hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015Object corruptionFor example, the CVE-2014-1761 exploit in the wild corrupted an object created fromGFX.dll. The method corrupted is related to a graphical object and is called constantly witha short interval of time between each call. This allows the attacker’s code to executeimmediately following the corruption of the vtable of the object.Another example exploit used CVE-2014-0515 and involved corrupting multiple objects,including the vector object and FileReference object. Vector object exploitation uses a bufferoverflow vulnerability resulting in an abnormally large field value length. This allows theattacker to access a vast range of memory freely from the script.Some IE exploits also used a similar technique to defeat ASLR and DEP. The exploit code forCVE-2014-1776 used a maliciously constructed SWF file to load Flash Player-related modulesand setup memory containing vector objects. The UAF vulnerability may be used to overwrite2 bytes of memory at an arbitrary location. By corrupting the first 2 bytes of the vector object,which is used as a length field, the exploit will gain the ability to access broader read and writememory space through the vector object.Code reuse attackAfter acquiring out-of-bounds memory read/write access, the exploit would corrupt anotherobject’s vtable, reusing existing code fragments from loaded DLLs to defeat ASLR. For example,the exploit code for CVE-2014-0515 uses a fake FileReference function table to run code fromthe existing location of the Adobe Flash Player executable location.With fake function table setup, the exploit code calls the related method, “cancel.” This passesthe execution to a location the attacker designates. This becomes interesting when the locationto which the control flow is passed is inside the Adobe Flash Player executable itself.The function calls other functions that in turn call VirtualProtect to add an executable bit tothe designated memory region. This is a very sophisticated way of defeating DEP—not exactlyreturn-oriented programming (ROP), but a type of code-reuse attack.It is possible to use ROP to defeat DEP and is the more traditional approach. CVE-2014-1776exploit code used ROP; after first acquiring read and write access to the full process memoryarea, it sets up the ROP code. When the ROP code is running, it adds an executable bit to theshellcode area that follows the ROP code.Rise of legacy code vulnerabilitiesDeprecated featuresVulnerabilities found in legacy code were also a significant factor in 2014. CVE-2014-0515was a vulnerability in the Pixel Bender feature of Adobe Flash Player. The feature is officiallydeprecated, but the code remains in the executable. We noted that the DWORD value at offset0xEA of Pixel Bender data was responsible for triggering the vulnerability.The metadata of defaultValue is intended to be just 4 bytes long, but the code tries to convertall 16 arguments and put them in the memory array, incurring a memory corruption error.The original binary data is parsed and translated into a bytecode that is later used for furtheroperations. The second value from the defaultValue argument overwrites the index value insidethe SEL instruction’s byte code in memory.Based on the nature of the issue and the age of the code, we suspect that this vulnerability wasfound using dumb fuzzing that replaced random bytes in the target sample file. The bug itselfappeared very old and was likely present from the earliest versions of the Pixel Bender feature;now, even though the feature is no longer supported, the flaw may still hurt the security ofthe products.16