Onderwerp: security enforcement - new monitor for winnt

i want to stop ie:
writing EXE/CAB/LNK ... files,
calling MSHTA.EXE to parse remote web pages,
accessing files outside "favorites" and cache("content.ie5").

i want to stop WSCRIPT.EXE from parsing files inside TEMP and cache.

i want to stop the system running executable files located in TEMP and cache.

afaik, i can stop ie 0day exploits by doing these things.

so, i made this:
http://umbrella.name/winblox/
of course, free. and you can define your own rules easily(assuming you guys know a bit about regular expression).

it's totally a new idea(afaik). so, not for operational uses.

Please take a look at:
http://www.heise.de/ct/ftp/projekte/iecontroller/

Its open source and seems to do the same thing.

----- Original Message -----
From: "Liu Die Yu" <liudieyuinchina@yahoo.com.cn>
To: <bugtraq@securityfocus.com>
Sent: Tuesday, March 30, 2004 6:34 AM
Subject: security enforcement - new monitor for winnt


>
>
> i want to stop ie:
> writing EXE/CAB/LNK ... files,
> calling MSHTA.EXE to parse remote web pages,
> accessing files outside "favorites" and cache("content.ie5").
>
> i want to stop WSCRIPT.EXE from parsing files inside TEMP and cache.
>
> i want to stop the system running executable files located in TEMP and
cache.
>
> afaik, i can stop ie 0day exploits by doing these things.
>
> so, i made this:
> http://umbrella.name/winblox/
> of course, free. and you can define your own rules easily(assuming you
guys know a bit about regular expression).
>
> it's totally a new idea(afaik). so, not for operational uses.
>

<!--

afaik, i can stop ie 0day exploits by doing these things.

so, i made this:

http://umbrella.name/winblox/

of course, free.

-->

This is fantastic. A truly useful effort for the benefit of the
so-called "security community". And free. And from security
expert who actually finds new and imaginative full and complete
remote compromises and other goodies against the ubiquitous mass
produced products from 'Microsoft'. Perhaps others out there
can contribute to Liu Die Yu's most generous efforts and develop
this free utility even further for the good of the so-
called "security community". There really is no need for anyone
to spend a nickel to achieve any of this. For example, securing
the 'My Computer' zone requires nothing more than a .reg entry
to allow the same security settings in Internet Explorer to be
revealed, there's even a 'Microsoft' KB article showing how to
do that. For free !:


http://support.microsoft.com/?kbid=315933


I take it you will be at the Gartner Symposium/Itxpo 2004.


--
http://www.malware.com

i've downloaded iecontroller and checked the app.

no, they do not do the same thing:
iecontroller can monitor ie's network activities(the "Internet" tab), but winblox can't.
iecontroller can monitor ie's activex(the "ActiveX" tab), but winblox cannot.
iecontroller is designed for protecting ie(*ie*controller), but winblox is not.
(winblox can monitor all applications which load USER32.DLL)
iecontroller cannot monitor commandline, but winblox can.

of course, i don't expect a single monitor to monitor all things :-P

most importantly, i believe a monitor must have:
console-mode config tool,
text config file,
and log file,
just like all linux daemons(for flexiblity), but iecontroller does not have such features yet.

btw, source code will be published soon.

best wishes,

--- Amir Mohammadkhani-Aminabadi <amir.mohammadkhani@einsurance.de> wrote:
> Please take a look at:
> http://www.heise.de/ct/ftp/projekte/iecontroller/
>
> Its open source and seems to do the same thing.
>
> ----- Original Message -----
> From: "Liu Die Yu" <liudieyuinchina@yahoo.com.cn>
> To: <bugtraq@securityfocus.com>
> Sent: Tuesday, March 30, 2004 6:34 AM
> Subject: security enforcement - new monitor for winnt
>
>
> >
> >
> > i want to stop ie:
> > writing EXE/CAB/LNK ... files,
> > calling MSHTA.EXE to parse remote web pages,
> > accessing files outside "favorites" and cache("content.ie5").
> >
> > i want to stop WSCRIPT.EXE from parsing files inside TEMP and cache.
> >
> > i want to stop the system running executable files located in TEMP and
> cache.
> >
> > afaik, i can stop ie 0day exploits by doing these things.
> >
> > so, i made this:
> > http://umbrella.name/winblox/
> > of course, free. and you can define your own rules easily(assuming you
> guys know a bit about regular expression).
> >
> > it's totally a new idea(afaik). so, not for operational uses.
> >
>
>
>


__________________________________
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
http://taxes.yahoo.com/filing.html

exploitable buffer overflow when attacker can supply arbitrary data to CreateFileW.

thanks for pointing it out.

i'll fix it and make winblox open-source later tonight(many other guys suggested me to do this
also).

you can surely find more when you have source code. please publish all of them - we must fix all
asap, before operational uses.

