This Week In Security: Censoring Researchers, The Death Of OpenPGP, Dereferencing Nulls, And Zoom Is Watching You

Last week the schedule for our weekly security column collided with the Independence Day holiday. The upside is that we get a two-for-one deal this week, as we’re covering two weeks worth of news, and there is a lot to cover!

[Petko Petrov], a security researcher in Bulgaria, was arrested last week for demonstrating an weakness he discovered in a local government website. In the demonstration video, he stated that he attempted to disclose the vulnerability to both the software vendor and the local government. When his warnings were ignored, he took to Facebook to inform the world of the problem.

From the video, it appears that a validation step was performed on the browser side, easily manipulated by the end user. Once such a flaw is discovered, it becomes trivial to automate the process of scraping data from the vulnerable site. The vulnerability found isn’t particularly interesting, though the amount of data exposed is rather worrying. The bigger story is that as of the latest reports, the local government still intends to prosecute [Petko] for downloading data as part of demonstrating the attack.

Youtube Censorship

We made a video about launching fireworks over Wi-Fi for the 4th of July only to find out @YouTube gave us a strike because we teach about hacking, so we can't upload it. YouTube now bans: "Instructional hacking and phishing: Showing users how to bypass secure computer systems"

In related news, Google has begun cracking down on “Instructional Hacking and Phishing” videos. [Kody] from the Null Byte Youtube channel found himself locked out of his own channel, after receiving a strike for a video discussing a Wifi vulnerability.

The key to getting a video unblocked seems to be generating lots of social media attention. Enough outcry seems to trigger a manual review of the video in question, and usually results in the strike being rescinded.

Improved Zip Bomb

A zip bomb is a small zip file that unzips into a ridiculously large file or collection of files. While there are obvious nefarious uses for such a file, it has also become something of a competition, crafting the most extreme zip bomb. The previous champion was 42.zip, a recursive zip file that when fully extracted, weighs in at 42 petabytes. A new contender may have just taken the crown, and without using zip file recursion.

[David Fifield] discovered a pair of ZIP tricks. First being that multiple files can be constructed from a single “kernel” of compressed data. The second is that file headers could also be part of files to be decompressed. It’s clever work, and much easier to understand when looking at the graphics he put together. From those two points, the only task left is to optimize. Taking advantage of the zip64 format, the final compression ratio was approximately 98 million to one.

Breaking OpenPGP Keyservers

OpenPGP as we know it is on the ropes. OpenPGP is the technique that allows encryption and verification of emails through cryptographic signatures. It’s the grandaddy of modern secure communication, and still widely used today. One of the features of OpenPGP is that anyone can upload their public key to keyservers hosted around the world. Because of the political climate in the early 90’s when OpenPGP was first developed, it was decided that a baked-in feature of the keyserver was that uploaded keys could never be deleted.

Another feature of OpenPGP keys is that one user can use their key to sign another user’s key, formally attesting that it is valid. This creates what is known as a “web of trust”. When an OpenPGP instance validates a signature, it also validates all the attestations attached to that signature. Someone has spammed a pair of OpenPGP certificates with tens of thousands of signatures. If your OpenPGP client refreshes those signatures, and attempts to check the validations, it will grind to a halt under the load. Loading the updated certificate permanently poisons the offline key-store. In some cases, just the single certificate can be deleted, but some users have had to delete their entire key store.

It’s now apparent that parts of the OpenPGP infrastructure hasn’t been well maintained for quite some time. [Robert J. Hansen] has been spearheading the public response to this attack, not to mention one of the users directly targeted. In a follow-up post, he alluded to the need to re-write the keyserver component of OpenPGP, and the lack of resources to do so.

It’s unclear what will become of the OpenPGP infrastructure. It’s likely that the old keyserver network will have to be abandoned entirely. An experimental keyserver is available at keys.openpgp.org that has removed the spammed signatures.

Beware the QR Codes

Link shorteners are a useful way to avoid typing out a long URL, but have a downside — you don’t know what URL you’re going to ahead of time. Thankfully there are link unshorteners, like unshorten.it. Paste a shortlink and get the full URL, so you don’t accidentally visit a shady website because you clicked on a shortened link. [Nick Guarino] over at cofense.com raises a new alarm: QR codes can similarly lead to malicious or questionable websites, and are less easily examined before scanning. His focus is primarily how a QR code can be used to bypass security products, in order to launch a fishing attack.

