CODE BLUE 2014 : マイクロソフトの脆弱性調査 : ベンダーでありながら発見者となるために by デイヴィッド・シードマン David Seidman
•
2 gostaram•1,143 visualizações
当マイクロソフトでは、社員がしばしば他のベンダー製品のセキュリティ上の問題を発見しており、その原因となるバグの修正のためには、製品のベンダーと一緒に解決を図る協調的な取り組みが必要であることを訴えている。マイクロソフト脆弱性調査 (MSVR) は、企業や研究者が脆弱性を発見し報告する際、マイクロソフトの対応方法を参考としてもらうことを支援するために制定された。MSVRは、この事前対策プログラムのライフタイムの間に重要なソフトウェア中の多数の脆弱性を修正する社内のバグハンターと協力するために重要な役割を演じてきている。我々のやり方を知れば、貴社で同様の脆弱性コーディネーションプログラムをどのように始めればよいか分かるだろう。 この講演では、MSVRの立ち上げ時の詳細な過程と、MSVRと同様の集中型プログラムを制定したい組織のための方法を取りあげる。弊社の技術者が発見しMSVRを通し報告したいくつかの脆弱性を技術的な点からベンダーと協力して脆弱性を修正し、その後、脆弱性に関するアドバイザリーを発行するまでを通しで説明する。
Recomendados
Mais conteúdo relacionado
Mais procurados
Semelhante a CODE BLUE 2014 : マイクロソフトの脆弱性調査 : ベンダーでありながら発見者となるために by デイヴィッド・シードマン David Seidman
Semelhante a CODE BLUE 2014 : マイクロソフトの脆弱性調査 : ベンダーでありながら発見者となるために by デイヴィッド・シードマン David Seidman (20)
Mais de CODE BLUE
Mais de CODE BLUE (20)
Último
Último (20)
CODE BLUE 2014 : マイクロソフトの脆弱性調査 : ベンダーでありながら発見者となるために by デイヴィッド・シードマン David Seidman
- 2. ! ! ! ! ! !
- 3. ! ! ! !
- 4. ! ! ! ! ! !
- 5. ! ! ! !
- 7. ! ! !
- 8. ! !
- 9. MSVR ! MSRC ! Microso+ Security Response Center ! ! Microso+ Bounty Programs ! Web !
- 10. MSVR ! HackerOne ! ! ! Facebook
- 11. MSVR ! ! ! ! !
- 12. MSVR ! ! ! !
- 13. MSVR ! Web ! h>p://technet.microso+.com/en-‐us/security/msvr ! !
- 14. ! Windows ! Adobe Reader, Oracle Java PC ! PC ! ! ! Reference: h>p://download.microso+.com/download/5/0/3/50310CCE-‐8AF5-‐4FB4-‐83E2-‐03F1DA92F33C/Microso+_Security_Intelligence_Report_Volume_15_English.pdf
- 15. ! ! ! DNS ! SSL !
- 16. ! MSVR ! Adobe, AOL, Apple, Blackberry, CA, Cisco, CiZbank, Comodo, Fidelity, Google, Hex-‐Rays, HP, IBM, Intel, Intuit, Lenovo, Mozilla, Nullso+, Nvidia, OpenOffice, Opera, Oracle, PGP, RealNetworks, SAP, Symantec, VMware, Wireshark, WordPress, Yahoo! !
- 17. ! ! 0-‐day ! ! Reference: h>p://blogs.technet.com/b/msrc/archive/2011/04/19/coordinated-‐vulnerability-‐disclosure-‐from-‐philosophy-‐to-‐pracZce.aspx
- 18. ! ! ! ! !
- 19. ? ! ! ! ! ! : Office Word PDF Adobe Reader ! ! !
- 20. ! ! ! SDL ! XSS SQL ! ! iPhone ! ROI
- 21. MSVR ! … ! CVD ! CVD: Coordinated Vulnerability Disclosure -‐ ( “responsible disclosure -‐ ” ) ! 0-‐day ! MSVR ! : ! MSVR
- 22. ! CVD ! ! ( ) ! Microso+ ( ) ! Online Service ( ) ! MiZgaZon Bypass ( ) ! : ! !
- 23. MSVR
- 24. 1:
- 25. 1 : ! <insert any Windows 0day full disclosure post here in the last 20 years>
- 26. 2: ! : ! ! ! ! ! ! !
- 27. 2 : ! Windows ! 8 ! NumLock ! 8 !
