Security Assessing Java RMI Slides

There has been alot of interest lately in RMI security and people trying to hunt down my slides from the presentation I did at OWASP. The slides can be found here.

The original presentation can be found:
http://video.google.com/videoplay?docid=1673714450539106400#

Editing webpages with JavaScript snippet

So, most of you will no doubt know that you can execute JavaScript from the URL bar and how useful it can be. For example, you could view the text is password fields which has proved to be useful on several occassions (alert document.form1.passwordField.text) . An interesting JS snippet I came across was:

javascript:document.body.contentEditable='true'; document.designMode='on'; void 0

Just type that into the URL, then you can start editing the webpage you are viewing straight from the browser.

Disable HtmlUnit logging

HtmlUnit is a pretty decent scriptable browser. I use it for developing alot of website scrapers and various bots. By default, the logging to the standard output stream is pretty verbose. A quick way to disable it programmatically is to add the following static initializer to your code:

   static {

        LogFactory.getFactory().setAttribute("org.apache.commons.logging.Log", "org.apache.commons.logging.impl.NoOpLog");

    }

Strings are immutable in Java. Really, Mr. Anderson?

Take a look at the following code, the output is not what you may expect ;)

//MindWarp.java
public class MindWarp 

{
  public static void main(String[] args)
  {
    System.out.println(MR_ANDERSON);
  }
  private static final String MR_ANDERSON = "Adam, RIM Security Researcher";
  private static final Warper warper = new Warper(); //The hackers class ;)
}


//Warper.java - Hacks the String object which is on the heap....
import java.lang.reflect.*;

public class Warper 

{
  private static Field stringValue;
  
static 

{
    try
    {
      stringValue = String.class.getDeclaredField("value");     //String has a private char [] called "value"
    }
    catch(NoSuchFieldException ex)
    {

//Should deploy a safety net here i.e enumerate a char[] incase the variable inside the String class is not called "value"
        ex.printStackTrace(); 
    }
    if (stringValue != null) {
      stringValue.setAccessible(true); // make field public ;)
    }
  }
  public Warper() {
    try {

//String must be same length, otherwise IndexOutOfBoundsException
      stringValue.set("Adam, RIM Security Researcher", "You have been hacked! ! ! ! !".toCharArray()); 
    } catch(IllegalAccessException ex) {} // shhh
  }
}

Assembly competitions

I have been in a couple of Assembly competitions recently on a private forum. They have been very interesting, one in particular was to create the smallest PE file (Windows executable) that displays the message "ADZ" in a graphical message box i.e use of user32.MessageBoxA() and must exit without an exception. I am currently in first position with 109 bytes! So its a challenge to any reverse engineering experts to try and beat that ;) I will be posting my solution and analysis once of the competition ends, which is in about 5 days. Here is a useful resource to get you started:

http://www.phreedom.org/solar/code/tinype/

EDIT: Well 109 bytes was a clear winner :) If anyone got smaller don't hesitate to let us know! Here is my bytecode:

4D 5A CC CC 50 45 00 00 4C 01 01 00 68 21 00 40
00 E8 65 1D 40 7C EB 2D 04 00 03 01 0B 01 08 00
04 75 73 65 72 33 32 00 04 00 00 00 0C 00 00 00
04 00 00 00 0C 00 00 00 00 00 40 00 04 00 00 00
04 00 00 00 04 6A 30 EB 05 41 44 5A 04 00 68 6A
00 40 00 EB 01 CC EB 01 88 68 6A 00 40 00 EB 02
02 00 6A 00 E8 81 07 05 7E C3 53 41 46

OWASP NYC

Fantastic conference, the presentation went really well. Already starting to see people referencing my RMI hacking presentation, thanks for all the feedback!

Gunter Ollman's Blog

Secshoggoth

It is great to see the search engine results changing in respects to RMI security. The start of all this happened 4 years ago during my Software Engineering degree and I was taught to develop my first RMI service. At the time, things didn't seem right from a security perspective but I didn't have the time nor skillset to pursue it at the time. I remember attempting to assess an RMI service at the time but couldn't get past step 1 of what I presented at the OWASP conference. However, my interest was sparked again during a security assessment, so over the last few weeks the RMI research began and things started to come together very quickly. I am looking forward to releasing alot of research and new tools over the coming weeks.

Cheers

EDIT: The video is now available via Google Videos

Hacking RMI services

Update: Unfortunately I will no longer be releasing the RMI Assessment tools. I have recently left Corsaire and will be joining Research In Motion (Blackberry). The research and tools are Corsaire's intellectual property.

Hacking Java Remote Method Invocation

Things have been a quiet here recently. I have been preparing for my RMI hacking presentation for OWASP in NYC. I have developed a suite of tools which finger print an RMI service and aid in building the vital stub component which is required to communicate with RMI services. A video of my presentation will be available on the coming weeks and the software will be released soon. You can find an abstract of my talk here:

Security Assessing Java RMI at OWASP NYC

I look forward to seeing you all.

Breaking the bank

My new paper has finally been released after weeks of intense peer reviews. This paper draws attention to how the use of common programming APIs and practices could lead to flaws in the processing of numeric data, which could allow attackers to manipulate the outcome of transactions or otherwise interfere with the accuracy of calculations. It discusses the technical vulnerabilities typically observed in both the validation and processing of numeric data that could expose an organisation to unmanaged risk. It is intended for a technically literate audience involved in developing or testing financial applications, and to provide technical insight to those responsible for their management. The vulnerabilities are presented with source code examples, suggestions on how to identify the flaws during the testing phases and recommendations for mitigating the risk.

http://research.corsaire.com/whitepapers/080715%20-breaking-the-bank-numeric-processing.pdf

A colleague and good friend of mine, Daniel Cuthbert, has presented parts of the research at OWASP NYC 2008, the video is available here.

Enjoy

Backdooring Windows (XP, Vista) Authentication

From the Windows login screen there is one accessible application, the Utility Manager (c:\windows\system32\utilman.exe). You can access this by pressing win key + U. To add a backdoor to the windows login screen boot into a live distro (BackTrack, BartPE etc) so the disk can be mounted. Simply replace utilman.exe with a copy of cmd.exe. When presented with the login screen pressing the win key + U will present you with a console with the highest privileges; SYSTEM. Running "explorer" from the console will present the taskbar leaving the login screen as a backdrop. This is a great backdoor for a system as it will most likely go undetected. It will certainly not be picked up by any AV system.

HSBC Bank Account aggregation

No doubt that most of you use online banking. I am certainly a great fan. There are a couple of annoyances such as the logging in process which I find tedious as it is something that can be totally automated. Also, my online banking only gives me statements from the previous 3 months. Therefore, I have been working on a Java Swing application which focuses on the HSBC Personal Internet Banking to automate the login process and to automatically retrieve all the account details which could then, for example, be used as a feed / gadget for iGoogle or social networking sites. The HSBC class file will be available soon.....