Most QR scanners have an option to automatically navigate to the web page in the code. Turn this option off. Not only could scanning a QR code lead to a malicious web site, but URLs can also launch actions in other apps. This potential problem of QR codes is very similar to the problem of shortened links — the actual payload isn’t human readable prior to interacting with it, when it’s potentially too late.

Dereferencing Pointers for Fun and Profit

On the 10th, the Eset blog, [welivesecurity], covered a Windows local priveledge escalation 0-day being actively exploited in the wild. The exploit highlights several concepts, one of which we haven’t covered before, namely how to use a null pointer dereference in an exploit.

In C, a pointer is simply a variable that holds a memory location. In that memory location can be a data structure, a string, or even a callable function. By convention, when pointers aren’t referring to anything, they are set to NULL. This is a useful way to quickly check whether a pointer is pointing to live data. The process of interacting with a pointer’s data is known a dereferencing the pointer. A NULL pointer dereference, then, is accessing the data referred to by a pointer that is set to NULL. This puts us in the dangerous territory of undefined behavior.

Different compilers, architectures, and even operating systems will potentially demonstrate different behavior when doing something undefined. In the case of C code on 32-bit Windows 7, NULL is indistinguishable from zero, and memory location zero is a perfectly valid location. In this case, we’re not talking about the physical location zero, but logical address zero. In modern systems, each process has a dedicated pool of memory, and the OS manages the offset and memory mapping, allowing the process to use the simpler logical memory addressing.

Windows 7 has a function, “NtAllocateVirtualMemory”, that allows a process to request access to arbitrary memory locations. If a NULL, or zero, is passed to this function as the memory location, the OS simply picks a location to allocate that memory. What many consider a bug is that this function will effectively round down small memory locations. It’s quite possible to allocate memory at logical address 0/NULL, but is considered to be bad behavior. The important takeaway here is that in Windows 7, a program can allocate memory at a location referred to by a null pointer.

On to the vulnerability! The malicious program sets up a popup menu and submenu as part of its GUI. While this menu is still being initialized, the malicious program cancels the request to set up the menu. By timing the cancellation request precisely, it’s possible for the submenu to still be created, but to be a null pointer instead of the expected object. A second process can then trigger the system process to call a function expected to be part of the object. Because Windows allows the allocation of memory page zero, this effectively hands system level execution to the attacker. The full write-up is worth the time to check out.

Zoom Your Way to Vulnerability

Zoom is a popular web-meeting application, aimed at corporations, with the primary selling point being how easy it is to join a meeting. Apparently they worked a bit too hard on easy meeting joins, as loading a malicious webpage on a Mac causes an automatic meeting join with the mic and webcam enabled, so long as that machine has previous connected to a Zoom meeting. You would think that uninstalling the Zoom client would be enough to stop the madness, but installing Zoom also installs a local webserver. Astonishingly, uninstalling Zoom doesn’t remove the webserver, but it was designed to perpetually listen for a new Zoom meeting attempt. If that sounds like a Trojan to you, you’re not wrong.

The outcry over Zoom’s official response was enough to inform them of the error of their ways. They have pushed an update that removes the hidden server and adds a user interaction before joining a meeting. Additionally, Apple has pushed an update that removes the hidden server if present, and prompts before joining a Zoom meeting.

Wireless Keyboards Letting You Down

Have you ever typed your password using a wireless keyboard, and wondered if you just broadcast it in the clear to anyone listening? In theory, wireless keyboards and mice use encryption to keep eavesdroppers out, but at least Logitech devices have a number of problems in their encryption scheme.

Part of the problem seems to be Logitech’s “Unifying” wireless system, and the emphasis on compatibility. One receiver can support multiple devices, which is helpful when eliminating cable clutter, but also weakens the encryption scheme. An attacker only has to be able to monitor the radio signals during pairing, or even monitoring signals while also observing keypresses. Either way, a few moments of processing, and an attacker has both read and write access to the wireless gear.

Several even more serious problems have fixed with firmware updates in the past years, but [Marcus Mengs], the researcher in question, discovered that newly purchased hardware still doesn’t contain the updated firmware. Worse yet, some of the effected devices don’t have an officially supported firmware update tool.

Maybe wired peripherals are the way to go, after all!

