IE5 Users: Beware [Archive] - FutureQuest Community

Terra

09-23-1999, 06:43 PM

<<Reprinted in Entirety from BUGTRAQ>>
>From owner-bugtraq@SECURITYFOCUS.COM Wed Sep 22 18:44:38 1999
--private--
Approved-By: aleph1@SECURITYFOCUS.COM
Delivered-To: bugtraq@lists.securityfocus.com
Received: from securityfocus.com (securityfocus.com [207.126.127.66]) by
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]lists.securityfocus.com (Postfix) with SMTP id 8DCF31EE87 for
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]<a href="mailto:bugtraq@lists.securityfocus.com>;"<a">bugtraq@lists.securityfocus.com>;"<a</a> href="mailto:>bugtraq@lists.securityfocus.com>;">>bugtraq@lists.securityfocus.com>;</a>"><bugtraq@lists.securityfocus.c-om>; Tue, 21 Sep 1999 19:35:20 -0700
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp](PDT)
Received: (qmail 29571 invoked by alias); 22 Sep 1999 02:35:20 -0000
Delivered-To: BUGTRAQ@SECURITYFOCUS.COM
Received: (qmail 29564 invoked from network); 22 Sep 1999 02:35:19 -0000
Received: from m5.andara.com <a href="mailto:root@24.222.0.5)"<a">root@24.222.0.5)"<a</a> href="mailto:>root@24.222.0.5)">>root@24.222.0.5)</a>">(root@24.222.0.5) by securityfocus.com with SMTP;
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]22 Sep 1999 02:35:19 -0000
Received: from hfx.andara.com (s9n185.hfx.andara.com [24.222.9.185]) by
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]M5.andara.com (8.9.3/8.9.3) with ESMTP id XAA13937 for
[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]<a href="mailto:BUGTRAQ@SECURITYFOCUS.COM>;"<a">BUGTRAQ@SECURITYFOCUS.COM>;"<a</a> href="mailto:>BUGTRAQ@SECURITYFOCUS.COM>;">>BUGTRAQ@SECURITYFOCUS.COM>;</a>"><BUGTRAQ@SECURITYFOCUS.COM>; Tue, 21 Sep 1999 23:35:00 -0300 (ADT)
X-Mailer: Mozilla 4.61 [en] (Win95; U)
X-Accept-Language: ja,en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID:[nbsp][nbsp]<a href="mailto:37E8401A.4EFFF12E@hfx.andara.com>"<a">37E8401A.4EFFF12E@hfx.andara.com>"<a</a> href="mailto:>37E8401A.4EFFF12E@hfx.andara.com>">>37E8401A.4EFFF12E@hfx.andara.com></a>"><37E8401A.4EFFF12E@hfx.andara.-com>
Date:[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] Tue, 21 Sep 1999 23:34:02 -0300
Reply-To: "Charles D. O'Dale" <a href="mailto:codale@HFX.ANDARA.COM>"<a">codale@HFX.ANDARA.COM>"<a</a> href="mailto:>codale@HFX.ANDARA.COM>">>codale@HFX.ANDARA.COM></a>"><codale@HFX.ANDARA.COM>
Sender: Bugtraq List <a href="mailto:BUGTRAQ@SECURITYFOCUS.COM>"<a">BUGTRAQ@SECURITYFOCUS.COM>"<a</a> href="mailto:>BUGTRAQ@SECURITYFOCUS.COM>">>BUGTRAQ@SECURITYFOCUS.COM></a>"><BUGTRAQ@SECURITYFOCUS.COM>
From: "Charles D. O'Dale" <a href="mailto:codale@HFX.ANDARA.COM>"<a">codale@HFX.ANDARA.COM>"<a</a> href="mailto:>codale@HFX.ANDARA.COM>">>codale@HFX.ANDARA.COM></a>"><codale@HFX.ANDARA.COM>
Subject:[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]IE5 Automated format of HD, no ActiveX required
X-To:[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM

Hi all,

Back in July, I discovered a simple way in which a user's hard drive may
be unexpectedly formatted via the World Wide Web using the Internet
Explorer web browser -- no ActiveX required.[nbsp][nbsp]Microsoft was contacted
many times via Secure@microsoft.com but would not acknowledge the
difficulty as a problem (part of the e-mail exchange is re-printed
below).[nbsp][nbsp]As it has been over two months since this potential nightmare
was pointed out to them, and as no solution has been forthcoming, I'm
hoping that you folks might be able to come up with a simple client-side
answer to this problem before some vandal discovers it and decides to
implement it on a large scale.

