Multiple Vulnerabilities with Pre-installed Software expose Dell Systems to hack

Security vulnerabilities in pre-installed software expose Dell systems to code execution attacks which allow attackers to disable security mechanisms, escalate privileges and execute arbitrary code within the context of the application user.

CVE-2016-9038

The first vulnerability in Invincea-X, Dell Protected Workspace 6.1.3-24058, tracked as CVE-2016-9038, is a double fetch in the SboxDrv.sys driver. An attacker can exploit the flaw by sending crafted data to the \Device\SandboxDriverApi device driver which is read/write accessible to everyone. The attacker can exploit the issue to write an arbitrary value to kernel memory space in order to gain local privilege escalation.

CVE-2016-8732

The second flaw tracked as CVE-2016-8732 affected the Invincea Dell Protected Workspace version 5.1.1-22303, that is a security solution for endpoints. This security vulnerability found in one of the driver components, ‘InvProtectDrv.sys’ with version 5.1.1-22303 and the vulnerability is fixed with version 6.3.0.

According to Talos, the flaws exist within one of the driver components, ‘InvProtectDrv.sys’ that is included in version 5.1.1-22303 of this security software. Weak restrictions on the driver communications channel and insufficient validation could allow an attacker controlled application that is executed on an affected system to leverage the driver to disable protection mechanisms.

CVE-2017-2802

A third flaw, tracked as CVE-2017-2802, affects the Dell Precision Optimizer application and could lead to the execution of arbitrary code. The vulnerabilities affects the Dell Precision Tower 5810 with nVidia graphic cards, PPO Policy Processing Engine 3.5.5.0, and ati.dll (PPR Monitoring Plugin) 3.5.5.0.

An attacker could supply a malicious DLL having the same name of the “atiadlxx.dll” in one of the directories specified by the PATH environment variable to achieve arbitrary code execution. The security implications for the flaws are serious because the Invincea Dell Protected Workspace is an application is commonly deployed to secure workstations within high-security environments.

Vulnerability exists with PPR Monitoring Plugin 3.5.5.0 and versions from v4.0 onward are not vulnerable.

Talos recommend's that organizations using affected versions of this solution update to the latest version as quickly as possible to ensure that the protections provided by this software cannot be bypassed by an attacker. Organizations need to carefully consider the risks and benefits of software bundled with devices. It is important anyway to carefully assess any pre-installed software to avoid that flaws affecting them can be exploited by attackers.

Vault 7 Leaks CIA malware targets Linux machines

The CIA has developed strains of malware specifically designed to target Linux computers. The existence of the malware, known as OutlawCountry, was revealed by WikiLeaks. The leaked user manual — dated 04 June 2015 — details a kernel module for Linux 2.6 that allows CIA operatives to divert traffic from a Linux machine to a chosen destination. The Vault 7 leaks continue to flow thick and fast from WikiLeaks, shedding more and more light on the hacking and infiltration capabilities of the CIA.

With Linux-based operating systems usually lauded for their impenetrability, news of a possible chink in the armour will undoubtedly cause concern. With OutlawCountry, it seems the CIA was able to redirect network traffic from a target machine to an agency-controlled machine for infiltration. Shell access and root privileges are needed to install OutlawCountry, meaning CIA operatives must compromise machines via other means before deploying this malware strain.

OutlawCountry redirects outgoing Internet traffic:

OutlawCountry allows for the redirection of all outbound network traffic on the target computer to CIA controlled machines for ex- and infiltration purposes. The malware consists of a kernel module that creates a hidden netfilter table on a Linux target; with knowledge of the table name, an operator can create rules that take precedence over existing netfilter/iptables rules and are concealed from a user or even system administrator.

The installation and persistence method of the malware is not described in detail in the document; an operator will have to rely on the available CIA exploits and backdoor to inject the kernel module into a target operating system. OutlawCountry v1.0 contains one kernel module for 64-bit CentOS/RHEL 6.x; this module will only work with default kernels. Also, OutlawCountry v1.0 only supports adding covert DNAT rules to the PREROUTING chain.

