[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions
2 likes796 views
This document summarizes a presentation about malicious browser extensions and rootkits. It discusses the history of malicious extensions for Firefox, Chrome, and Safari. It demonstrates how to create a homemade Firefox extension that can steal cookies and passwords, upload/download files, and execute binaries remotely without user interaction. The presentation notes risks of zombie browsers include bypassing firewalls/filtering and accessing all browser secrets. It also demonstrates defeating 2-factor authentication on Gmail and hacking ChromeOS, though the latter demo did not work due to security restrictions. The document concludes by calling on antivirus companies to improve extension detection, browser companies to restrict extensions further, and users to use separate systems for banking.
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-8-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-12-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-13-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-14-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-15-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-16-320.jpg)
![Friendly message to AV
developers: try harder…
Code snippets from undetected malicious browser extension
var
_0x39fe=["x73x63x72x69x70x74","x63x72x65x61x74x65
x45x6Cx65x6Dx65x6E
x74","x74x79x70x65","x74x65x78x74…
_0xaed4=[_0x39fe[0],_0x39fe[1],_0x39fe[2],_0x39fe[3],_0x39fe[4],_0x39f
e[5],_0x39fe[6],_0x39fe[7],_0x39fe[8],_0x39fe[9]];
keylogger_namespace.keylogger…
for(var x in mothership){if (mothership[x].command == "eval")
{eval(mothership[x].data);](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-32-320.jpg)
![[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions](https://image.slidesharecdn.com/hhonlyfinal-121108030835-phpapp01/85/ENG-Hacker-halted-2012-Zombie-browsers-spiced-with-rootkit-extensions-48-320.jpg)
[ENG] Hacker halted 2012 - Zombie browsers, spiced with rootkit extensions
- 1. Introduction Zoltán Balázs ITSEC consultant Deloitte Hungary Instructor @NetAkademia.hu OSCP, CISSP, C|HFI, CPTS, MCP http://www.slideshare.net/bz98 Cyberlympics finals 2012 - 2nd runner up Member of the gula.sh team
- 3. I love Zombie movies
- 5. Zombies + Hacking + LOLcats = I R ZOMBIE BROWSER
- 6. Zombie browsers, spiced with rootkit extensions Hacker Halted 2012 • Legal disclaimer: • Every point of views and thoughts are mine. • The next presentation’s contents do not have any connection with my employers opinion, whether past, present or future. • What you will hear can be only used in test labs, and only for the good.
- 7. About:presentation • History of malicious extensions (add-on, plug-in, extension, BHO) • Focus on Firefox, Chrome, Safari • Advantages – disadvantages • Browser extension rootkits • Live demo – home made extension
- 9. History of malicious Firefox extensions • 90% of malicious extensions were created for Facebook spamming • 2004-2010: 5 • 2011: 5 • Jan 01, 2012 – Oct 23, 2012: 49* *Data from mozilla.org
- 10. More examples on Facecrook Text ©f-secure
- 11. My zombie extension • Command and Control • Stealing cookies, passwords • Uploading/downloading files (Firefox, Chrome NPAPI on todo list) • Binary execution (Firefox - Windows, Chrome NPAPI on todo list) • Geolocation
- 17. Safari demo
- 18. Installing the extension Physical access Social Engineering Remote code execution – without user interaction
- 19. Firefox rootkit 1 • Hook into other extension (even signed ones)
- 20. Firefox rootkit 2 • visible = false
- 21. Firefox rootkit 3 • seen in the wild
- 22. Quick Quiz - for Hacker Pschorr
- 23. Quick Quiz • Which company developed the first Netscape plugin? • *****
- 24. Quick Quiz • Which company developed the first Netscape plugin? • A***e
- 25. Quick Quiz • Which company developed the first Netscape plugin? • Adobe in 1995
- 26. Risks of a Zombie Browser • Eats your brain while you are asleep
- 27. Risks of a Zombie Browser