To summarize:

This attack involves uploading a .bat or .pif file (for the Format
command) and linking it via html to a standard web page.[nbsp][nbsp]Once this link
is clicked and the user agrees to 'Open' the file presented, a process
will be started -- without prompting from the user -- to format the
user's hard drive.

The key is the Format command's "/autotest" flag, which I believe was
put into place early on in MS-DOS's history to assist in batch
processing, and was probably dropped from the documentation some time
back (it's not in my DOS 5.0 manual as far as I can tell -- although
that's not too far in the past).[nbsp][nbsp]It can be tested for by entering:
"Format a: /autotest" at the MS-DOS C:\ prompt.

The automated format via web page can be accomplished as follows (with
the example shown demonstrating how to create a link on a web page which
will automatically format Drive A):

1)[nbsp][nbsp] Either:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] Create a .pif file ("Format.pif") with the Command Line set to:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] "C:\WINDOWS\COMMAND\FORMAT.COM a: /autotest"

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]And Working Line set to:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] "C:\WINDOWS\COMMAND"

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]Or:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]Create a .bat file ("Format.bat") with a single command:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] "format a: /autotest"

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp][nbsp](Should the user wish to format another disk, the a: may be
replaced with c:, d:, e:, etc.)

2)[nbsp][nbsp]Link to the file on a web page as follows:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp]<a href="Format.pif">Click Me</a>

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] Or:

[nbsp][nbsp][nbsp][nbsp][nbsp][nbsp] <a href="Format.bat">Click Me</a>

[nbsp][nbsp][nbsp][nbsp] According to the method chosen for implementation in step 1.[nbsp][nbsp]These
links may be placed beneath graphics or text, as would be found on a
regular web page.

3)[nbsp][nbsp]Upload the html document and .pif or .bat file to the targetted web
server directory and wait for an unwary user to click the link and
'Open'.

Spooky, eh?

These steps don't create a Trojan Horse so much as an out-right "Cyber
Mine" which will be activated on a user's machine the instant they click
the link and accept the file into their system.[nbsp][nbsp]As the download of the
< 1k file is almost instantaneous, damage will be made to the user's
data in a matter of seconds.

The nasty kicker to this particular operation is the "/autotest" flag,
which automatically activates the command preceeding it (in this case,
the malicious Format) without requiring an acknowledgement from the
user.[nbsp][nbsp]Although the user will be prompted to either 'Save' or 'Open' the
file before any damage can be done, it is easy to see how a trusted web
site, compromised by a malicious cracker and mined in the manner
described above, could deliver this damaging bomb:

-----

Reading a trusted web page, the unwary user would click the mined link
and accept the file into their system.[nbsp][nbsp]Given a suitable name, such as
'Business_Plan.bat' or 'Secure.pif', it's reasonable to expect an
average user to choose 'Open' when reading this file, as they would
normally be provided with an option to save or discard the document at a
later time and so have it held -- relatively harmlessly -- in memory.
However, with the mined link, an automated format would be started
instead.

-----

Unfortunately, given the frequency with which web pages are vandalized
these days, it's not unreasonable to expect a malicious link of this
nature being installed on a high-traffic web site at some point in the
future.[nbsp][nbsp]Should a few hours pass before the incident is discovered (if
the vandal leaves the page cosmetically intact, the 'cyber mined' .pif
or .bat files (being only 1 k in size) would remain well hidden), a
great deal of damage could be done to the systems of visiting users
without them quite understanding how or why the damage occurred.

There may be other attacks through this hole made possible by linking to
different C:\Windows\Command files and I believe it may also be
activated through various e-mail applications which permit html encoding
-- making for one nasty Melissa-type e-mail!