Spying on Linux servers:

OutlawCountry can be used for both servers and regular desktops. Once Victims Traffic successful Redirected to CIA operator Control, then CIA can able to sniff Victims Activities and it will be used for other Attacks and it leads to compromise entire Victims network. If the Malware leads to occur more damage if its performed with Linux Based servers and it cause to sniff many users traffic which under the compromised server control.

Below is a list of the most notable WikiLeaks "Vault 7" dumps:

ᗙ Weeping Angel - tool to hack Samsung smart TVs

ᗙ Fine Dining - a collection of fake, malware-laced apps

ᗙ Grasshopper - a builder for Windows malware

ᗙ DarkSeaSkies - tools for hacking iPhones and Macs

ᗙ Scribble - beaconing system for Office documents

ᗙ Archimedes - a tool for performing MitM attacks

ᗙ AfterMidnight and Assassin - malware frameworks for Windows

ᗙ Athena - a malware framework co-developed with a US company

ᗙ Pandemic - a tool for replacing legitimate files with malware

ᗙ CherryBlossom - a tool for hacking SOHO WiFi routers

ᗙ Brutal Kangaroo - a tool for hacking air-gapped networks

ᗙ ELSA - malware for geo-tracking Windows users

Understanding DOM based XSS in DVWA

Cross-site Scripting (XSS) is a well-known web application vulnerability among developers, so there is no need to explain what XSS is. The most important part of a Cross-site Scripting attack developers should understand is its impact; an attacker can steal or hijack your session, carry out very successful phishing attacks and effectively can do anything that the victim can.

Let us first see what is DOM XSS?

In order to understand DOM XSS, we need to describe a bit what DOM is, and why is it relevant to this context. The Document Object Model is a convention for representing and working with objects in an HTML document (as well as in other document types). Basically all HTML documents have an associated DOM, consisting of objects representing the document properties from the point of view of the browser.

DOM XSS is a type of cross site scripting attack which relies on inappropriate handling, in the HTML page, of the data from its associated DOM. Among the objects in the DOM, there are several which the attacker can manipulate in order to generate the XSS condition, and the most popular, from this perspective, are the document.url, document.location and document.referrer objects.

Simple DOM Based Cross-site Scripting Vulnerability Example:

Let’s take the basic example of a page which provides users with customized content, depending on their user name which is encoded in the URL, and uses their name on the resulting page:

In this case the HTML source of http://www.example.com/userdashboard.html would look like this:

The result of http://www.example.com/userdashboard.html?context=Mary would be a customized dashboard for Mary, containing the string “Main Dashboard for Mary” at the top.

The malicious script can be embedded in the URL as follows:

Furthermore, the victim’s browser receives the above URL and sends a HTTP request to http://www.example.com, receiving the static HTML page described above. Then, the browser starts building the DOM of the page, and populates the document.url property, of the document object with the URL containing the malicious script.

When the browser arrives to the script which gets the user name from the URL, referencing the document.urlproperty, it runs it and consequently updates the raw HTML body of the page, resulting in

Next, the browser finds the malicious code in the HTML body and executes it, thus finalizing the DOM XSS attack. In reality, the attacker would hide the contents of the payload in the URL using encoding so that it is not obvious that the URL contains a script.

Note however, that some browsers may encode the < and > characters in the URL, causing the attack to fail. However there are other scenarios which do not require the use of these characters, nor embedding the code into the URL directly, so these browsers are not entirely immune to this type of attack either.

How is DOM XSS different?

Using the above example, we can observe that:

1. The HTML page is static, and there is no malicious script embedded into the page, as in the case of other types of XSS attacks;
2. The script code never gets to the server, if the “#” character is used; it is seen as fragment and the browser does not forward it further. Hence server-side attack detection tools will fail to detect this attack; in some cases, depending on the type of the URL, the payload might get to the server and it may be impossible to hide it.

