct0r And All Honest Hackerz and Security Managers I - Presentation
The Beast is Resting in Your Memory On Return-Oriented Programming Attacks and Mitigation Techniques To appear at USENIX Security & BlackHat USA, 2014
Intelligent Things, Vehicles and Factories: Intel Workshop on Cyberphysical and Mobile Security 2014, Darmstadt, June 11 The Beast is Resting in Your Memory On Return-Oriented Programming Attacks and Mitigation
64-Bit NASM Notes. Invoking 64-Bit NASM
64-Bit NASM Notes The transition from 32- to 64-bit architectures is no joke, as anyone who has wrestled with 32/64 bit incompatibilities will attest We note here some key differences between 32- and 64-bit
Computer Organization and Architecture
Computer Organization and Architecture Chapter 11 Instruction Sets: Addressing Modes and Formats Instruction Set Design One goal of instruction set design is to minimize instruction length Another goal
Application-Specific Attacks: Leveraging the ActionScript Virtual Machine
IBM Global Technology Services April 2008 Application-Specific Attacks: Leveraging the ActionScript Virtual Machine By Mark Dowd X-Force Researcher IBM Internet Security Systems (markdowd@au1.ibm.com)
OpenBSD Remote Exploit
OpenBSD Remote Exploit Only two remote holes in the default install Alfredo Ortega, Gerardo Richarte Core Security April 2007 Abstract OpenBSD is regarded as a very secure Operating System. This article
Complete 8086 instruction set
Page 1 of 53 Complete 8086 instruction set Quick reference: AAA AAD AAM AAS ADC ADD AND CALL CBW CLC CLD CLI CMC CMP CMPSB CMPSW CWD DAA DAS DEC DIV HLT IDIV IMUL IN INC INT INTO I JA JAE JB JBE JC JCXZ
X86-64 Architecture Guide
X86-64 Architecture Guide For the code-generation project, we shall expose you to a simplified version of the x86-64 platform. Example Consider the following Decaf program: class Program { int foo(int
Win32.Winux.txt Wed Nov 21 13:30:00 2001 1 ; +-----------------------+ ; : Win32/Linux.Winux : ; +--+----------------+---+ ; : by Benny/29A : ;
Win32.Winux.txt Wed Nov 21 13:30:00 2001 1 +-----------------------+ : Win32/Linux.Winux : +--+----------------+---+ : by Benny/29A : +----------------+ Heya ppl, lemme introduce you my first multi-platform
Syscall Proxying - Simulating remote execution Maximiliano Caceres <maximiliano.caceres@corest.com> Copyright 2002 CORE SECURITY TECHNOLOGIES
Syscall Proxying - Simulating remote execution Maximiliano Caceres Copyright 2002 CORE SECURITY TECHNOLOGIES Table of Contents Abstract.........................................................................................
PCI-SIG ENGINEERING CHANGE REQUEST
PCI-SIG ENGINEERING CHANGE REQUEST TITLE: Update DMTF SM CLP Specification References DATE: 8/2009 AFFECTED DOCUMENT: PCIFW30_CLP_1_0_071906.pdf SPONSOR: Austin Bolen, Dell Inc. Part I 1. Summary of the
Stitching the Gadgets On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection
USENIX Security Symposium 2014, San Diego, CA, USA Stitching the Gadgets On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection Lucas Davi Intel Collaborative Research Institute for
風 水. Heap Feng Shui in JavaScript. Alexander Sotirov. asotirov@determina.com
風 水 Heap Feng Shui in JavaScript Alexander Sotirov asotirov@determina.com Black Hat Europe 2007 Introduction What is Heap Feng Shui? the ancient art of arranging heap blocks in order to redirect the program
Computer Organization and Assembly Language
Computer Organization and Assembly Language Lecture 8 - Strings and Arrays Introduction We already know that assembly code will execute significantly faster than code written in a higher-level language
Machine-Level Programming II: Arithmetic & Control
Mellon Machine-Level Programming II: Arithmetic & Control 15-213 / 18-213: Introduction to Computer Systems 6 th Lecture, Jan 29, 2015 Instructors: Seth Copen Goldstein, Franz Franchetti, Greg Kesden 1
Overview of IA-32 assembly programming. Lars Ailo Bongo University of Tromsø
Overview of IA-32 assembly programming Lars Ailo Bongo University of Tromsø Contents 1 Introduction... 2 2 IA-32 assembly programming... 3 2.1 Assembly Language Statements... 3 2.1 Modes...4 2.2 Registers...4
Reverse Engineering Malware Part 1
Reverse Engineering Malware Part 1 Author :Arunpreet Singh Blog : https://reverse2learn.wordpress.com MD5 Hash : 1d8ea40a41988b9c3db9eff5fce3abe5 This is First Part of 2 Part Series.This Malware Drops
Reverse Engineering and Computer Security
Reverse Engineering and Computer Security Alexander Sotirov alex@sotirov.net Introduction Security researcher at Determina, working on our LiveShield product Responsible for vulnerability analysis and
Instruction Set Architecture
CS:APP Chapter 4 Computer Architecture Instruction Set Architecture Randal E. Bryant adapted by Jason Fritts http://csapp.cs.cmu.edu CS:APP2e Hardware Architecture - using Y86 ISA For learning aspects
Assembly Language: Function Calls" Jennifer Rexford!
