def con 23 presentation con 23/def con 23 presentations/de… ·...
TRANSCRIPT
![Page 1: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/1.jpg)
Bugged&Files&Is#Your#Document#Telling#on#You?#
Daniel#Crowley,#Damon#Smith#
![Page 2: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/2.jpg)
• Damon&Smith&
Who&are&we?&
• Daniel&Crowley&
![Page 3: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/3.jpg)
Files&that&trigger&outbound&traffic&when&parsed&&
&Without&being&an&executable&format&&Regardless&of&format&complexity&
&&&&&&Without&the&use&of&exploits&&
&…and&the&implications&of&all&that&
What&is&this&talk&about?&
![Page 4: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/4.jpg)
• Privacy&
– DRM&
– DLP&
– DeFanonymization&
• Security&
– NTLM&credential&capture/relay&– CSRF&
• ”It’s&a&feature,¬&a&bug”&
Why&is&this&important?&&
![Page 5: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/5.jpg)
Demonstration&
• RTF&• WMV&
![Page 6: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/6.jpg)
• Office&formats&– .docx&– .pptx&– .xlsx&
• PLS&playlists&• Shortcut&(.lnk)&files&• Desktop.ini&files&• HTML&
What&formats&are&already&known&to&allow&this?&
![Page 7: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/7.jpg)
• HTML&in&IE&• Linked&images&in&emails&opened&in&Outlook!&
Other&NTLM&trigger&silliness&
![Page 8: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/8.jpg)
• Document&formats&• Media&formats&• Meeting/scheduling&related&formats&&
What&did&our&work&focus&on?&
![Page 9: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/9.jpg)
• Remote&image&
– No&warning,&no&NTLM&
• App.media.openPlayer()&– Warning,&NTLM&possible&
• getURL()&– Warning,&NTLM&possible&
PDF&
![Page 10: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/10.jpg)
• Linked&document&on&UNC&share&– Warning&(ignored),&NTLM&possible&
RTF&
![Page 11: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/11.jpg)
• Remote&XML&stylesheets&• Javascript&
SVG&(Scalable&Vector&Graphics)&
![Page 12: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/12.jpg)
• All&these&formats&support&remote&media&
– Even&UNC&paths…&
M3U&/&PLS&/&ASX&
![Page 13: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/13.jpg)
• ID3&tag&– LINK&frame&– APIC&frame&
• Not&supported&on&any&major&player&we&tested&!&
MP3&
![Page 14: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/14.jpg)
• URLANDEXIT&• Launches&default&browser&with&specified&URL&
• DRM&functionality&abuse&• Subtitles&• Can&include&arbitrary&HTML&
ASF&(WMA/WMV/ASF)&
![Page 15: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/15.jpg)
• HTTP&tracker&URLs&in&“announceFlist”&– As&many&as&you&want&
• URL&seeds&allowed&in&“urlFlist”&– Clients&can&implement&any&URL&handler&
• Must&support&one&or&both&of&HTTP&&&FTP&
– Not&universally&supported&
TORRENT&
![Page 16: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/16.jpg)
• Free/Busy&URL&
– No&warning,&NTLM&possible&– Requires&specific&actions&by&recipient&
VCF&(vCard&format)&
![Page 17: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/17.jpg)
• VALARM&
– ATTACH¶meter&is&a&URL&
– AUDIO&and&PROCEDURE&alarm&types&&
• ICS&is&the&iCalendar&format&– Not&even&Calendar.app&will&let&you&accept&PROCEDURE&!&
ICS&(iCalendar&format)&
![Page 18: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/18.jpg)
• Email&• Open&file&share&
• Watering&hole&
• P2P&distribution&• Honeypot&
Delivery&methods&
![Page 19: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/19.jpg)
• Dystopian&future&DRM&could&call&home&
– Probably&already&does&in&some&cases&• Goes&beyond&deterrence&into&identification&
Digital&Rights&Management&
![Page 20: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/20.jpg)
• Imagine&being&a&whistleblowerFtoFbe&
– In&a&fascist&country&• The&document&you&exfiltrate&calls&home&
– From&your&work&computer&– From&your&home&computer&– From&your&friend’s&home&
– From&your&lawyer’s&office&
– From&a&journalist’s&office&
• You&get&disappeared&&
Data&Loss&Prevention&
![Page 21: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/21.jpg)
• Tor&Browser&only&routes&browser&traffic&through&Tor&– External&programs&don’t&route&through&Tor&
• You&don’t&control&that&jihad&wiki&– But&maybe&you&can&upload&a&bugged&PDF&
DeFAnonymization&
![Page 22: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/22.jpg)
• Windows&will&autoFauth&when&accessing&SMB&
• Files&can&in&some&cases&initiate&SMB&traffic&– Embedding&remote&file://&resources&– UNC&path&as&file&
– Javascript/other&active&content&• NTLM&auth&can&be&cracked&or&relayed&
NTLM&Credential&Capture/Relay&
![Page 23: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/23.jpg)
NTLM&overview&
Server&Client&
1.&Negotiate&
2.&Challenge&
3.&Authenticate&
![Page 24: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/24.jpg)
NTLM&relay&overview&
Server&Client&
Attacker&
![Page 25: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/25.jpg)
• Initiating&traffic&from&privileged&positions&is&fun&
– Exploit&router&vulns&– Exploit&NAS/Printers&– Exploit&IoT&devices&
CSRF&
![Page 26: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/26.jpg)
• AV?&– Too&many&formats&and&variations&– Possibility&of&false&positives&
• Format&changes?&– Too&much&inertia,&too&many&formats&
• ApplicationFlevel&firewalls?&– Easy&for&RTF&
– Not&so&easy&for&M3U&&
Possible&Mitigations&
![Page 27: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/27.jpg)
• Warnings?&• Proxychains&with&strict_chain&and&bad&proxy&- Doesn’t&work&for&some&applications&
• Egress&filtering?&- Doesn’t&stop&internal&connections&- Might&stop&legitimate&functionality&
Possible&Mitigations&
![Page 28: DEF CON 23 Presentation CON 23/DEF CON 23 presentations/DE… · Files&that&trigger&outbound&traffic&when&parsed& & &Without&being&an&executable&format& &Regardless&of&format&complexity&](https://reader036.vdocuments.us/reader036/viewer/2022063003/5f5ea9350f74504dd24cf35b/html5/thumbnails/28.jpg)
Questions?&
Daniel#Crowley,#Damon#Smith#