More Related Content
What's hot
What's hot (20)
Similar to NDIS Packet of Death
Similar to NDIS Packet of Death (20)
Recently uploaded
Recently uploaded (20)
NDIS Packet of Death
- 2. Windows Kernel, the final frontier Our mission: to explore strange new attack surfaces, to seek out new bugs and new 0-days. To boldly go where (almost) no security researcher has gone before
- 3. NDIS PACKET OF DEATH TURNING WINDOWS’ COMPLEXITY AGAINST ITSELF NITAY ARTENSTEIN CHECK POINT
- 5. AGENDA 1. INTO THE KERNEL 2. FINDING VULNERABILITIES 3. PWNAGE: CVE-2014-9383
- 6. AGENDA 1. INTO THE KERNEL 2. FINDING VULNERABILITIES 3. PWNAGE: CVE-2014-9383
- 7. USS WINTERPRISE PACKET FLOW USERlAND KERNEL bridge / APPLICATION NETWORK CARD WINSOCK API WINSOCK KERNEL ?
- 8. KERNEL NETWORK CARD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER
- 9. Filter Drivers • Handle all packets, regardless of configuration • Massive attack surface • Small, easy to reverse engineer “Being stuck in the middle is not THAT bad!”
- 10. KERNEL NETWORK CARD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER SECURiTY 1. Third party code
- 11. KERNEL NETWORK CARD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER SECURiTY 2. Too much complexity
- 12. NETWORK DRIVER INTERFACE SPECIFICATION NETWORK CARD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER NDIS SECURiTY 3. API quality
- 13. The Windows network driver layers absolutely horrendous messes of conflicting layers of backward-compatible cruft emotional trauma the Windows network stack 🙀
- 14. Hostile Programming Environments • Bad API design • Complicated memory management • Inadequate documentation • No helper functions “They said kernel programming is good money”
- 15. NETWORK DRIVER INTERFACE SPECIFICATION NETWORK CARD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER NDIS SECURiTY 1. Third party code 2. Too much complexity 3. API quality
- 17. AGENDA 1. INTO THE KERNEL 2. FINDING VULNERABILITIES 3. PWNAGE: CVE-2014-9383
- 20. FIRST ATTACK: PACKET CONFUSION GOOD EVIL
- 21. FIRST ATTACK: PACKET CONFUSION GOOD MINIPORT DRIVER FILTER DRIVER PROTOCOL DRIVER PACKET PACKET PACKET PACKET TASK: INTERCEPT PACKET, INSPECT CONTENTS
- 22. NdisDprAllocatePacket(&Status, &MyPacket, pAdapt->RecvPacketPoolHandle); NDIS_PACKET_FIRST_NDIS_BUFFER(MyPacket) = NDIS_PACKET_FIRST_NDIS_BUFFER(Packet); NDIS_PACKET_LAST_NDIS_BUFFER(MyPacket) = NDIS_PACKET_LAST_NDIS_BUFFER(Packet); // Inspect packet here NdisMIndicateReceivePacket(pAdapt->MiniportHandle, &MyPacket, 1); FIRST ATTACK: PACKET CONFUSION GOOD
- 23. FIRST ATTACK: PACKET CONFUSION GOOD [The receive function] the received data as soon as it is copied system performance. Instead, the driver must
- 24. NdisDprAllocatePacket(&Status, &MyPacket, pAdapt->RecvPacketPoolHandle); NDIS_PACKET_FIRST_NDIS_BUFFER(MyPacket) = NDIS_PACKET_FIRST_NDIS_BUFFER(Packet); NDIS_PACKET_LAST_NDIS_BUFFER(MyPacket) = NDIS_PACKET_LAST_NDIS_BUFFER(Packet); pPersistentData.Packet = MyPacket; QueueForLaterProcessing(pPersistentData); NdisMIndicateReceivePacket(pAdapt->MiniportHandle, &MyPacket, 1); FIRST ATTACK: PACKET CONFUSION GOOD
- 25. FIRST ATTACK: PACKET CONFUSION EVIL API DOCUMENTATION SAMPLE CODE STACKOVERFLOW.COM SITES FROM THE 90’s
