Are Text-Only Data Formats Safe? Stephen Checkoway, Hovav Shacham, - - PowerPoint PPT Presentation

▶
are text only data formats safe
SMART_READER_LITE
LIVE PREVIEW

Are Text-Only Data Formats Safe? Stephen Checkoway, Hovav Shacham, - - PowerPoint PPT Presentation

Dec 01, 2023 157 likes •336 views

Are Text-Only Data Formats Safe? Stephen Checkoway, Hovav Shacham, Eric Rescorla Tuesday, April 27, 2010 1 Intuitive data-safety scale Unsafe Safe ASCII Text Executables Media Web Applications Documents Tuesday, April 27, 2010 2 T EX

slide-1
SLIDE 1

Are Text-Only Data Formats Safe?

Stephen Checkoway, Hovav Shacham, Eric Rescorla

1 Tuesday, April 27, 2010

slide-2
SLIDE 2

Intuitive data-safety scale

Unsafe Safe Executables ASCII Text Media Web Applications Documents

2 Tuesday, April 27, 2010

slide-3
SLIDE 3

T EX

  • Document preparation language
  • 7-bit ASCII text
  • Understands boxes and glue
  • Makes pretty equations

D(HR) =

  • x,y∈X

H(x, y) log H(x, y) R(x, y)

boxes and glue

3 Tuesday, April 27, 2010

slide-4
SLIDE 4

How we use T E X T EX

4 Tuesday, April 27, 2010

slide-5
SLIDE 5

Intuitive data-safety scale

Unsafe Safe Executables ASCII Text Media Web Applications Documents T E X

5 Tuesday, April 27, 2010

slide-6
SLIDE 6

More T E X

  • Turing-complete, macro language: \def
  • Read/write files: \read, \write
  • Extremely malleable syntax: \catcode

6 Tuesday, April 27, 2010

slide-7
SLIDE 7

Taking control with T E X

Distribution Operating System How

Write to Startup

T EX Live

Write to web directory

7 Tuesday, April 27, 2010

slide-8
SLIDE 8

L

AT

E X virus lifecycle

  • Compile sploit.tex
  • C:\DOCUME~1\ADMINI~1\STARTM~1

\PROGRAMS\STARTUP\sploit.js

  • Restart computer
  • sploit.js finds .tex files; inserts the virus

8 Tuesday, April 27, 2010

slide-9
SLIDE 9

Data exfiltration

  • Read sensitive files
  • \input, \include
  • \read, \readline
  • Typeset data in output PDF

9 Tuesday, April 27, 2010

slide-10
SLIDE 10

Input filtering

  • Filter out dangerous control sequences
  • Math mode

10 Tuesday, April 27, 2010

slide-11
SLIDE 11

T EXniques to bypass filters

  • Macros like \input
  • \@input, \@iinput, \@input@, \@@input
  • \lstinputlisting, \verbatiminput
  • Bypass filters
  • \csname, \begin, ^^xy, \catcode
  • Escape math mode
  • \end{eqnarray}, \end{align}

11 Tuesday, April 27, 2010

slide-12
SLIDE 12

12 Tuesday, April 27, 2010

slide-13
SLIDE 13

T E X’s malleability

  • Category codes control functionality
  • Can be changed by \catcode

\catcode`Z=0 ZTeX

13 Tuesday, April 27, 2010

slide-14
SLIDE 14

An example: xii.tex

\let~\catcode~`76~`A13~`F1~`j00~`P2jdefA71F~`7113jdefPALLF PA''FwPA;;FPAZZFLaLPA//71F71iPAHHFLPAzzFenPASSFthP;A$$FevP A@@FfPARR717273F737271P;ADDFRgniPAWW71FPATTFvePA**FstRsamP AGGFRruoPAqq71.72.F717271PAYY7172F727171PA??Fi*LmPA&&71jfi Fjfi71PAVVFjbigskipRPWGAUU71727374 75,76Fjpar71727375Djifx :76jelse&U76jfiPLAKK7172F71l7271PAXX71FVLnOSeL71SLRyadR@oL RrhC?yLRurtKFeLPFovPgaTLtReRomL;PABB71 72,73:Fjif.73.jelse B73:jfiXF71PU71 72,73:PWs;AMM71F71diPAJJFRdriPAQQFRsreLPAI I71Fo71dPA!!FRgiePBt'el@ lTLqdrYmu.Q.,Ke;vz vzLqpip.Q.,tz; ;Lql.IrsZ.eap,qn.i. i.eLlMaesLdRcna,;!;h htLqm.MRasZ.ilk,% s$;z zLqs'.ansZ.Ymi,/sx ;LYegseZRyal,@i;@ TLRlogdLrDsW,@;G LcYlaDLbJsW,SWXJW ree @rzchLhzsW,;WERcesInW qt.'oL.Rtrul;e doTsW,Wk;Rri@stW aHAHHFndZPpqar.tridgeLinZpe.LtYer.W,:jbye

By David Carlisle

14 Tuesday, April 27, 2010

slide-15
SLIDE 15

Conclusions

  • Binary/text distinction not a good classifier
  • Arbitrary code execution
  • Exfiltrate sensitive data

15 Tuesday, April 27, 2010

slide-16
SLIDE 16

Questions?

Owning people through a typesetting language; it seems unsporting, somehow. – Keaton Mowery

16 Tuesday, April 27, 2010