CanSecWest2016

1. 0days, Exploits and Bug bounties

2. Nicholas, I’m French, no H please!
• Before at Vupen, at MSRC UK now, fixing stuff I used to break
• Been to CanSec’ before
@n_joly to find cool cat pics

3. Aug 2014 – Sept 2015, chasing the bounties
• Getting ready for big bounties
• Dealing with last minute mitigations
• Why you do absolutely need your lucky
charm
• Collisions, when you feel bad for a day

4. Get ready for action!

5. pwn2own Mobile at PacSec
• Competing on my own for the first time
• Spent 1 month+ on that challenge
• Failed at pwning the sandbox but uncovered 3 escapes for IE desktop
• Great holidays!
Trophy!
Lucky charm,
exploiter’s best friend

6. Meanwhile, between two sushis…

7. December, playing with Reader
• Playing first with known areas, uncovered some UAFs
• Opened some IDBs, was looking for 3D stuff
• Spent one month to get 2 working exploits

8. Where to look at?

9. JavaScript™ for Acrobat® 3D Annotations API
Reference

10. Spot the bugz, you have 2 secs

11. Has anybody heard of that before?

12. But what’s dumped?
That’s a return address to ScCore.dll

13. By early Feb, 3 exploits for 3 targets
• Built the escapes found earlier in November
• Built a certain number of Flash exploits, just in case
• Built a VBScript exploit for IE x64
• Built 2 PDF exploits sharing the same escape
But…

14. Let’s add mitigations
to the game!

15. What’s that CFG thing people keep talking about?

16. An optional feature…

17. How does that work?
https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065(v=vs.85).aspx

18. So basically, before the
optional update:
With CFG:
Net result: Net result:

19. Had to rethink about everything
• Reader “safe”, not compiled with the flag
• Sandbox escapes partially affected
• Flash and IE :S
Flash.ocx 17.0.0.34

20. And then the Wassenaar drama

21. Let’s find permit A-38

22. The March black Tuesday
When you need to
be lucky!

23. Here goes the crazy week
“A”vulnerability.
Not 27!!
But obviously mine!!!!

24. And then registering for the contest
• On Tuesday, 3 exploits
• On Wednesday, 2 ½ exploits
• But on Friday…

26. Time to go to Vancouver, with my 1 ½ exploits

27. Junctions!
C:dir1dir2dir3Junction..dir4dir5file
With Junction pointing to an untrusted location,
such as %temp%low
FILE_ATTRIBUTE_REPARSE_POINT
k33nteam reported 3 bugs, but missed that one!

28. • Had to code everything on site but fortunately the ferry to Vancouver
Island takes quite some time:
• First time I coded an exploit on a ferry in my life, but that was worth it!
But my story was nothing compared to that guy

29. What do I do with my escapes?

30. Spartan bug bounty comes at rescue!
http://blog.talosintel.com/2015/10/dangerous-clipboard.html

31. But what is it about?
• Heap overflow in GdiConvertBitmapV5
http://blog.talosintel.com/2015/10/dangerous-clipboard.html

32. Collisions, the true
taste of peanuts
Or when you’re grumpy for a week…

33. Collisions 1/4

34. Collisions 2/4
And by the way…
This one was reported
against AS2 only!

35. Collisions 3/4

36. Collisions 4/4
That’s k33nteam’s entry, which was also my 2nd!

37. The art of being suspect no1
CVE-2014-0574 ba.clear
CVE-2014-0588 ba.uncompressvialzma
CVE-2015-0359 ba.writeObject
CVE-2015-0312 ba.compress
…
That is NOT me
That is me

38. After one year..

39. Time needed to pay/patch a bug
Spartan bounty: payment issued 46 days after report, patches out after 79 days

40. An amazing experience
• Finally decided to join Microsoft in the UK
• So many challenges to take on!
Chromium’s Xmas
gifts
• Created a company
• Travelled everywhere
• Even gave a talk at
MOSEC!

41. Want some bounties? https://aka.ms/BugBounty
Have some cool bugz? secure@microsoft.com
Wanna wear the blue Hat? http://careers.microsoft.com
Thanks :)
Got a question

42. References
• Spartan Bounty https://technet.microsoft.com/en-us/dn972323.aspx
• Dangerous Clipboard http://blog.talosintel.com/2015/10/dangerous-clipboard.html
• Control Flow Guard https://msdn.microsoft.com/en-
us/library/windows/desktop/mt637065(v=vs.85).aspx
• Exploring CFG in Windows 10 http://blog.trendmicro.com/trendlabs-security-
intelligence/exploring-control-flow-guard-in-windows-10/
• CFG effects to memory space http://www.alex-ionescu.com/?p=246
• JavaScript™ for Acrobat® 3D Annotations API Reference
http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdfs/AcrobatDC_js_3d_
api_reference.pdf
• HackingTeam Flash Exploit http://blogs.360.cn/blog/hacking-team-part2/
• Camera.copyPixelsToByteArray https://code.google.com/p/chromium/issues/detail?id=424981
• DisplayObject.opaqueBackground https://code.google.com/p/chromium/issues/detail?id=508009
• AS2 Filters Confusion https://code.google.com/p/chromium/issues/detail?id=457261 and
https://code.google.com/p/google-security-research/issues/detail?id=244
• CVE-2015-0313 http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2015-
0313-the-new-flash-player-zero-day/