1. Steven C. Markey,MSIS,PMP,CISSP,CIPP/US,CISM,CISA,STS-EV,CCSK
Principal,nControl,LLC
AdjunctProfessor
Reverse Engineering Thick-clients

2. • Agenda
– Thick-client Overview
– Attack Surface
– Reverse Engineering Thick-clients
Reverse Engineering Thick-clients

3. Reverse Engineering Thick-clients
• Thick-client Overview
– “Old School”
• Local Software & Occasional Local Storage
– Local Software Connecting to Server Software
• Traditionally Installed Local Software via TCP/IP Sockets
• Web Delivered Local Software via TCP/IP Sockets
• Web Delivered Local Software via HTTP/S
– Alternative to Web/Thin Clients
• Occasionally More Efficient
• Allows for Interaction with Local Office Automation Software
• Allows for Syncing/Batch Uploads for Offline Use

4. Reverse Engineering Thick-clients
• Thick-client Attack Surface
– Local Software & Local Storage = Local Exposures
• Rootkits
• Cache & Registry Corruption
• Information Disclosure
– One-off Exposures
• Access to Office Automation Software Exposures
– Ignorance is Bliss
• Assumed Lack of Attack Surface
– Can Still Proxy Requests
– Sniffers Can Be Goldmines
• Overreliance on Data in Transit Crypto Protections
• Overreliance on Segregation of Duties & Access Controls

5. Reverse Engineering Thick-clients
• Reverse Engineering Thick-clients
– Tools
• Decompilers: Dotpeek, Reflector, JustDecompile, ILSpy, DILE,
PEBrowse, Java Decompile, Mocha & DJ Java Compiler
• Profilers: Eclipse – Test & Performance Tools Platform (TPTP),
MSVS – MSIL Disassembler (lldasm), YourKit & DTrace
• Proxies: Burp – Wsdler.jar, BurpJDSer.jar, ZAP & Paros
• Sniffers: Wireshark
– Access
• Binaries
• Local Files, Storage & Office Automation Plugins

6. Reverse Engineering Thick-clients
• Example
– App
• Java Swing TCP-based Thick-client  AWS EC2 Java 7
– AWS AMI Linux Distro, Executable JAR on Server & Local MySQL
– Windows 8.1, Java 7
– Tools
• Decompilers: DJ Java Decompiler & Mocha
• Profilers: YourKit
• Proxies: Burp – Wsdler.jar, BurpJDSer.jar
• Sniffers: Wireshark
– Access
• Binaries, Local Files, Storage & Office Automation Plugins

7. • Questions?
• Contact
– Email: steve@ncontrol-llc.com
– LinkedIn: http://www.linkedin.com/in/smarkey
– Twitter: markes1