- 26. FIRST ATTACK: PACKET CONFUSION If we need to queue this packet we will also have to copy over the per-packet information. This is because data is available only for the duration of this receive indication call EVIL
- 27. FIRST ATTACK: PACKET CONFUSION EVIL PACKET METADATA BUFFER PACKET METADATA BUFFER PACKET METADATA BUFFER ATTACKER CONTROLLED PACKET SIZE
- 28. if (NDIS_GET_PACKET_HEADER_SIZE(Packet) BufferSize) { memcpy( Buffer, PacketBuffer, NDIS_GET_PACKET_HEADER_SIZE(Packet) ); } FIRST ATTACK: PACKET CONFUSION GOOD EVIL 40 1337
- 29. GOOD EVIL 0 1 “Much, MUCH better than a green rubber lizard”
- 30. SECOND ATTACK: PACKET OVERWRITE GOOD EVIL
- 31. SECOND ATTACK: PACKET OVERWRITE GOOD PACKET DATA TASK: APPEND DATA TO END OF PACKET BUFFER BUFFER BUFFER
- 32. SECOND ATTACK: PACKET OVERWRITE GOOD BUFFER END OF PACKET DATA
- 33. SECOND ATTACK: PACKET OVERWRITE EVIL API DOCUMENTATION SAMPLE CODE Remove all MDLs [memory buffers] from the end of the chain, where the last byte of the MDL isn’t part of the packet buffer
- 34. SECOND ATTACK: PACKET OVERWRITE EVIL BUFFER END OF PACKET BUFFER IN USE
- 35. BUFFER END OF PACKET BUFFER IN USE EVILGOOD DATA SECOND ATTACK: PACKET OVERWRITE
- 36. GOOD EVIL 0 2 “Thank God that hairy chests are acceptable in the 60s”
- 37. THIRD ATTACK: death by protocol GOOD EVIL
- 38. THIRD ATTACK: death by protocol TASK: DEFRAGMENT IPv6 PACKETS GOOD
- 40. THIRD ATTACK: death by protocol GOOD RFC 2460 (IPv6) RFC 790 (IPv4) RFC 791 (IPv4) RFC 826 (ARP) RFC 1034 (DNS) RFC 768 (UDP) RFC 793 (TCP) RFC 792 (ICMP)
- 41. GOOD EVIL 0 3 “I keep this around for when Spock is not on board”
- 42. AGENDA 1. INTO THE KERNEL 2. FINDING VULNERABILITIES 3. PWNAGE: CVE-2014-9383
- 43. PREMISE: 1. MORE COMPLEXITY == MORE BUGS 2. EDGE CASES ARE THE MOST DIFFICULT TO TEST CONCLUSION: LOOK FOR BUGS IN COMPLICATED AND UNCOMMON USE CASES BUG HUNTING 101 EVIL
- 44. A Word About IPv6 • Insanely complicated protocol • Nobody’s using it • Has isoteric features that REALLY nobody uses • NDIS drivers still have to support those features “Anybody order pizza?”
- 45. BONUS: YOU GET TO SET THE SIZE OF THE EXTENSION HEADER SECURiTY 1. Complicated!
- 46. RFC 2460 A node may use the IPv6 Fragment header to fragment the packet at the source and have it reassembled at the destination. However, is discouraged EVIL SECURiTY 2. Unused!
- 47. About CVE-2014-9383 • RCE vulnerability in Bitdefender NDIS filter driver • Patched last month • Disclaimer: No ASLR bypass (requires another vuln) • Another disclaimer: Statistical attack, works 50% of the time “Next time Iet me write a Linux driver”
- 49. CVE-2014-9383 EVILGOOD Buffer 1 Buffer 2 SIZE CALCULATION: HEADERS ARBITRARY SIZE HDR HDR HDR HDR OVERFLOW MAXSIZE
- 51. MergedPacket = ExAllocatePoolWithTag(0, MAX_HEADER_SIZE + BufSize1 + Bufsize2, ‘ TAG’); HeaderSize = CalculateHeaderSize(Packet1); memcpy(MergedPacket, Packet1, HeaderSize); Packet1 += HeaderSize; memcpy(MergedPacket, Packet1, BufSize1); memcpy(MergedPacket, Packet2, BufSize2);GOOD EVIL CVE-2014-9383
- 53. “Damn, we’ve exhausted our special effects budget on the previous memes”
- 54. Bonus: DIY with NDISaster • Identifies the main handler functions in NDIS drivers • Generates a Windbg script for packet capture • Incorporates the output from Windbag back to IDA • Identifies the main functions per protocol • Still no support for NDIS 6!
- 57. THANK YOU