Defending against DOM XSS attacks

The best way to fix DOM based cross-site scripting is to use the right output method (sink). For example if you want to use user input to write in a <div> element don't use innerHtml, instead use innerText/textContent. This will solve the problem, and it is the right way to remediate DOM based XSS vulnerabilities.

Effective conceptual defense methods against the DOM XSS include, but are not limited to

1. Avoiding client-side sensitive actions such as rewriting or redirection, using client-side data;
2. Sanitization of the client-side code by inspecting and securely handling references to DOM objects that pose a threat, such as url, location and referrer, especially in cases when the DOM may be modified;
3. Using intrusion prevention systems which are able to inspect inbound URL parameters and prevent the inappropriate pages to be served.

Attack Characteristic	Classic XSS	DOM XSS
Root cause	Source code	Source code
Premises	Inappropriate embedding of client side data in outbound HTML pages (by the server).	Inappropriate referencing and use in the client-side code, of DOM objects which are not entirely controlled and verified by the server-generated HTML pages.
Page type	Dynamic	Static or Dynamic
Detection	Intrusion detection systems, logs	Cannot be detected server side, if proper evading techniques are being used by the attacker.
Detection of vulnerabilities	Attack simulation;	Attack simulation;
	Code review – server-side;	Code review – client-side;
	Vulnerability detection tools that perform automatic penetration testing	Vulnerability detection tools that perform automatic penetration testing
Defending	Sanitization – server side	Sanitization – client-side
	Intrusion prevention systems	Intrusion prevention systems –to a lesser extent

Use NMAP to scan for MS17-010 Vulnerability

Sometimes you need to check on the status of your applied updates and quickly. With news of WannaCry, Petya, Nyetya Ransomware spreading via the MS17-010 vulnerability around the globe it’s a good idea to double check that all your updates are applied correctly. Even if you have comprehensive vulnerability management and patching programs there are almost certainly servers that have been missed, whether because they are vendor supported or part of your company's cottage IT. It is important to be able to find those servers and either remediate them or put additional controls in place to protect them.

Save it to Nmap NSE script directory:

• Linux – /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
• OSX – /opt/local/share/nmap/scripts/
• Windows ZenMap Install – C:\Program Files (x86)\Nmap\scripts

While detecting SMB is the first step, there are legitimate reasons why a server may have SMB open. For the specific case of finding servers that are vulnerable to MS17-010 we need to dig a bit deeper.

The following is a quick NMAP Execute Script monitor to check for the presence of the fixes needed to mitigate MS17-010:

Using the NSE smb-vuln-ms17-010.nse Script

If you’re using the command line version of NMap on any system, you can run this command (change the IP range to meet your needs):

nmap -sC -p 445 --script smb-vuln-ms17-010.nse 192.168.1.0/24

If you’re using the Windows ZenMap GUI, fill in the Target box with your IP (or IP range) and use this line in the Command box (it should automatically append the IP/Range to the end of this command):

nmap -sC -p 445 --script smb-vuln-ms17-010.nse

Scan Results

When the scan finds a server with SMB open and not vulnerable to MS17-010 then the output looks identical to the previous scan however a vulnerable server will generate additional output.

Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-17 13:18 Central Daylight Time

Nmap scan report for 192.168.1.50

Host is up (0.014s latency).

PORT STATE SERVICE

445/tcp open microsoft-ds

Host script results:

| smb-vuln-ms17-010:

| VULNERABLE:

| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)

| State: VULNERABLE

| IDs: CVE:CVE-2017-0143

| Risk factor: HIGH

| A critical remote code execution vulnerability exists in Microsoft SMBv1

| servers (ms17-010).

|

| Disclosure date: 2017-03-14

| References:

| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143

| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Nmap done: 1 IP address (1 host up) scanned in 0.98 seconds

What to do next

If you find a vulnerable machine, you’ll want to patch it right away. You can use the following references to find information for your Operating System version:

• Microsoft MS17-010 Security Bulletin
• Microsoft TechNet – Customer Guidance For WannaCrypt Attacks

As a general rule, don’t rely on this NMap script to find all of your vulnerable systems, this is only a tool. Stay current on patching workstations and servers.

