3 ms·

> what I didn't understand is why Microsoft allows users to run random JS code from Internet with full privileges The short version is they don't. Cscript and

> what I didn't understand is why Microsoft allows users to run random JS code from Internet with full privileges The short version is they don't. Cscript and wscript are akin to PowerShell and they aren't talking about JS from the Web. The way it works is, say, the attacker sends the script (direct) as an email attachment and tricks the target into running it, or sends a document (indirect) that drops and runs the script, and tricks the target into opening that. They've even taken to having executables drop and run scripts to offload malicious activity into otherwise trusted processes without setting off alarms, like injection does. In the indirect cases, cscript/wscript aren't the only options for JS. You can also: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";new%20ActiveXObject('Shell.Application').ShellExecute('calc.exe'); But Microsoft is overstating the difficulty of detecting these attacks. For example obfuscation isn't a barrier to detection; in fact obfuscation can itself be detected and is a fantastic signal for blocking this stuff. General Windows system behavior, on the other hand, is chaotic[1], so in practice you're limited to writing rules for e.g. what child processes winword.exe isn't allowed to create, but even then you'll need exemptions for certain teams. 1. uTorrent for example creates child processes in a way that's practically indistinguishable from malware: C:\WINDOWS\System32\mshta.exe C:\WINDOWS\System32\mshta.exe" "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\HYD4.tmp.1548293039\HTA\index.hta?utorrent" "C:\5ee283553c4ab530c77f19785f6092cabfd8e48a5eefd808cb53aecea4399dd9" /LOG "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\HYD4.tmp.1548293039\index.hta.log" /PID "1076" /CID "sDbhVc2tIx6wzwCd" /VERSION "111849449" /BUCKET "0" /SSB "1" /COUNTRY "US" /OS "5.1" /BROWSERS "\"C:\Program Files\Internet Explorer\iexplore.exe\"" /USERTYPE "admin" /ARCHITECTURE "32" /LANG "en" /USERNAME "<USER>" /CLIENT "utorrent"" C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cscript.exe" "shell_scripts/check_if_cscript_is_working.js"" C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.b-000.XYZ.bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJmYWlsR2VuZXJhbCIsInR5cGUiOiJpIiwiZXJyb3IiOiJFcnJvcjogVW5hYmxlIHRvIHdhaXQgZm9yIHByb2Nlc3MuOyBmaWxlOiBmaWxlOi8vLmpzOyBsaW5lOiAxMCJ9" "

anon4242 7y ago
Yeah, about uTorrent... didn't we agree long ago that it could no longer be trusted..?
tinus_hn 7y ago
Pretty easy to defeat: don’t allow executable attachments.
- FreakLegion 7y ago
  Most companies don't, for actual executables (PE files) and scripts. So for example: 1. Attackers use documents, because it isn't realistic to disallow documents over email as a matter of policy. 2. Attackers use download links (Box, OneDrive, etc.), because it isn't realistic to disallow URLs in email as a matter of policy. 3. Attackers put the naughty bits in password-protected archives, which aren't realistic for most companies to disallow over email as a matter of policy. Some will, though. On and on. Policy is great and you should use it as much as possible, but at some point usability always wins out. Obviously there's a business opportunity there, and companies like Proofpoint and Mimecast have stepped in to fill the gap.
  - tinus_hn 7y ago
    Pretty easy to defeat: downloaded and extracted executables are quarantined. And documents can’t ‘drop and run scripts’, they are documents. And by the way, try sending a password protected archive in the mail once. Most services just throw them away.
    - FreakLegion 7y ago
      > downloaded and extracted executables are quarantined The vast majority of companies won't implement a security policy that strict, even if they can distinguish email attachment downloads from other sources, which they generally can't (ADS doesn't capture it directly). > And documents can’t ‘drop and run scripts’, they are documents Yes they can, and do, without needing exploits, for both legitimate and illegitimate reasons. The legitimate reasons are why, again, the vast majority of companies won't implement blanket security policies here. > And by the way, try sending a password protected archive in the mail once. Most services just throw them away. Incorrect. You can do whatever you want with your personal email, but we're talking about enterprise security. Few companies (but more than the above two cases) will block password-protected anything as a matter of policy. In practice, none of what you're saying will be done because of the downstream problems it creates for IT and security teams.

anon4242 7y ago

Yeah, about uTorrent... didn't we agree long ago that it could no longer be trusted..?

tinus_hn 7y ago

Pretty easy to defeat: don’t allow executable attachments.

FreakLegion 7y ago
Most companies don't, for actual executables (PE files) and scripts. So for example: 1. Attackers use documents, because it isn't realistic to disallow documents over email as a matter of policy. 2. Attackers use download links (Box, OneDrive, etc.), because it isn't realistic to disallow URLs in email as a matter of policy. 3. Attackers put the naughty bits in password-protected archives, which aren't realistic for most companies to disallow over email as a matter of policy. Some will, though. On and on. Policy is great and you should use it as much as possible, but at some point usability always wins out. Obviously there's a business opportunity there, and companies like Proofpoint and Mimecast have stepped in to fill the gap.
- tinus_hn 7y ago
  Pretty easy to defeat: downloaded and extracted executables are quarantined. And documents can’t ‘drop and run scripts’, they are documents. And by the way, try sending a password protected archive in the mail once. Most services just throw them away.
  - FreakLegion 7y ago
    > downloaded and extracted executables are quarantined The vast majority of companies won't implement a security policy that strict, even if they can distinguish email attachment downloads from other sources, which they generally can't (ADS doesn't capture it directly). > And documents can’t ‘drop and run scripts’, they are documents Yes they can, and do, without needing exploits, for both legitimate and illegitimate reasons. The legitimate reasons are why, again, the vast majority of companies won't implement blanket security policies here. > And by the way, try sending a password protected archive in the mail once. Most services just throw them away. Incorrect. You can do whatever you want with your personal email, but we're talking about enterprise security. Few companies (but more than the above two cases) will block password-protected anything as a matter of policy. In practice, none of what you're saying will be done because of the downstream problems it creates for IT and security teams.