Security and Privacy Jens Mller, Fabian Ising, Christian Mainka, - - PowerPoint PPT Presentation

▶
security and privacy
SMART_READER_LITE
LIVE PREVIEW

Security and Privacy Jens Mller, Fabian Ising, Christian Mainka, - - PowerPoint PPT Presentation

Feb 09, 2024 239 likes •631 views

Office Document Security and Privacy Jens Mller, Fabian Ising, Christian Mainka, Vladislav Mladenov, Sebastian Schinzel, Jrg Schwenk Overview 1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure

slide-1
SLIDE 1

Office Document Security and Privacy

Jens Müller, Fabian Ising, Christian Mainka, Vladislav Mladenov, Sebastian Schinzel, Jörg Schwenk

slide-2
SLIDE 2

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure 5. Data Manipulation 6. Code Execution 7. Evaluation

Overview

2

slide-3
SLIDE 3

History: Office Wars

3

  • 1990: MS Office 1.0
  • 2002: Star Office → OpenOffice.org
  • 2006: OOXML + ODF standardization
  • 2010: OpenOffice.org → LibreOffice
slide-4
SLIDE 4

Two competing standards

4

OOXML (ISO/IEC 29500) ODF (ISO/IEC 26300) Office Open XML Open Document Format 6500 pages 800 pages (some) MS proprietary formats re-use of SVG, MathML, XForms, … .docx, .xlsx, .pptx, … .odt, .ods, .odp, … XML-based, Zip container XML-based, Zip container

slide-5
SLIDE 5

OOXML Directory Structure

5

slide-6
SLIDE 6

OOXML Example

6

slide-7
SLIDE 7

ODF Directory Structure

7

slide-8
SLIDE 8

ODF Example

8

slide-9
SLIDE 9
  • Victim opens malicious office document
  • “Bad things” happen (attack-dependent)

Attacker Model

9

slide-10
SLIDE 10

1. OOXML/ODF Basics 2. Denial of Service

 Deflate Bomb

3. Invasion of Privacy 4. Information Disclosure 5. Data Manipulation 6. Code Execution 7. Evaluation

Overview

10

slide-11
SLIDE 11

Deflate Bomb

11

  • max. compression ratio: 1:1023
slide-12
SLIDE 12

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy

 URL Invocation, Evitable Metadata

4. Information Disclosure 5. Data Manipulation 6. Code Execution 7. Evaluation

Overview

12

slide-13
SLIDE 13
  • Goal: “phone home” to attacker’s

server once document is opened

URL Invocation

13

slide-14
SLIDE 14

URL Invocation

14

CVE-2020-12802

slide-15
SLIDE 15

URL Invocation

15

slide-16
SLIDE 16

Evitable Metadata

16

Source: news.bbc.co.uk

slide-17
SLIDE 17

Evitable Metadata

17

slide-18
SLIDE 18

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure

 Data Exfiltration, File Disclosure, Credential Theft

5. Data Manipulation 6. Code Execution 7. Evaluation

Overview

18

slide-19
SLIDE 19
  • Idea: victim obtains spreadsheet; user

input values sent to attacker’s server

Data Exfiltration

19

slide-20
SLIDE 20
  • Idea: include local files on disk

File Disclosure

20

slide-21
SLIDE 21

File Disclosure

21

slide-22
SLIDE 22

File Disclosure

22

slide-23
SLIDE 23

File Disclosure

23

slide-24
SLIDE 24
  • Goal: obtain user’s NTLM hash

Credential Theft

24

slide-25
SLIDE 25
  • Offline cracking

– NTLMv2: modern GPU requires 2,5h for eight chars – NTLMv1, LM: considered broken [Marlinspike2012]

  • Pass-the-hash or relay attacks

– Compare [Ochoa2008, Hummel2009] – Depending on Windows security policy

Credential Theft

25

slide-26
SLIDE 26

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure 5. Data Manipulation

 File Write Access, Content Masking

6. Code Execution 7. Evaluation

20

Overview

slide-27
SLIDE 27
  • Idea: XForms allow local file as target

File Write Access

27

slide-28
SLIDE 28

File Write Access

28

CVE-2020-12803

slide-29
SLIDE 29

Content Masking: OOXML

29

slide-30
SLIDE 30

Content Masking: ODF

30

Parsed by MS Office Parsed by LibreOffice

slide-31
SLIDE 31

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure 5. Data Manipulation 6. Code Execution

 Macros

7. Evaluation

24

Overview

slide-32
SLIDE 32

Macros

32

slide-33
SLIDE 33

Addition Findings

33

CVE-2018-8161 (memory corruption)

slide-34
SLIDE 34
  • We can write XML to arbitrary files
  • LibreOffice config file itself is XML

One-Click RCE in LibreOffice

34

slide-35
SLIDE 35

One-Click RCE in LibreOffice

35

CVE-2020-12803

slide-36
SLIDE 36

1. OOXML/ODF Basics 2. Denial of Service 3. Invasion of Privacy 4. Information Disclosure 5. Data Manipulation 6. Code Execution 7. Evaluation

28

Overview

slide-37
SLIDE 37

Evaluation

37

slide-38
SLIDE 38
  • Removing insecure features
  • User privacy by default
  • Limitation of resources
  • Elimination of ambiguities

Countermeasures

38

slide-39
SLIDE 39
  • OOXML and ODF are complex formats
  • Thorough analysis of dangerous features
  • One-click pure logic chain RCE in 2020 ;)

Conclusion

39

Artifacts: https://github.com/RUB-NDS/Office-Security