best wishes,

die

--- Oliver Lavery <olavery@pivx.com> wrote:
>
> Liu Die Yu, are you sure you don't want to be calling _snprintf
> here? And since CreateFileW can be called with a 32,767 byte file name,
> I'm not sure what'll happen when you stuff it into a 200 byte buffer when
> it's converted to multi-byte... Call me crazy, but I'd be a little hesitant
> to run this in a production environment (even though it's at version 6.0)
>
> Microsoft doesn't have a monopoly on buggy code with B0fs in it.
>
> This is a good idea though, hooking is neat. I'm not so sure I'd say
> it's unprecedented. Using AppInit_DLLs to load a hook DLL is a pretty common
> trick. Still, a nice hack.
>
> .text:10001AEB ; int __stdcall My_CreateFileW(LPCWSTR
> lpWideCharStr,int,int,int,int,int,int)
> .text:10001AEB public My_CreateFileW
> .text:10001AEB My_CreateFileW proc near ; DATA XREF:
> DllMain(x,x,x)+47o
> .text:10001AEB ; DllMain(x,x,x)+75o
> .text:10001AEB
> .text:10001AEB var_CD0 = byte ptr -0CD0h
> .text:10001AEB var_8D0 = dword ptr -8D0h
> .text:10001AEB var_8CC = dword ptr -8CCh
> .text:10001AEB MultiByteStr = byte ptr -8C8h
> .text:10001AEB Text = byte ptr -800h
> .text:10001AEB lpWideCharStr = dword ptr 8
> .text:10001AEB arg_4 = dword ptr 0Ch
> .text:10001AEB arg_8 = dword ptr 10h
> .text:10001AEB arg_C = dword ptr 14h
> .text:10001AEB arg_10 = dword ptr 18h
> .text:10001AEB arg_14 = dword ptr 1Ch
> .text:10001AEB arg_18 = dword ptr 20h
> .text:10001AEB
> .text:10001AEB push ebp
> .text:10001AEC mov ebp, esp
> .text:10001AEE sub esp, 0CD0h
> .text:10001AF4 mov [ebp+var_8D0], 0
> .text:10001AFE call sub_100012EF ; _reg
> .text:10001B03 test eax, eax
> .text:10001B05 jnz loc_10001C42
> .text:10001B0B lea eax, [ebp+var_CD0]
> .text:10001B11 push eax
> .text:10001B12 mov ecx, [ebp+arg_4]
> .text:10001B15 push ecx
> .text:10001B16 call sub_10001383
> .text:10001B1B push 0 ; lpUsedDefaultChar
> .text:10001B1D push 0 ; lpDefaultChar
> .text:10001B1F push 0C8h ; cchMultiByte
> .text:10001B24 lea edx, [ebp+MultiByteStr]
> .text:10001B2A push edx ; lpMultiByteStr
> .text:10001B2B push 0FFFFFFFFh ; cchWideChar
> .text:10001B2D mov eax, [ebp+lpWideCharStr]
> .text:10001B30 push eax ; lpWideCharStr
> .text:10001B31 push 0 ; dwFlags
> .text:10001B33 push 0 ; CodePage
> .text:10001B35 call ds:WideCharToMultiByte
> .text:10001B3B mov [ebp+Text], 0
> .text:10001B42 lea ecx, [ebp+MultiByteStr]
> .text:10001B48 push ecx
> .text:10001B49 lea edx, [ebp+var_CD0]
> .text:10001B4F push edx
> .text:10001B50 call ds:GetCommandLineA
> .text:10001B56 push eax
> .text:10001B57 call sub_100010C9
> .text:10001B5C push eax
> .text:10001B5D push offset aCreatefileSSSS ;
> "CreateFile:%s > %s ==> %s --> %s"
> .text:10001B62 lea eax, [ebp+Text]
> .text:10001B68 push eax
> .text:10001B69 call _sprintf
> .text:10001B6E add esp, 18h
> .text:10001B71 mov [ebp+var_8D0], 0
> .text:10001B7B jmp short loc_10001B8C
>
> Cheers,
> ~x
>
>
> > -----Original Message-----
> > From: Liu Die Yu [mailto:liudieyuinchina@yahoo.com.cn]
> > Sent: March 29, 2004 11:35 PM
> > To: bugtraq@securityfocus.com
> > Subject: security enforcement - new monitor for winnt
> >
> >
> >
> >
> > i want to stop ie:
> >
> > writing EXE/CAB/LNK ... files,
> >
> > calling MSHTA.EXE to parse remote web pages,
> >
> > accessing files outside "favorites" and cache("content.ie5").
> >
> >
> >
> > i want to stop WSCRIPT.EXE from parsing files inside TEMP and cache.
> >
> >
> >
> > i want to stop the system running executable files located in
> > TEMP and cache.
> >
> >
> >
> > afaik, i can stop ie 0day exploits by doing these things.
> >
> >
> >
> > so, i made this:
> >
> http://umbrella.name/winblox/
>
> of course, free. and you can define your own rules easily(assuming you guys
> know a bit about regular expression).
>
>
>
> it's totally a new idea(afaik). so, not for operational uses.
>
> ---
> Incoming mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.605 / Virus Database: 385 - Release Date: 01/03/2004
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.605 / Virus Database: 385 - Release Date: 01/03/2004
>
>


__________________________________
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
http://taxes.yahoo.com/filing.html

Liu Die Yu, are you sure you don't want to be calling _snprintf
here? And since CreateFileW can be called with a 32,767 byte file =
name,
I'm not sure what'll happen when you stuff it into a 200 byte buffer =
when
it's converted to multi-byte... Call me crazy, but I'd be a little =
hesitant
to run this in a production environment (even though it's at version =
6.0)

Microsoft doesn't have a monopoly on buggy code with B0fs in it.

