A. Padgett Peterson, P. E., Cissp
tarix 08.04.2018 ölçüsü 492 b. #47817
Securing Gateways Identifying/Defending E-Mail Attacks A. Padgett Peterson, P.E., CISSP Corporate Information Protection Lockheed Martin Corporation Orlando, Florida Las Vegas, 26 July, 2000 The Problem In recent months the most serious problems have been from the “Mass Mailer” viruses May take many forms Word Documents: Melissa Excel spreadsheets: Papa VBS files: Loveletter Script files: KAK Are other vectors but less common Mass Mailers From a corporate/agency standpoint, the really disruptive mechanism are those which broadcast using global address lists (GAL) potential for thousands of messages 50,000 Melissa seen 200,000 LoveLetter Mass Mailers e.g. PrettyPark uses .WAB - has no access to GAL All attacks using GAL are VB based (VBA/VBS/ActiveX) Looking Sdrawkcab Early 1998 - vendor told that inclusion of CreateObject in VBS was not a good idea Ignored as usual Russian New Year attack demonstrated capability of embedded scripting Patch issued for RNY WORD/EXCEL. Required 32 Mb download. Ignored PowerPoint. Looking Sdrawkcab - Dec 1997 discovering exactly which Whazzat ?
July 00 - Surprise http://www.microsoft.com/technet/security/bulletin/fq00-049.asp The Office HTML Script vulnerability, allows malicious script code on a web page to reference an Excel 2000 or PowerPoint file in such a way as to cause a remotely hosted file to be saved to a visiting user's hard drive. Since Then W97M/Alina.A@MM W97M/Antisocial.E@MM W97M/Bench.E@mm W97M/Buffer.A@MM W97M/MadCow@MM, WM97/Melissa-D@MM (over 50 Melissas now) W97M/Cobra.F@MM W97M/Evolution.E@MM W97M/Jany.B@MM W97M/Lucia.A@MM W97M/Nail.B@MM W97M/Ping.B@MM W97M/Prilissa.A@MM etc, etc, etc What is the common factor ? ALL use CreateObject Are other possible constructs GetObject (must preexist) CreateTextObject (using executable ASCII) GetTextObject and one more we’ll mention later but not many Gateway Factor “Block all Scripting” something about a baby and a bath ? “Block all executables” care to be a bit more specific: ??_ AD? ASP BAS BAT BIN CDR CHM CMD COM CPL CRT CSC DEV DL? DO? EXE GMS GZ? HLP HT? IM? INI INS ISP JS? MD? MPP MPT MS? OBD OBT OCX OLE OV? PCD POT PP? RTF SCR SCT SHS SMM SYSVB? VS? VXD WBK WPD WS? XL? XML XTP More Appropriate Allow only permitted extensions Block anything but allows “safe” scripting & VBS At Desktop Vendor has 8 Mb patch (2 Mb 2000) Affects many elements http://support.microsoft.com/support/kb/articles/Q262/6/18.asp Does seem to work well with today’s problems, but what about tomorrow ? Executable written to TEMP directory prior to screen popup exploit already being discussed At Desktop Best answer probably Integrity Manager/Behavior blocker no updates required unless new mechanism discovered If network application tries to write to disk, or execute local file, ask first That other construct CLSID essentially a call to an internal element generally one marked “safe for scripting” and shouldn’t be may allow creation/writes without “CreateObject” method used by BubbleBoy/KAK shouldn’t be in a script anyway Conclusions Gateways filters need to be developed that are both specific and granular need to be able to apply/reconfigure immediately (vendors often lag by several hours) library of special filters needs to be developed commitment from gateway for immediate action specific line of authority to direct filters consided “approved” attachments rather than bad Conclusions II Gateways can use multiple products - is a good idea re: scanners choose defensible points and ones that can be reconfigured quickly. Desktop Integrity Management/Behavior Blockers may be more appropriate slow updates very large numbers Thank you Questions ? A. Padgett Peterson, P.E., CISSP padgett.peterson@lmco.com Dostları ilə paylaş:
