PocketPC exploitation

[Jose Morales]

I would like to contribute to the list a paper i just had published that
discusses the vulnerabilities of current virus detectors for pocket pc's, it
is scary to think that such simplistic detectors are the current state of
the art for such powerfull devices, it leads one to think that the lessons
of the past have not been learned, feedback on the paper is appreciated and
welcomed, i hope it helps those interested in this area of research feel
free to contact me. I should be presenting the paper at the workshop on
software security assesment tools, tactics and metrics in long beach
california in early november in conjunction with the automated software
engineering conference. the paper can be downloaded at

http://www.cs.fiu.edu/~jmora009/

Jose.


************************************************** ******************************************
Jose Andre Morales
Computer Specialist
Master of Science in Computer Science, FIU 2004
Email: jose@onestopearth.com
************************************************** ******************************************



From: Nicolas RUFF <nicolas.ruff@gmail.com>
To: "Vuln-Dev@Securityfocus. Com" <vuln-dev@securityfocus.com>
CC: Jerome Athias <jerome.athias@free.fr>
Subject: Re: PocketPC exploitation
Date: Mon, 19 Sep 2005 17:47:14 +0200
> > i would like to know if some of you have experience with exploitation of
> > PocketPCs and could give me some ways and tools (debugger...).
> > since some vulns come ( http://www.securityfocus.com/bid/13807 )
> > I know that writing a DLL (Fuser) is quite easy with eVC++ (Embedded),
> > so a "download and execute"-like shellcode could be amazing...
>
>Pointers to begin with :
>
>- Microsoft Embedded Visual C++, with on-target debugging :
>http://www.microsoft.com/downloads/details.aspx?FamilyID=1dacdb3d-50d1-41b2-a107-fa75ae960856&displaylang=en
>
>- Phrack #63 "Hacking Windows CE"
>http://www.phrack.org/phrack/63/p63-0x06_Hacking_WindowsCE.txt
>
>- And the upcoming IDA Pro 4.9 with Windows CE on-target debugging :
>http://www.datarescue.com/idabase/wince/index.htm
>
>Regards,
>- Nicolas RUFF
>Security researcher @ EADS-CCR

[Jose Morales]

Ratter, thank you for your comments, everything you say is true. Now I think
that real life experience has taught us that it is better to protect from
possible future attacks similar to those seen in the past and avoid an
outbreak then to wait for a major vx outbreak to react and protect from it
happening a second time.

Nobody wants another nimda, codered, slammer, welchia, mydoom and bagle plus
others that have cost billions in losses and productivity time plus unknown
numbers of computers rendered useless and in need of repair. the technology
exists to protect pocket pc's againts the types of viruses seen in the
desktop world it should be incorportated into current solutions as a
preemptive guard against possible future attacks. Your logic is good until
a major virus outbreak occurs on PPC and people start to complain "why wasnt
I proctected" there is no answer for it. In the hacker world some
significant articles have already come out no PPC vulnerabilities it is only
a matter of time before a major virus strike hits, the time to give better
protection for PPC is now and not after an outbreak.

As for overhead on PPC placed by better antivirus solutions, this will very
soon go away, handhelds keep being releases with bigger hard drives (upto 4
gigabytes last time i hear) more RAM more CPU power and overall better
performance, clearly the bottlenecks of current embedded system security
will very soon dissipate and in its current state they can handle stronger
AV solutions that was is currently out there.

im sure airscanner.com, norton, kaspersky avast and the others can improve
their products now given current ppc and help prevent possible major vx
outbreaks in the future.

proactive defense is better than reactive defense that is the best real life
experience we have learned from the past to help prepare for the future.

Yours in Success,

Jose.


************************************************** ******************************************
Jose Andre Morales
Computer Specialist
Master of Science in Computer Science, FIU 2004

************************************************** ******************************************


From: Ratter <ratter@atlas.cz>
Reply-To: Ratter <ratter@atlas.cz>
To: Jose Morales <jose@onestopearth.com>
CC: vuln-dev@securityfocus.com, bugtraq@securityfocus.com
Subject: Re: PocketPC exploitation
Date: Fri, 23 Sep 2005 14:34:31 +0200

JM> I would like to contribute to the list a paper i just had published that
JM> discusses the vulnerabilities of current virus detectors for pocket
pc's, it
JM> is scary to think that such simplistic detectors are the current state
of
JM> the art for such powerfull devices, it leads one to think that the
lessons
JM> of the past have not been learned, feedback on the paper is appreciated
and
JM> welcomed, i hope it helps those interested in this area of research feel
JM> free to contact me.
OK, here's the feedback. You're creating unnecessary havoc. There are
AFAIK two or three pocket PC viruses/trojans. One is done by me,
second is probably a modification of mine and third is a trojan done
by some russian writer. All are very easy nonencrypted code, so what
else than a simplistic detector you would like to have? Yes, there
exists polymorfic generator written by Vecna/29A (published in last
29A magazine) and a Dust version that uses it. But this virus is on my
disk only, it will probably never be published as I'm retired.

So the question stands - for what you want to add detection for
encrypted/polymorfic/epo/metamorfic/whatever viruses to PPC detectors,
when there is _no_ virus, that uses them? Can you see the overhead it
would cause? The antivirus size increase? The time increase spent on
detection? This really is ridiculous.

When the time comes (and it probably will come), adding advanced
detection techniques to given PPC antiviruses is a matter of very
little time, because as you say all of these techniques are relatively
well elaborated in the PC world. When there will be people out there
that will take every ITW virus/worm and modify by few bytes, then the
time comes to add more advanced scanning techniques. Now it's simply
waste of resources on both sides - antivirus companies and _mainly_
user's devices.

You have very nice equations in the paper, very academic approach, but
well, the paper lacks one thing. Real life experience.

--
Best regards,
Ratter

[Joel Maslak]

On Fri, 30 Sep 2005, Denis Jedig wrote:

> Although it is a Good Idea (tm) to uncover design deficiencies in
> current AV products, we never should forget that "antivirus" is *by
> definition* a reactive thing and thus cannot protect from unknown
> threats. If we wanted to have a *really* proactive approach, we would
> have to either ask for OS capabilities to efficiently compart
> (malicious) code or for the software manufacturers to take damn care
> when using low-level languages and introduce efficient patching
> mechanisms at last.

Once again, there is no silver bullet.

I do agree with you on AV being reactive. In fact, the need for it just
proves the pitiful state of security today. That said, I very much
disagree on your proposed "solutions".

OS capabilities? Like what? Preventing users from installing and running
applications that aren't approved by the OS vendor, the processor
manufacturer, and/or some government regulatory body? Preventing any
application from writing to the disk, accessing the network, or
interacting with the user? Who are you going to allow to make these
decisions for you, on your own machine? Or do you have a real solution
that addresses more then one specific subcategory of threat, but
doesn't remove your ability to control your own machine and to write code
to do the same?

As for low-level languages, I don't think that's the problem. Low level
languages, meaning assembly/machine languages and C-based languages, have
problems with making it easy to prevent buffer overflows - that's for
sure. And many high level languages don't have that problem. But there
are hundreds of other vectors to use to spread viruses, worms, spyware,
etc.

--
Joel