------------------------------------------------------------------------ ---------------------------- Benchmarking attacks and major security weakness on all recent Windows versions up to Windows 2008 ------------------------------------------------------------------------ ---------------------------- + Author: Fabien KERBOUCI + Version/Date: 27/01/2009 + Keywords: [ benchmark timing benchmarking attacks Windows runas vulnerability password length ] Get a more detailed version of this advisory with complete tutorial and video in Haking9 Magazine of May 2009. ======================================================================== ============================ Affected operating systems: --------------------------- Windows XP Pro Windows 2003 Windows Vista Windows 2008 (all service packs...) And probably some UNIX/Linux systems with some variants... Look by yourself. ======================================================================== ============================ Abstract: --------- This paper makes a short introduction on benchmarking attacks and then focuses on one kind of these techniques which can be used to globally weaken the security of many applications running under modern Windows operating systems (tested up to Windows 2008 in date of 27/01/2009). This paper includes a detailed proof of concept of the weakness applied to the "runas.exe" application, thus allowing a malicious user to _easily_ guess the password length typed in when "runas" is used to launch an application under another user's privileges. Note that we consider the vulnerability not being in "runas.exe" but in the operating system itself. That will be explained in the last part of the paper. Get a more detailed version of this advisory with complete tutorial in Haking9 Magazine of May 2009. Introduction before speaking of benchmarking attacks: ----------------------------------------------------- When you speak of security threats you mostly speak about unsecure protocols, weak encryption algorithms, buffer overflows, privileges escalation, human factor, etc. There are also another class of attacks that are quite well documented and based on an environmental analysis of a secure component you want to unsecure. These are known as "timing attacks". Timing attacks were very popular years ago and this field of research is still under progress. Briefly, timing attacks consist of analyzing the time it takes for a system to compute data in order to predict private information about these data. The information you obtain from a timing attack will lower the security of the component under analysis. Benchmarking attacks include timing attacks and I found relevant enough to speak of timing attacks prior speaking of benchmarking attacks for those of you who are not familiar with this field of research. Timing attack scenario examples : --------------------------------- If you are already familiar with timing attacks you can skip this chapter. Let's take a brief example of a timing attack scenario aiming to predict real user logins on a specific system : 1. A system is running a server application 'login.exe' which takes a username, a password and then opens a shell or refuses connection if authentication fails. 2. When you type a login and password the 'login.exe' application will check the login, then check the password, then will allow or deny access to a shell. 3. If the login is wrong the application returns without checking password. The system denies the access in N milliseconds. 4. If the login is correct but the password is not the application checks the password and then denies access. It takes N + M milliseconds to realize the operation. 5. You got it. If you can measure the number of milliseconds it takes for the system to reply on a real login you are aware of (Administrator, root, ...) then you can predict other real logins by discarding all the attempts that ran only ~(N) milliseconds as you are only looking for attempts that took ~(N + M) milliseconds to be processed. There is a security advisory published in 2003 by Marco Ivaldi detailing exactly this kind of flaw against SSH [1]. More recently, also about SSH, Dawn Xiaodong Song, David Wagner and Xuqing Tian wrote an interesting paper detailing an attack based on keystrokes intervals analysis [2]. Now about benchmarking attacks: ------------------------------- Timing attacks are harder to realize on local environments and against specific applications because modern CPUs are designed for multi-threading (as are applications) and current clock frequencies make the millisecond a pretty obsolete unit of measurement. You have to think of more complicated strategies to obtain exploitable information against a specific component. This is where benchmarking becomes useful. When you speak of a 'benchmark' you are not only speaking about how fast a process is running but also about how efficient it is. In order to evaluate that you must rely on many more indicators, making the time a process runs only a part of a benchmark result. A benchmark can also imply to analyze the following indicators: - number of threads ran by process - size of memory allocated by process/threads - CPU consumption - number of open handles, file descriptors, sockets, ... - command line arguments, environment variables etc. You can think 'benchmarking attacks' as a higher level of attacks that also includes timing attacks. Benchmarking attacks are simply based on all the indicators you can grab to analyze the way a component is running. I was looking such exploitable