This document discusses how various file formats like documents, media, and calendars can trigger outbound network connections without user interaction or exploits. This includes leaking privacy-sensitive data and allowing remote code execution via NTLM authentication. The talk demonstrates this behavior in formats like RTF, WMV, MP3, torrents, and others. It notes security implications for de-anonymization, credential theft, and data exfiltration from organizations. Mitigations are difficult due to the variety of formats and potential for false positives or breaking legitimate functionality.

1. Bugged&Files&
Is#Your#Document#Telling#on#You?#
Daniel#Crowley,#Damon#Smith#

2. • Damon&Smith&
Who&are&we?&
• Daniel&Crowley&

3. Files&that&trigger&outbound&traffic&when&parsed&
&
&Without&being&an&executable&format&
&Regardless&of&format&complexity&
&&&&&&Without&the&use&of&exploits&
&
&…and&the&implications&of&all&that&
What&is&this&talk&about?&

4. • Privacy&
– DRM&
– DLP&
– DeFanonymization&
• Security&
– NTLM&credential&capture/relay&
– CSRF&
• ”It’s&a&feature,&not&a&bug”&
Why&is&this&important?&
&

5. Demonstration&
• RTF&
• WMV&

6. • Office&formats&
– .docx&
– .pptx&
– .xlsx&
• PLS&playlists&
• Shortcut&(.lnk)&files&
• Desktop.ini&files&
• HTML&
What&formats&are&already&known&to&
allow&this?&

7. • HTML&in&IE&
• Linked&images&in&emails&opened&in&Outlook!&
Other&NTLM&trigger&silliness&

8. • Document&formats&
• Media&formats&
• Meeting/scheduling&related&formats&
&
What&did&our&work&focus&on?&

9. • Remote&image&
– No&warning,&no&NTLM&
• App.media.openPlayer()&
– Warning,&NTLM&possible&
• getURL()&
– Warning,&NTLM&possible&
PDF&

10. • Linked&document&on&UNC&share&
– Warning&(ignored),&NTLM&possible&
RTF&

11. • Remote&XML&stylesheets&
• Javascript&
SVG&(Scalable&Vector&Graphics)&

12. • All&these&formats&support&remote&media&
– Even&UNC&paths…&
M3U&/&PLS&/&ASX&

13. • ID3&tag&
– LINK&frame&
– APIC&frame&
• Not&supported&on&
any&major&player&we&
tested&!&
MP3&

14. • URLANDEXIT&
• Launches&default&browser&with&specified&URL&
• DRM&functionality&abuse&
• Subtitles&
• Can&include&arbitrary&HTML&
ASF&(WMA/WMV/ASF)&

15. • HTTP&tracker&URLs&in&“announceFlist”&
– As&many&as&you&want&
• URL&seeds&allowed&in&“urlFlist”&
– Clients&can&implement&any&URL&handler&
• Must&support&one&or&both&of&HTTP&&&FTP&
– Not&universally&supported&
TORRENT&

16. • Free/Busy&URL&
– No&warning,&NTLM&possible&
– Requires&specific&actions&by&recipient&
VCF&(vCard&format)&

17. • VALARM&
– ATTACH&parameter&is&a&URL&
– AUDIO&and&PROCEDURE&alarm&types&
&
• ICS&is&the&iCalendar&format&
– Not&even&Calendar.app&will&let&you&accept&
PROCEDURE&!&
ICS&(iCalendar&format)&

18. • Email&
• Open&file&share&
• Watering&hole&
• P2P&distribution&
• Honeypot&
Delivery&methods&

19. • Dystopian&future&DRM&could&call&home&
– Probably&already&does&in&some&cases&
• Goes&beyond&deterrence&into&identification&
Digital&Rights&Management&

20. • Imagine&being&a&whistleblowerFtoFbe&
– In&a&fascist&country&
• The&document&you&exfiltrate&calls&home&
– From&your&work&computer&
– From&your&home&computer&
– From&your&friend’s&home&
– From&your&lawyer’s&office&
– From&a&journalist’s&office&
• You&get&disappeared&
&
Data&Loss&Prevention&

21. • Tor&Browser&only&routes&
browser&traffic&through&
Tor&
– External&programs&don’t&
route&through&Tor&
• You&don’t&control&that&
jihad&wiki&
– But&maybe&you&can&
upload&a&bugged&PDF&
DeFAnonymization&

22. • Windows&will&autoFauth&when&accessing&SMB&
• Files&can&in&some&cases&initiate&SMB&traffic&
– Embedding&remote&file://&resources&
– UNC&path&as&file&
– Javascript/other&active&content&
• NTLM&auth&can&be&cracked&or&relayed&
NTLM&Credential&Capture/Relay&

23. NTLM&overview&
Server&Client&
1.&Negotiate&
2.&Challenge&
3.&Authenticate&

24. NTLM&relay&overview&
Server&Client&
Attacker&

25. • Initiating&traffic&from&privileged&positions&is&fun&
– Exploit&router&vulns&
– Exploit&NAS/Printers&
– Exploit&IoT&devices&
CSRF&

26. • AV?&
– Too&many&formats&and&variations&
– Possibility&of&false&positives&
• Format&changes?&
– Too&much&inertia,&too&many&formats&
• ApplicationFlevel&firewalls?&
– Easy&for&RTF&
– Not&so&easy&for&M3U&
&
Possible&Mitigations&

27. • Warnings?&
• Proxychains&with&strict_chain&and&bad&proxy&
- Doesn’t&work&for&some&applications&
• Egress&filtering?&
- Doesn’t&stop&internal&connections&
- Might&stop&legitimate&functionality&
Possible&Mitigations&

28. Questions?&
Daniel#Crowley,#Damon#Smith#