Now your Windows Defender Antivirus helps you to prevent ransomware attack. Let us see how!

After WannaCry and Petya, it seems like Microsoft has realized the potential harm that ransomware can cause to its operating systems and its customers' sensitive information. Microsoft is making some interesting security-related changes to Windows 10 with the next Fall Creators Update, expected to debut in September. Windows 10 testers can now access a preview of the changes that include a new controlled folder access feature. It’s designed to only allow specific apps to access and read / write to a folder.

Windows Defender Antivirus is your default security software on Windows 10 to protect your system against viruses, spyware, rootkits, and other types of malware out-of-the-box, including ransomware. Starting with Windows 10 build 16232, Controlled folder access is introduced in Windows Defender Antivirus, to make it easier to protect your data from malicious programs and threats like ransomware. 

This new feature essentially monitors the changes that apps make to files in certain folders that are protected. If an app is blacklisted and tries to make changes to files in the protected folders, the user will get a notification about the attempt. Certain applications will be white-listed automatically, though the company doesn't specify which applications. To allow certain apps through the feature, users need to click Allow an app through Controlled folder access and locate and add the app. Think of it as a layer of protection against manipulation of files that are stored in protected folders.

Controlled Folder Access is not enabled by default. First thing you need to do is enable the feature by flipping its preference to on, and adding at least one folder that you want the feature to protect on the device. You can add additional folders to the list of protected folders, but you cannot alter the default list, which includes folders such as Documents, Pictures, Movies, and Desktop. Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults.

You must be signed in as an administrator to change Controlled folder access settings.

Option 1: To Turn On or Off  Windows Defender Controlled Folder Access

Note: Turning on or off Controlled folder access will modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access

GuardMyFolders DWORD

0 = Off               1 = On

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon.
2. Click/tap on the Virus & threat protection settings link.
3. Turn On or Off (default) Controlled folder access for what you want.
4. Click/tap on Yes when prompted by UAC to approve.
5. When finished, you can close Windows Defender Security Center if you like.

Option 2: To Add or Remove Protected Folders for Windows Defender Controlled Folder Access

Note: The list of added protected folders is stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access\GuardedFolders

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. 
2. Click/tap on the Virus & threat protection settings link. 
   
3. Click/tap on the Protected folders link under Controlled folder access.
4. Do step 5 (add) or step 6 (remove) below for what you would like to do.
5. To add a protected folder.
6. Click/tap on the Add a protected folder + button.
7. Navigate to and select the folder (ex: "Documents") you want to add, click/tap on Select Folder, and go to step 10 below.
8. To remove a protected folder.
9. Click/tap on a listed folder (ex: "Documents") you want to remove, click/tap on the Remove button, and go to step 10 below. 
10. Click/tap on Yes when prompted by UAC to approve.
11. When finished, you can close Windows Defender Security Center if you like.

Option 3: To Add or Remove Allowed Apps through Windows Defender Controlled Folder Access

Note: The list of allowed apps is stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exploit Guard\Controlled Folder Access\AllowedApplications

1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. 
2. Click/tap on the Virus & threat protection settings link.
3. Click/tap on the Allow an app through Controlled folder access link under Controlled folder access.
4. Do step 5 (add) or step 6 (remove) below for what you would like to do.
5. To add a allowed app
6. Click/tap on the Add an allowed app + button.
7. Navigate to and select the folder (ex: "notepad.exe") you want to allow, click/tap on Open, and go to step 10 below.
8. To remove a allowed app
9. Click/tap on a listed folder (ex: "notepad.exe") you want to remove, click/tap on the Remove button, and go to step 10 below. 
10. Click/tap on Yes when prompted by UAC to approve.
11. When finished, you can close Windows Defender Security Center if you like.

That's it!