24 thoughts on “This Week In Security: Censoring Researchers, The Death Of OpenPGP, Dereferencing Nulls, And Zoom Is Watching You

      1. Yeah let’s just assume any average hackaday commenter is capable of coding encryption software and write snarky comments at them, great idea, we’ll end up so incredibly secure this way.

  1. youtube has outgrown itself I feel, lots of interesting channels being demonetised or deleted, and thats not even getting into the rampant over sensitive discrimination against any content with copyrighted music with no regard to fair use or context. Hopefully another platform will step up, but unfortunately lots of good content will be lost while youtube screws itself over.

    1. I really cut down on my YT watching when they started inserting commercials in the videos, as well as removing the “Skip Ad” button on some videos.
      I am upset that they obfuscate some videos that are not in sync with their political view, I mean a general search will not turn up the video, you have to specify it by name.
      IIRC, I have never subscribed to anyone’s feed on YT, I might have gotten an account in “the early days” but have not logged in for years.

      1. “How to perform the Heimlich maneuver.”

        2 min un-skipable movie trailer.
        1/4 way through video…
        30 second un-skipable ad for local restaurant.
        1/2 way through video…
        30 second un-skipable ad for local first aid training.
        3/4 way through video…
        30 second un-skipable ad for local funeral home.
        End of video…
        Pop up ad for YouTube Red.

        1. Between ublock origin and the somewhat annoying adblock plus, I see zero ads on YT or anywhere else – other than in-video product placements/endorsements. Which are less annoying I suppose.
          Yes, YT is sort of shadow banning essentially anyone who doesn’t think like Jen Gennai (see project Veritas google leak, censored itself, then put back up – also on Vimeo and Bitchute) and that’s annoying as heck. But it brings to mind the classic line from Star Wars – and Mike Masnicks “Streisand Effect” – the tighter your grasp, the more slips through your fingers.

          Every worthwhile site I’ve seen taken down has moved and has gained more subs etc than before – what they lost was monetization, which isn’t exactly a right – make your own doggone web page like any newspaper if you want that. And you pay for the servers.

          Me, I’m just glad they let me put up my silly science/tech/experiments videos and stream them to my friends for free – that’s how they started, pretty much, that’s all I want anyway.

      2. Blame the people making the videos if you don’t like adverts during videos or if they’re unskippable. The number, location (before, during or after) and type of adverts (short popups, long skippable or long unskippable) is set by the content creator. If they want to extract maximum profit from their viewers then they can set it to be frequent and annoying.

    1. That video shows a simple MouseJack attack, which was indeed demonstrated in 2015-2016.

      Marcus has significantly advanced the state of the art, by reverse engineering the pairing algorithm, the AES encryption/decryption algorithm, injecting into wireless presenters that actively filter injected keystrokes, etc, etc.
      Also significantly, he has implemented access to the RAW HID (HID++) channel used by Unifying receivers to transmit things like Macros, and other persistent programming to the mouse/keyboard, and made it available to an attacker as a pipeline for arbitrary binary data.

      This means that a victim using an airgapped machine (i.e. no network interfaces at all) and a Logitech wireless keyboard can be compromised in such a way as to result in a covert shell on their machine, receiving its instructions and relaying its output via the raw HID channel, completely invisible to the victim. And it should only require about 10-15 seconds of “unobserved access” to an unlocked machine (where “unobserved access” means that the operator may be present, but not actively watching their unlocked screen) to type out an initial payload. After that, everything goes over the raw HID channel.

  2. The keyserver authentication system in the OpenPGP seems like a laughable joke, since how didn’t the developers foresee such a problem?

    Authenticating that someone is who they say they are is much easier if one only looks at relevant pieces of authentication, not every single little piece of authentication in existence…..

  3. I’d love to find a good bid site that will at least simpoly displsy What the vids are , without needing scripting first.
    YouTube’s
    (CDN?) seems to just get worse (buffering) with every new change
    Once YouTube started cropping all of the old 4×5 videos to fit cell 16×9, or even worse, cell phone aspect of a Bit over 400 pixels tall (wtf? Arghhhh ) They pretty much lost my interest. Seriously sucks when the project or point of discussion has been cropped off along with the lower third of the video.

    {Pecking this out on a trashefd tablet screen, so a few typos just flat refuse to let me correct them. My apologies.)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.