Assembly Language: Function Calls" Jennifer Rexford! 1 Goals of this Lecture" Function call problems:! Calling and returning! Passing parameters! Storing local variables! Handling registers without interference!
WLSI Windows Local Shellcode Injection. Cesar Cerrudo Argeniss (www.argeniss.com)
WLSI Windows Local Shellcode Injection Cesar Cerrudo Argeniss (www.argeniss.com) Overview _ Introduction _ Establishing a LPC connection _ Creating a shared section _ The technique _ Building an exploit
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Title: Bugger The Debugger - Pre Interaction Debugger Code Execution
White Paper Title: Bugger The Debugger Pre Interaction Debugger Code Execution Prepared by: Brett Moore Network Intrusion Specialist, CTO SecurityAssessment.com Date: April 2005 Abstract The use of debuggers
Self Protection Techniques in Malware
DSIE 10 5 th Doctoral lsymposium on Informatics Engineering i January 28 29, 2010 Porto, Portugal Self Protection Techniques in Malware Tiago Santos Overview Introduction Malware Types Why Self Protection?
Introduction to Reverse Engineering
Introduction to Reverse Engineering Inbar Raz Malware Research Lab Manager December 2011 What is Reverse Engineering? Reverse engineering is the process of discovering the technological principles of a
Appendix F: Instructions for Downloading Microsoft Access Runtime
Appendix F: Instructions for Downloading Microsoft Access Runtime The Consumer Products Reporting Tool is designed to work with Microsoft Access 2010 or later. For the best compatibility, please refer
CS61: Systems Programing and Machine Organization
CS61: Systems Programing and Machine Organization Fall 2009 Section Notes for Week 2 (September 14 th - 18 th ) Topics to be covered: I. Binary Basics II. Signed Numbers III. Architecture Overview IV.
Stack Overflows. Mitchell Adair
Stack Overflows Mitchell Adair Outline Why? What? There once was a VM Virtual Memory Registers Stack stack1, stack2, stack3 Resources Why? Real problem Real money Real recognition Still prevalent Very
Bypassing Anti- Virus Scanners
Bypassing Anti- Virus Scanners Abstract Anti-Virus manufacturers nowadays implements more and more complex functions and algorithms in order to detect the latest and newest viruses along with their variants.
Harnessing Intelligence from Malware Repositories
Harnessing Intelligence from Malware Repositories Arun Lakhotia and Vivek Notani Software Research Lab University of Louisiana at Lafayette arun@louisiana.edu, vxn4849@louisiana.edu 7/22/2015 (C) 2015
Securing software by enforcing data-flow integrity
Securing software by enforcing data-flow integrity Manuel Costa Joint work with: Miguel Castro, Tim Harris Microsoft Research Cambridge University of Cambridge Software is vulnerable use of unsafe languages
Metasploit Beginners
Metasploit Beginners #.. # # _/ \ _ \ _/ # # / \ \\ \ / // \/ /_\ \ / / \ # # / /_/ / \ \/ \ /\ \ \ # # \/ \/ \/ # # # # _/ \ \_/ \ \/ \/ / # # \ \ \/\ /\ / # # \
Inside a killer IMBot. Wei Ming Khoo University of Cambridge 19 Nov 2010
Do you? or Inside a killer IMBot Wei Ming Khoo University of Cambridge 19 Nov 2010 Background Tracking a botnet propagating over Skype & Yahoo IM. Bait is Foto Exploits social connectivity (friend
Lecture 7: Machine-Level Programming I: Basics Mohamed Zahran (aka Z) mzahran@cs.nyu.edu http://www.mzahran.com
CSCI-UA.0201-003 Computer Systems Organization Lecture 7: Machine-Level Programming I: Basics Mohamed Zahran (aka Z) mzahran@cs.nyu.edu http://www.mzahran.com Some slides adapted (and slightly modified)
CSIS Security Research and Intelligence Advisory Microsoft GDI+ Integer division by zero flaw handling.ico files VU#290961 CVE-2007-2237
CSIS Security Research and Intelligence Advisory Microsoft GDI+ Integer division by zero flaw handling.ico files VU#290961 CVE-2007-2237 Discovered by Dennis Rand rand@csis.dk http://www.csis.dk Table
Packers Models. simple. malware. advanced. allocation. decryption. decompression. engine loading. integrity check. DRM Management
allocation allocation (VirtualAlloc / empty section) trapped start allocation (VirtualAlloc / empty section) (MANY layers,add/rol/xor) startup decompression engine loading (one layer,add/rol/xor) (Tea/RC4/operators)
CS:APP Chapter 4 Computer Architecture Instruction Set Architecture. CS:APP2e
