Reverse_Engineering_Thick-clients
Download as PPTX, PDF1 like830 views
This document discusses reverse engineering thick-client applications. It begins with an overview of thick clients, noting they provide local software that connects to server software via TCP/IP sockets. It describes the attack surface of thick clients, including potential for rootkits, cache/registry corruption, and information disclosure due to local software and storage. Tools that can be used for reverse engineering thick clients are also outlined, such as decompilers, profilers, proxies and sniffers. An example reverse engineering process using these tools on a Java thick client is then provided.
Reverse_Engineering_Thick-clients
- 1. Steven C. Markey,MSIS,PMP,CISSP,CIPP/US,CISM,CISA,STS-EV,CCSK Principal,nControl,LLC AdjunctProfessor Reverse Engineering Thick-clients
- 2. • Agenda – Thick-client Overview – Attack Surface – Reverse Engineering Thick-clients Reverse Engineering Thick-clients
- 3. Reverse Engineering Thick-clients • Thick-client Overview – “Old School” • Local Software & Occasional Local Storage – Local Software Connecting to Server Software • Traditionally Installed Local Software via TCP/IP Sockets • Web Delivered Local Software via TCP/IP Sockets • Web Delivered Local Software via HTTP/S – Alternative to Web/Thin Clients • Occasionally More Efficient • Allows for Interaction with Local Office Automation Software • Allows for Syncing/Batch Uploads for Offline Use
- 4. Reverse Engineering Thick-clients • Thick-client Attack Surface – Local Software & Local Storage = Local Exposures • Rootkits • Cache & Registry Corruption • Information Disclosure – One-off Exposures • Access to Office Automation Software Exposures – Ignorance is Bliss • Assumed Lack of Attack Surface – Can Still Proxy Requests – Sniffers Can Be Goldmines • Overreliance on Data in Transit Crypto Protections • Overreliance on Segregation of Duties & Access Controls
- 5. Reverse Engineering Thick-clients • Reverse Engineering Thick-clients – Tools • Decompilers: Dotpeek, Reflector, JustDecompile, ILSpy, DILE, PEBrowse, Java Decompile, Mocha & DJ Java Compiler • Profilers: Eclipse – Test & Performance Tools Platform (TPTP), MSVS – MSIL Disassembler (lldasm), YourKit & DTrace • Proxies: Burp – Wsdler.jar, BurpJDSer.jar, ZAP & Paros • Sniffers: Wireshark – Access • Binaries • Local Files, Storage & Office Automation Plugins
- 6. Reverse Engineering Thick-clients • Example – App • Java Swing TCP-based Thick-client AWS EC2 Java 7 – AWS AMI Linux Distro, Executable JAR on Server & Local MySQL – Windows 8.1, Java 7 – Tools • Decompilers: DJ Java Decompiler & Mocha • Profilers: YourKit • Proxies: Burp – Wsdler.jar, BurpJDSer.jar • Sniffers: Wireshark – Access • Binaries, Local Files, Storage & Office Automation Plugins
- 7. • Questions? • Contact – Email: steve@ncontrol-llc.com – LinkedIn: http://www.linkedin.com/in/smarkey – Twitter: markes1