This is a good idea though, hooking is neat. I'm not so sure I'd say
it's unprecedented. Using AppInit_DLLs to load a hook DLL is a pretty =
common
trick. Still, a nice hack.

..text:10001AEB ; int __stdcall My_CreateFileW(LPCWSTR
lpWideCharStr,int,int,int,int,int,int)
..text:10001AEB public My_CreateFileW
..text:10001AEB My_CreateFileW proc near ; DATA XREF:
DllMain(x,x,x)+47=19o
..text:10001AEB ; =
DllMain(x,x,x)+75=19o
..text:10001AEB=20
..text:10001AEB var_CD0 =3D byte ptr -0CD0h
..text:10001AEB var_8D0 =3D dword ptr -8D0h
..text:10001AEB var_8CC =3D dword ptr -8CCh
..text:10001AEB MultiByteStr =3D byte ptr -8C8h
..text:10001AEB Text =3D byte ptr -800h
..text:10001AEB lpWideCharStr =3D dword ptr 8
..text:10001AEB arg_4 =3D dword ptr 0Ch
..text:10001AEB arg_8 =3D dword ptr 10h
..text:10001AEB arg_C =3D dword ptr 14h
..text:10001AEB arg_10 =3D dword ptr 18h
..text:10001AEB arg_14 =3D dword ptr 1Ch
..text:10001AEB arg_18 =3D dword ptr 20h
..text:10001AEB=20
..text:10001AEB push ebp
..text:10001AEC mov ebp, esp
..text:10001AEE sub esp, 0CD0h
..text:10001AF4 mov [ebp+var_8D0], 0
..text:10001AFE call sub_100012EF ; _reg
..text:10001B03 test eax, eax
..text:10001B05 jnz loc_10001C42
..text:10001B0B lea eax, [ebp+var_CD0]
..text:10001B11 push eax
..text:10001B12 mov ecx, [ebp+arg_4]
..text:10001B15 push ecx
..text:10001B16 call sub_10001383
..text:10001B1B push 0 ; =
lpUsedDefaultChar
..text:10001B1D push 0 ; lpDefaultChar
..text:10001B1F push 0C8h ; cchMultiByte
..text:10001B24 lea edx, [ebp+MultiByteStr]
..text:10001B2A push edx ; lpMultiByteStr
..text:10001B2B push 0FFFFFFFFh ; cchWideChar
..text:10001B2D mov eax, [ebp+lpWideCharStr]
..text:10001B30 push eax ; lpWideCharStr
..text:10001B31 push 0 ; dwFlags
..text:10001B33 push 0 ; CodePage
..text:10001B35 call ds:WideCharToMultiByte
..text:10001B3B mov [ebp+Text], 0
..text:10001B42 lea ecx, [ebp+MultiByteStr]
..text:10001B48 push ecx
..text:10001B49 lea edx, [ebp+var_CD0]
..text:10001B4F push edx
..text:10001B50 call ds:GetCommandLineA
..text:10001B56 push eax
..text:10001B57 call sub_100010C9
..text:10001B5C push eax
..text:10001B5D push offset aCreatefileSSSS ;
"CreateFile:%s > %s =3D=3D> %s --> %s"
..text:10001B62 lea eax, [ebp+Text]
..text:10001B68 push eax
..text:10001B69 call _sprintf
..text:10001B6E add esp, 18h
..text:10001B71 mov [ebp+var_8D0], 0
..text:10001B7B jmp short loc_10001B8C

Cheers,
~x


> -----Original Message-----
> From: Liu Die Yu [mailto:liudieyuinchina@yahoo.com.cn]=20
> Sent: March 29, 2004 11:35 PM
> To: bugtraq@securityfocus.com
> Subject: security enforcement - new monitor for winnt
>=20
>=20
>=20
>=20
> i want to stop ie:
>=20
> writing EXE/CAB/LNK ... files,
>=20
> calling MSHTA.EXE to parse remote web pages,
>=20
> accessing files outside "favorites" and cache("content.ie5").
>=20
>=20
>=20
> i want to stop WSCRIPT.EXE from parsing files inside TEMP and cache.
>=20
>=20
>=20
> i want to stop the system running executable files located in=20
> TEMP and cache.
>=20
>=20
>=20
> afaik, i can stop ie 0day exploits by doing these things.
>=20
>=20
>=20
> so, i made this:
>=20
http://umbrella.name/winblox/

of course, free. and you can define your own rules easily(assuming you =
guys
know a bit about regular expression).



it's totally a new idea(afaik). so, not for operational uses.=20

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.605 / Virus Database: 385 - Release Date: 01/03/2004
=20

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.605 / Virus Database: 385 - Release Date: 01/03/2004
=20