CS:APP Chapter 4 Computer Architecture Instruction Set Architecture CS:APP2e Instruction Set Architecture Assembly Language View Processor state Registers, memory, Instructions addl, pushl, ret, How instructions
What Happens In Windows 7 Stays In Windows 7
What Happens In Windows 7 Stays In Windows 7 Moti Joseph & Marion Marschalek Troopers Conference 2014 About Us Joseph Moti Security Researcher Marion Marschalek Malware Analyst 8 7 3 1-7 3 6 4-1 9 3 2-9
Defense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
CPU performance monitoring using the Time-Stamp Counter register
CPU performance monitoring using the Time-Stamp Counter register This laboratory work introduces basic information on the Time-Stamp Counter CPU register, which is used for performance monitoring. The
Understanding the Windows SMB NTLM Authentication Weak Nonce Vulnerability
Understanding the Windows SMB NTLM Authentication Weak Nonce Vulnerability Hernan Ochoa hernan@ampliasecurity.com Agustin Azubel aazubel@ampliasecurity.com September, 2010 Presentation goals: Describe
PCI Vulnerability Validation Report
Friday, March 9, 013 PCI Vulnerability Validation Report Introduction This report shows the results of a vulnerability validation tests conducted by CORE Impact Professional Professional in support of
User s Manual. Transcend JetFlash SecureDrive. Contents
User s Manual Transcend JetFlash SecureDrive Thank you for purchasing Transcend s USB Flash drive with built-in 256-bit AES encryption security. JetFlash SecureDrive helps you safeguard data by creating
Fetch TV My Media Hub Quick Start Guide for USB Devices. Sharing your media content with the set top box from a USB device
Fetch TV My Media Hub Quick Start Guide for USB Devices Sharing your media content with the set top box from a USB device Contents Contents Contents 2 Welcome to your My Media Hub 3 With My Media Hub you
Microsoft Patch Analysis
Microsoft Patch Analysis Patch Tuesday - Exploit Wednesday Yaniv Miron aka Lament 1 / About Me Yaniv Miron aka Lament Security Researcher and Consultant Found security vulnerabilities in IBM, Oracle, Microsoft
Using fuzzing to detect security vulnerabilities
Using fuzzing to detect security vulnerabilities INFIGO-TD-01-04-2006 25-04-2006 Leon Juranić Leon.Juranic@infigo.hr Infigo IS. All rights reserved. This document contains information, which is protected
System Requirements for Web Applications
for Web Overview This document contains the Web server recommendations and client workstation requirements for Business Portal for Microsoft Dynamics GP 2010, Workflow, Web Services and SQL Reporting Services
Packers. (5th April 2010) Ange Albertini http://corkami.blogspot.com Creative Commons Attribution 3.0
Packers (5th April 2010) Ange Albertini 3.0 Table of contents 3 Models: simple, malware, advanced 4 Categories and Features: compresser, protecter, crypter, bundler, virtualiser, mutater 5 Landscape: Free,
HSLAB Print Logger 5 Installation Guide
HSLAB Print Logger 5 Installation Guide NOTE: Information and screen shots in this document are related to the Print Logger EE edition. In different editions some features may be not available. See editions
MWR InfoSecurity Security Advisory. Symantec s Altiris Deployment Solution File Transfer Race Condition. 7 th January 2010
al al MWR InfoSecurity Security Advisory Symantec s Altiris Deployment Solution File Transfer Race Condition 7 th January 2010 20010-01-07 Page 1 of 8 Contents Contents 1 Detailed Vulnerability Description...4
Recommended operating systems and software for end user services. Operating systems and software not supported for end user services
Recommended operating systems and software for end user services There are different requirements for different features in Office 365 Beta Beta, but the following list will work with every feature: Windows
Exploiting Trustzone on Android
1 Introduction Exploiting Trustzone on Android Di Shen(@returnsme) retme7@gmail.com This paper tells a real story about exploiting TrustZone step by step. I target an implementation of Trusted Execution
Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com
Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic
Maximizing customer protections
Maximizing customer protections 8 7 Vista XP XP end of support 8 XP 7 Vista XP What is the risk of continuing to run XP? Attackers will have the advantage over defenders After support ends, when Microsoft