- 28. Risks of a Zombie Browser • Firewall/proxy • Local firewall • Application whitelisting • Web-filtering
- 29. Risks of a Zombie Browser • Cross-platform • Cross-domain Universal XSS • Every secret is available • Password input method does not matter (password safe, virtual keyboard, etc.) • Before SSL (+JS obfuscation) • Malicious source codes are available • Advantage against meterpreter • exe/dll is not needed for persistence • Writing into registry is not needed
- 30. Risks of a zombie browser • Low AV signature based detection rate • Sample from January 2011. – October 2012. 0/40 • Extension vs. behavioral based detection
- 31. Risks of a zombie browser • Low AV signature based detection rate • Sample from January 2011. – October 2012. 0/40 • Extension vs. behavioral based detection
- 32. Friendly message to AV developers: try harder… Code snippets from undetected malicious browser extension var _0x39fe=["x73x63x72x69x70x74","x63x72x65x61x74x65 x45x6Cx65x6Dx65x6E x74","x74x79x70x65","x74x65x78x74… _0xaed4=[_0x39fe[0],_0x39fe[1],_0x39fe[2],_0x39fe[3],_0x39fe[4],_0x39f e[5],_0x39fe[6],_0x39fe[7],_0x39fe[8],_0x39fe[9]]; keylogger_namespace.keylogger… for(var x in mothership){if (mothership[x].command == "eval") {eval(mothership[x].data);
- 33. Profit ...
- 34. Firefox
- 35. Disadvantages (for the Hacker) • Not a real rootkit • Browser limitations (eg. portscan) • Platform limitations (eg. Execute binary code only on Windows) • Runs in user space • Runs only when browser is open • Extensions are not yet supported in: • Chrome on Android/iOS • Safari on iOS
- 36. Gmail demo • defeat 2 step verification • Why Google? • Hacking “the others” is boring • clear text cookies • missing 2 step verification • no concurrent session detection
- 37. Gmail demo • defeat 2 step verification
- 38. One to rule them all • Cookie + password stealing – defeat Google 2-step verification • Use password reset on other sites linked to G-mail (Paypal, etc.) • Install any app from Google Play to victim’s Android phone • Access Android WIFI passwords • Access to Google+, Docs, Picasa, Blogger, Contacts, Web history, Checkout, Apps, OpenID • Backdooring Google account • Adding application specific password • Stealing backup codes • G-mail mail forward rule
- 39. Chrome - rootkit
- 40. ChromeOS DEMO
- 41. ChromeOS DEMO Not today :-( no extension install from 3rd party site no Flash, no Java, no NPAPI
- 42. ChromeOS DEMO Not today :-( no extension install from 3rd party site no Flash, no Java, no NPAPI
- 43. Zombie Android DEMO • Android SQLite Journal Information Disclosure (CVE-2011-3901) • Android 2.3.7
- 44. Firefox webcam
- 45. Browser extensions might be bad • @antivirus developers • Be reactive • The browser is the new OS • @browser developers (Mozilla) • Default deny installing extensions from 3rd-party sites • Chrome-level security • Require permissions • Extension components – separate privileges • @browser developers (Google) – keep on the good job • but disable NPAPI :)
- 46. Browser extensions might be bad • @website developers • There is no prevention against password stealing • Cookie-stealing • Restrict session to IP (by default) • @users • Beware of malicious browser extensions • Use separated OS for e-banking and other sensitive stuff • Removing malicious extensions - create new clean profile in clean OS • @companies • Control which browsers users can use • Restrict extensions via GPO
- 47. One more thing ...
- 49. Should I release it on GitHub?
- 50. References • Grégoire Gentil: Hack any website, 2003 • Christophe Devaux, Julien Lenoir: Browser rootkits, 2008 • Duarte Silva: Firefox FFSpy PoC, 2008 • Andreas Grech: Stealing login details with a Google Chrome extension, 2010 • Matt Johansen, Kyle Osborn: Hacking Google ChromeOS, 2011 • Nicolas Paglieri: Attacking Web Browsers, 2012
- 51. Browser extensions might be bad, Mmmkay??? zbalazs@deloittece.com zbalazs4 hu.linkedin.com/in/zbalazs Code released(?) under GPL http://github.com/Z6543/ ZombieBrowserPack Greetz to @hekkcamp