- 28. 3: ! ? ! SSL SSL ? ! Web Internet Explorer ? !
- 29. 3 : 0-DAY ! Microso+ : ! Bing ! : “Bing ”
- 30. 4: ! ( Web ! ☺ ! PGP S/MIME ! PGP … !
- 31. 4 : ! : ID ! : ID Web ! : ID ? ! : ! :
- 32. 5: ! ! ! !
- 33. 5 : ! ! 6
- 34. 6: ! ! ! ” ” ☺
- 35. 6 : ! : ! < > ! : !
- 36. 7: MSVR ! ! ! ! ! ! ! MSVR
- 38. 7B: MSVR !
- 40. : LIBAVCODEC ! MSVR12-‐017 ! FFmpeg Libavcodec ! VLC WMA ! ! Reference: h>p://technet.microso+.com/en-‐us/security/msvr/msvr12-‐017
- 41. : LIBAVCODEC ! !Exploitable (Windbg) libavcodec_plugin.dll WriteAV ! VLC A/V ! WMA
- 42. : LIBAVCODEC
- 43. : LIBAVCODEC ! 0x0001 0x0007 ! word ? ! ?
- 44. : LIBAVCODEC ! OffVis ! “Microso+ Office VisualizaZon Tool(Offivis) IT doc*, xls*, ppt* Microso+ Office ” ! Web ! GUT Reference: h>p://www.microso+.com/en-‐us/download/details.aspx?id=2096
- 45. : LIBAVCODEC
- 46. : LIBAVCODEC ! ! ! ASF WMA ! ASF “Number of Channels” ! 16bit ! WAVEFORMATEX ! “number of audio channels”( ) ! 0x0003 0x0008 ! 0x0009 VLC WMA2 Reference: h>p://msdn.microso+.com/en-‐us/library/bb643323.aspx
- 47. : LIBAVCODEC ! 2 ! pop ebx ! call dword ptr[ebx+30h] ! ? ☺ ! ! ebx ! call pop
- 48. : LIBAVCODEC ! msvr@microso+.com ! MSVR ! ! !
- 49. : LIBAVCODEC ! 2012 5
- 50. : LIBAVCODEC
- 51. : VMWARE ! MSVR13-‐002 ! VMware OVF Tool ! 1: VMware ? ! VMX ! VMDK ! OVF ! …more Reference: h>p://technet.microso+.com/en-‐us/security/msvr/msvr13-‐002
- 52. : VMWARE ! 2: OVF ? ! (Open Virtual Machine Format) ! “ ” Reference: h>p://www.vmware.com/pdf/ovf_whitepaper_specificaZon.pdf
- 53. : VMWARE ! XML ! XML
- 54. : VMWARE ! 3: VMware OVF ? ! ov+ool.exe ! VMware player OVF
- 55. : VMWARE 4: OVFTool ?
- 56. : VMWARE 5: <?xml version="1.0" encoding="uy-‐8"?> <ovf:Envelope xmlns:xsi="h>p://www.w3.org/2001/XMLSchema-‐instance" xmlns:ovf="%p. %p.%p.%p.%p.%p.%p.%p" xmlns:vssd="h>p://schemas.dmy.org/wbem/wscim/1/cim-‐ schema/2/CIM_VirtualSystemSe{ngData" … </ovf:Envelope>
- 57. : VMWARE …
- 58. : VMWARE
- 59. : BLACKBERRY PTG ! “Blackberry Print To Go Auth Bypass” ! ? ! Blackberry PTG ? ! PC BlackBerry Playbook ” ” ! PC PDF Playbook
- 60. : BLACKBERRY PTG
- 61. : BLACKBERRY PTG ! Playbook ! BlackBerry ID( ID/ ) ! Playbook PTG ! PIN Playbook ! ! Playbook ” ” BlackBerry
- 62. : BLACKBERRY PTG
- 63. : BLACKBERRY PTG ! 1234 … ! URL Web h>p://localhost:1234/myserverlet/ ! !
- 64. : BLACKBERRY PTG ! ! 1234
- 65. : BLACKBERRY PTG
- 66. : BLACKBERRY PTG
- 67. : BLACKBERRY PTG
- 68. : BLACKBERRY PTG ! ? ! Playbook ! BlackBerry BlackBerry security ! BlackBerry ! “ BlackBerry ID ” ! Playbook ! !
- 69. ! ! ! !
- 70. ! ! Web ! ! MSVR !
