6 ms·

I don't see any way it would be possible for such a file to be simultaneously executed by the system as a MSI and as a JAR (you can probably always invoke the J

I don't see any way it would be possible for such a file to be simultaneously executed by the system as a MSI and as a JAR (you can probably always invoke the JRE on a .msi file, just not through the system file associations).

Lammy 6y ago
It's renamed, not simultaneously-associated. From the fine article: 'Quintero said this weakness would particularly acute if an attacker were to use it to hide a malicious Java file (.jar). And, he said, this exact attack vector was indeed detected in a malware sample sent to VirusTotal. “In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows,” Quintero wrote.'
- cpgxiii 6y ago
  Exactly, you can't have it be an MSI and a JAR, it has to be a JAR to invoke the JRE automatically. In terms of practical impact, it sounds like you need a target where the JAR file will be run, but also where you'd expect Windows signatures validation alone to protect against malicious Jars.
  - Lammy 6y ago
    Prepending "ren malicious.msi malicious.jar" to my exploit invocation doesn't seem that hard.
    - creato 6y ago
      The issue is it would seem the file needs to be an MSI file to get signature validation, but need to be a .jar file to run the malicious part. Transparently going from "File passes signature verification" to "running the jar payload" seems like it would require another (more serious than this) bug or active steps from the user.
      - Lammy 6y ago
        > seems like it would require another (more serious than this) bug Yes on your first part; no on the parenthetical. One exploit to let the malicious hanger-on into your computer. Another exploit—maybe in a web page you visit regularly—to trigger it. Compare to this real-world iOS attack: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
    - cpgxiii 6y ago
      Sure, but if you already have code execution on the target to run the rename or directly invoke the JRE, either (1) you've already exploited the target or (2) lack of signature validation (since the rename script or equivalent to invoke it wouldn't be signed) wouldn't have been a barrier to running the malicious JAR.
      - Lammy 6y ago
        No way, exactly the opposite. Attacks are often described as "chains" because it usually requires simultaneous application of multiple exploits to achieve an attack's goal. Here are a bunch of great real-life examples from the Playstation 4 hacking scene: https://www.psdevwiki.com/ps4/Working_Exploits https://www.psdevwiki.com/ps4/Working_Exploits Or iOS exploit chains, some of which I've used intentionally as part of iOS jailbreak tools like unc0ver. From Project Zero's "very deep dive into iOS Exploit chains found in the wild": "Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day." https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... I imagine the real-world application of this MSI thing is something like: 1) Get silently-malicious MSI on to target machine (via download server compromise, poisoned non-TLS download, redirect TLS-downgrade, etc etc) 2) Got malicious "trigger" exploit code on to any web page used by the target (via web server compromise, weak human security like admin passwords, etc etc). 3) There is no step three. With this in mind we can look at even very recent real-world news—like the simultaneous patching of five Chrome exploits in June 2020—and instantly see how it's not just hypothetical: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2020-077/ https://www.cisecurity.org/advisory/multiple-vulnerabilities... For example, one of them (CVE-2020-6493) is "Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page". How many more of these do you think are hanging around out there, waiting for Google to get the 'okay' to fix?
        cpgxiii 6y ago
    - Ardren 6y ago
      Yeah, it's simple if you've already exploited the target's computer...
      - Lammy 6y ago
        https://news.ycombinator.com/item?id=24185626 https://news.ycombinator.com/item?id=24185626 :)
  - berdario 6y ago
    Just name your payload something like "foo\u200fism.jar" (\u is the Python escape for arbitrary unicode codepoints) And Windows will (as of a couple years ago, at least) render it as "fooraj.msi" (Though I'm not sure what kind of verification prompt you'd get in this circumstance)
    - ChrisSD 6y ago
      Microsoft fixed that a few versions back. It will be displayed as "foo‏ism.jar" in explorer.

Lammy 6y ago

It's renamed, not simultaneously-associated. From the fine article: 'Quintero said this weakness would particularly acute if an attacker were to use it to hide a malicious Java file (.jar). And, he said, this exact attack vector was indeed detected in a malware sample sent to VirusTotal. “In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows,” Quintero wrote.'

cpgxiii 6y ago
Exactly, you can't have it be an MSI and a JAR, it has to be a JAR to invoke the JRE automatically. In terms of practical impact, it sounds like you need a target where the JAR file will be run, but also where you'd expect Windows signatures validation alone to protect against malicious Jars.
- Lammy 6y ago
  Prepending "ren malicious.msi malicious.jar" to my exploit invocation doesn't seem that hard.
  - creato 6y ago
    The issue is it would seem the file needs to be an MSI file to get signature validation, but need to be a .jar file to run the malicious part. Transparently going from "File passes signature verification" to "running the jar payload" seems like it would require another (more serious than this) bug or active steps from the user.
    - Lammy 6y ago
      > seems like it would require another (more serious than this) bug Yes on your first part; no on the parenthetical. One exploit to let the malicious hanger-on into your computer. Another exploit—maybe in a web page you visit regularly—to trigger it. Compare to this real-world iOS attack: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
  - cpgxiii 6y ago
    Sure, but if you already have code execution on the target to run the rename or directly invoke the JRE, either (1) you've already exploited the target or (2) lack of signature validation (since the rename script or equivalent to invoke it wouldn't be signed) wouldn't have been a barrier to running the malicious JAR.
    - Lammy 6y ago
      No way, exactly the opposite. Attacks are often described as "chains" because it usually requires simultaneous application of multiple exploits to achieve an attack's goal. Here are a bunch of great real-life examples from the Playstation 4 hacking scene: https://www.psdevwiki.com/ps4/Working_Exploits https://www.psdevwiki.com/ps4/Working_Exploits Or iOS exploit chains, some of which I've used intentionally as part of iOS jailbreak tools like unc0ver. From Project Zero's "very deep dive into iOS Exploit chains found in the wild": "Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day." https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... I imagine the real-world application of this MSI thing is something like: 1) Get silently-malicious MSI on to target machine (via download server compromise, poisoned non-TLS download, redirect TLS-downgrade, etc etc) 2) Got malicious "trigger" exploit code on to any web page used by the target (via web server compromise, weak human security like admin passwords, etc etc). 3) There is no step three. With this in mind we can look at even very recent real-world news—like the simultaneous patching of five Chrome exploits in June 2020—and instantly see how it's not just hypothetical: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2020-077/ https://www.cisecurity.org/advisory/multiple-vulnerabilities... For example, one of them (CVE-2020-6493) is "Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page". How many more of these do you think are hanging around out there, waiting for Google to get the 'okay' to fix?
      - cpgxiii 6y ago
  - Ardren 6y ago
    Yeah, it's simple if you've already exploited the target's computer...
    - Lammy 6y ago
      https://news.ycombinator.com/item?id=24185626 https://news.ycombinator.com/item?id=24185626 :)
- berdario 6y ago
  Just name your payload something like "foo\u200fism.jar" (\u is the Python escape for arbitrary unicode codepoints) And Windows will (as of a couple years ago, at least) render it as "fooraj.msi" (Though I'm not sure what kind of verification prompt you'd get in this circumstance)
  - ChrisSD 6y ago
    Microsoft fixed that a few versions back. It will be displayed as "foo‏ism.jar" in explorer.