data on Linux 2.6 (/proc and potential syscalls) but it is on Windows that such weakness appeared very distinctly. As the attack detailed hereafter is absolutely not based on any timing measurement I thought it as a 'benchmark attack'. Benchmarking attack against 'runas.exe': ---------------------------------------- runas is a critical component of Windows and is available on all the modern Windows versions. It permits you to launch an application under another user's privilege. It is widely used by administrators in corporate environments. Syntax is (in cmd.exe) : runas /user:[USER] [APPNAME] Eg.: runas /user:Administrator explorer.exe The attack permits a Guest user to predict the password length entered by any user who ran runas and typed a password in. This is very easy to do and is based on analyzing the I/O bytes computed when executing runas.exe. First you have to consider this : on Windows any unprivileged user can grab information on highly privileged running processes. This is where the flaw is. I found the issue by realizing some very simple steps that you can reproduce following: 1. Log in as guest 2. Run taskmgr.exe (CTRL+ALT+DEL) 3. Go in "view", "select columns" and tick "I/O Other Bytes". Apply. (see Annex about this column) 4. Start runas.exe, with : C:\> runas /user:Administrator explorer.exe 5. The prompt is asking for the password. Start OllyDBG (no setup, ready to use) 6. Configure OllyDBG to only break on Thread exit. 7. Release the process and type no password (immediately press enter) 8. Repeat the process again, same steps, but type a password for this time. Goal is to get the last value of the "I/O Other Bytes Counter" just before the process is destroyed by the kernel. Fortunately the last value of this indicator is the one that interests us. This is why you can use OllyDBG to break on thread exit, but you can also forge a software that will permanently track this data in a loop when it detects runas in process list. Last tracked value will be the one needed. We will assume that, in first instance, the "I/O Other Bytes" counter when no password was entered gave a "700" result. This value will always be the same over various executions and will grow according to the password length the user typed in : {0} letters - 700 (thereafter named 'BASE') {1-4} letters - 708 {5-8} letters - 716 {9-12} letters - 724 Consequently the algorithm to predict the password length is : RESULT - BASE = UNICODE STRING LENGTH then, UNICODE STRING LENGTH / 2 = PASSWORD LENGTH As you saw the software pads the password string to round it up to a multiplier of 4. That means that you have an uncertainty of three letters in your guess of the password length. Eg.: result is 716, so you know that the password is AT LEAST 5 letters and AT MAX 8 letters. Using this weakness an attacker will easily discriminate strong and weak passwords as he also may gain a lot of time in passwords brute-force attempts. Benchmarking attacks and security: ---------------------------------- You could think the flaw is in runas.exe : this software should pad the password to a huge and invariable length in order to hide the password length when computing it. That's true but that is not enough. It is obvious that benchmarking attacks can work against a huge number of softwares proceeding data in such ways. But will you ask all developers to master time execution, memory allocation, I/O operations in order to hide sensible and private data ? No, that's nonsense. The main problem is that a process can access other process information just by watching its own available environment. There is the major flaw: unprivileged process grabbing data on critical process. A secured environment must be absolutely hermetic and then watch carefully what it discloses to other users or process. Windows clearly fails on that point, as a badly protected Linux does when anyone can read the command line typed by a user just by running a 'ps'. Finally for binaries that are started by administrators from user environments (such as runas) they need to be identified somehow so critical information do not leak once started. With their bit-suid binaries we can say UNIX-like systems have an advantage for security against benchmarking attacks. ======================================================================== ============================ Annex: What are I/O other bytes? -------------------------------- Answer from Microsoft (quoted from Task Manager's help): "The number of bytes transferred in input/output operations generated by the process that are neither a read nor a write, including file, network and devices I/Os. An example of this type of operation is a control function. I/O Other Bytes directed toCONSOLE (console input object) handles are not counted." Got it ? ======================================================================== ============================ References: ----------- [1] : "OpenSSH/PAM timing attack allows remote users identification", by Marco Ivaldi - http://lab.mediaservice.net/advisory/2003-01-openssh.txt [2] : "Timing Analysis of Keystrokes and Timing Attacks on SSH", by Dawn Xiaodong Song, David Wagner and Xuqing Tian - http://www.cs.berkeley.edu/~daw/papers/ssh-use01.pdf ======================================================================== ============================ GREETINGS: ---------- SALUT Thibaut and KERIHUEL Julien for showing great interest on the topic antto, dex, HonkingZebra and HM for reading before release Clad Strife because without him nothing would have been written