Practical taint analysis for protecting buggy binaries
Practical taint analysis for protecting buggy binaries So your exploit beats ASLR/DEP? I don't care Erik Bosman Traditional Stack Smashing buf[16] GET / HTTP/1.100baseretnarg1arg2 Traditional
PassReview. http://www.passreview.com. PassReview - IT Certification Exams Pass Review
PassReview http://www.passreview.com PassReview - IT Certification Exams Pass Review Exam : 920-166 Title : NCSS-Contact Center Multimedia Ris.6.0 Vendors : Nortel Version : DEMO NO.1 Your customer is
Where s the FEEB? The Effectiveness of Instruction Set Randomization
Where s the FEEB? The Effectiveness of Instruction Set Randomization Ana Nora Sovarel David Evans Nathanael Paul University of Virginia, Department of Computer Science http://www.cs.virginia.edu/feeb Abstract
Dynamic Behavior Analysis Using Binary Instrumentation
Dynamic Behavior Analysis Using Binary Instrumentation Jonathan Salwan jsalwan@quarkslab.com St'Hack Bordeaux France March 27 2015 Keywords: program analysis, DBI, DBA, Pin, concrete execution, symbolic
A Museum of API Obfuscation on Win32
A Museum of API Obfuscation on Win32 Masaki Suenaga Senior Software Engineer Contents Abstract... 1 File Image vs. Memory Image... 2 API Analysis... 4 Generating Memory Dumps... 5 Runtime API Address Resolution...
6. Exercise: Writing Security Advisories
CERT Exercises Toolset 49 49 6. Exercise: Writing Security Advisories Main Objective Targeted Audience Total Duration Time Schedule Frequency The objective of the exercise is to provide a practical overview
Microsoft Smooth Streaming
Microsoft Smooth Streaming for SelenioFlex Ingest August 2015 for SelenioFlex Ingest Publication Information 2015 Imagine Communications Corp. Proprietary and Confidential. Imagine Communications considers
The 80x86 Instruction Set
Thi d t t d ith F M k 4 0 2 The 80x86 Instruction Set Chapter Six Until now, there has been little discussion of the instructions available on the 80x86 microprocessor. This chapter rectifies this situation.
ATLAS.ti 6 Using Video Data
ATLAS.ti 6 Using Video Data ATLAS.ti 6 Using Video Data Copyright 2011 by ATLAS.ti Scientific Software Development GmbH, Berlin. All rights reserved. Version: 7.20111212 Author: Clemens Hoffmann, Editor:
Where we are CS 4120 Introduction to Compilers Abstract Assembly Instruction selection mov e1 , e2 jmp e cmp e1 , e2 [jne je jgt ] l push e1 call e
![Where we are CS 4120 Introduction to Compilers Abstract Assembly Instruction selection mov e1 , e2 jmp e cmp e1 , e2 [jne je jgt ] l push e1 call e](/thumbs/25/6532540.jpg "Where we are CS 4120 Introduction to Compilers Abstract Assembly Instruction selection mov e1 , e2 jmp e cmp e1 , e2 [jne je jgt ] l push e1 call e")
0/5/03 Where we are CS 0 Introduction to Compilers Ross Tate Cornell University Lecture 8: Instruction Selection Intermediate code synta-directed translation reordering with traces Canonical intermediate
Specification of the Broadcast Wave Format (BWF)
EBU TECH 3285 Specification of the Broadcast Wave Format (BWF) A format for audio data files in broadcasting Version 2.0 Geneva May 2011 1 * Page intentionally left blank. This document is paginated for
Using Heap Allocation in Intel Assembly Language
Using Heap Allocation in Intel Assembly Language Copyright 2005, Kip R. Irvine. All rights reserved. Dynamic memory allocation is a feature we take for granted in high-level languages such as C++ and Java.
White paper: August 2008. Marcin Icewall Noga martin@hispasec.com
White paper: GetCodec Multimedia Trojan Analysis August 2008 Marcin Icewall Noga martin@hispasec.com 1. Introduction Recently a new trojan was spotted spreading in the wild, infecting multi-media files
Intel 8086 architecture
Intel 8086 architecture Today we ll take a look at Intel s 8086, which is one of the oldest and yet most prevalent processor architectures around. We ll make many comparisons between the MIPS and 8086
Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>
![Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>](/thumbs/32/15517621.jpg "Unix Security Technologies. Pete Markowsky <peterm[at] ccs.neu.edu>")
Unix Security Technologies Pete Markowsky What is this about? The goal of this CPU/SWS are: Introduce you to classic vulnerabilities Get you to understand security advisories Make