- 71. MSVR ! ! ! ROI ! ! ” ” ! : HackerOne ” ”
- 72. ! ! (PGP S/MIME) ! ! !
- 73. ! ! ! ! ! ( ) ! ! !
- 76. ©2014 Microso+ CorporaZon. All Rights Reserved. This document is provided "as-‐is." InformaZon and views expressed in this document, including URL and other Internet Web site references, may change without noZce. You bear the risk of using it. Some examples are for illustraZon only and are ficZZous. No real associaZon is intended or inferred. This document does not provide you with any legal rights to any intellectual property owned by Microso+. You may copy and use this document for your internal, reference purposes.
Notas do Editor
- If you happen to work at a company that produces lots of different products, you may not only being looking for bugs in your own code, but also in other vendor’s products as well I’ll show you how it’s possible to have a coordinated approach to getting bugs fixed outside your company, which is especially valuable if your platform supports or relies on them
- High level of what we’re doing now David is working on new ways to handle authentication that don’t depend on humans generating and remembering text for their security
- MSVR is a program within Microsoft that handles bugs in non-Microsoft software Bugs are usually found and submitted by security researchers at Microsoft across the divisions and this program coordinates fixes and advisories with the third-party vendors
- MSVR is a program within Microsoft that handles bugs in non-Microsoft software Bugs are usually found and submitted by security researchers at Microsoft across the divisions and this program coordinates fixes and advisories with the third-party vendors
- Reference for Reader+Java remark = SIR
- Example: Subtle bug in BIND DNS Server that could affect Microsoft DNS Server
- Reference: “Microsoft Vulnerability Research: Playing Well with Others Since 2009”
- This is not about trying to force companies or researchers to work with us, but rather make sure we also live up to Microsoft’s standards and work to make everyone involved happy
- Not complete but gives you a picture of the circumstances in which we tend to find vulnerabilities
- Key point: it is okay to use company resources and tools to find vulnerabilities on company time, as long as you also do your job Bugs that are below the bar still have some requirements (see later slide) but MSVR doesn’t have resources to help report them.
- CVD ensures the vendor is notified and given a reasonable amount of time to fix CVD requirement is actually in our employee handbook
- CVD ensures the vendor is notified and given a reasonable amount of time to fix CVD requirement is actually in our employee handbook
- Also logged in a tracking database Or send a mail to msvr@Microsoft
- Qualifying bug = high enough severity, Microsoft platform We don’t want to waste others’ time with incorrect or nonspecific reports If the bug is a design flaw, maybe you have an idea to design it better
- Human error doesn’t really qualify here
- Hypothetical example
- Lots of legwork here
- Optional for MSVR The finder always has an option to release their own content too, as long as the vendor has patched The idea here is to attract attention to noteworthy vulnerabilities that may not otherwise attract it. E.g. we may not need to do an advisory for an Adobe issue because it’s something everyone already knows about (unless it’s under attack), nor an advisory for an XSS flaw where there’s no user action, but might do one for a vuln in a common piece of software that isn’t often patched.
- There’s a tension between wanting to avoid warning the world when the danger isn’t that high, while still wanting to provide credit to your people. Having two advisory forms lets us do both.
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017 This is one of the tools we use in MMPC (Microsoft Malware Protection Center) to analyze and visualize file formats
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- http://technet.microsoft.com/en-us/security/msvr/msvr13-002
- http://technet.microsoft.com/en-us/security/msvr/msvr13-002
- http://technet.microsoft.com/en-us/security/msvr/msvr13-002
- http://technet.microsoft.com/en-us/security/msvr/msvr13-002
- Imports and exports OVF files
- Partial paste of PoC adjusted from a fuzzer-mutated OVF file The xmlsns:ovf envelope property is malformed; instead of pointing to the ovf schema url, it’s full of %p’s, which when interrupted by a function that takes format specifies, will print values as pointers
- http://technet.microsoft.com/en-us/security/msvr/msvr12-017
- Enter a random pin/password number here
- We didn’t have a BB Playbook to test
- Their team likely has access to internal knowledge about BB products, so they could see further than we could on if this was an issue or not Thanks BlackBerry Security team!
- Why use your own program instead of brokers? Maybe your company has some great resources you can utilize to make bug hunting more interesting and efficient If we all do this it’s good for everyone. Even if we don’t all do it, it’s still good just for you.
- We understand complex software and know which fixes should and should not take a long time
- We understand complex software and know which fixes should and should not take a long time