Of course, the user DOES have to choose 'Open' to activate the script,
so this isn't necessarily operating outside of the expected bounds of
operation for the Internet Explorer web browser.[nbsp][nbsp]However, given the
unforgiving consequences a user would face for unexpectedly 'Opening'
one of these malicious files off of a trusted web page or from one's
e-mail, the "/autotest" flag might prove to be a feature which deserves
early retirement.

Now, for <a href="mailto:Secure@microsoft.com"<a">Secure@microsoft.com"<a</a> href="mailto:>s">Secure@microsoft.com">>s">Secure@microsoft.com</a>">s"<a <a href="mailto:href="mailto:>Secure@microsoft.com">>Secure@microsoft.com</a>">s">Secure@microsoft.com'href="mailto:>Secure@microsoft.com">>Secure@microsoft.com">s">Secure@microsoft.com">s">href="mailto:>Secure@microsoft.com">>Secure@microsoft.com</a>">s">Secure@microsoft.com</a>'s</a> response:

-----8<----------8<----------8<----------8<----------8<----------8<----------8<----------8<-----

Return-Path: <a href="mailto:secure@microsoft.com>"<a">secure@microsoft.com>"<a</a> href="mailto:>secure@microsoft.com>">>secure@microsoft.com></a>"><secure@microsoft.com>
Received: from mail5.microsoft.com (mail5.microsoft.com [131.107.3.121])
by M5.andara.com
(8.9.3/8.9.3) with SMTP id AAA02662 for <a href="mailto:codale@hfx.andara.com>;"<a">codale@hfx.andara.com>;"<a</a> href="mailto:>codale@hfx.andara.com>;">>codale@hfx.andara.com>;</a>"><codale@hfx.andara.com>; Thu, 29
Jul 1999 00:05:17
-0300 (ADT)
Received: from 157.54.9.108 by mail5.microsoft.com (InterScan E-Mail
VirusWall NT); Wed, 28
Jul 1999 20:02:37 -0700 (Pacific Daylight Time)
Received: by INET-IMC-05 with Internet Mail Service (5.5.2524.0) id
<PWW6Z726>; Wed, 28 Jul
1999 20:02:37 -0700
Message-ID: <D1A11CCE78ADD111A35500805FD43F5801979296@RED-MSG-04>
From: Microsoft Product Security Response Team <a href="mailto:secure@microsoft.com>"<a">secure@microsoft.com>"<a</a> href="mailto:>secure@microsoft.com>">>secure@microsoft.com></a>"><secure@microsoft.com>
To: "'Charles O'Dale'" <a href="mailto:codale@hfx.andara.com>"<a">codale@hfx.andara.com>"<a</a> href="mailto:>codale@hfx.andara.com>">>codale@hfx.andara.com></a>"><codale@hfx.andara.com>
Subject: RE: Automated Disk Format via Browser
Date: Wed, 28 Jul 1999 20:02:36 -0700
X-Mailer: Internet Mail Service (5.5.2524.0)
X-Mozilla-Status: 8013
X-Mozilla-Status2: 00000000
X-UIDL: b74162acb7b26c38ff7f97cefd509df4

Ah, now I understand![nbsp][nbsp]The problem is in the dialogue box.[nbsp][nbsp]By "open" we
mean that we'll take whatever action on the file that a double-click
would cause.[nbsp][nbsp]For documents, we open the file.[nbsp][nbsp]For executables and
batch files, we run them.

IE is doing what it should, but it sounds like our dialogue box could
use some rewording.[nbsp][nbsp]I hadn't considered that the meaning of the "open"
selection might not be clear to everyone, but I can certainly see why it
would be confusing.

I'll take this issue up with the IE team, and suggest that we reword
this dialogue in a future version.[nbsp][nbsp]Meantime, it sounds like IE security
is working fine, it's just our English that needs work.[nbsp][nbsp]Thanks very
much for taking the time to write!

Secure@microsoft.com

-----8<----------8<----------8<----------8<----------8<----------8<----------8<----------8<-----

Well, that's the solution I was offered.

Doesn't an application have to be registered in IE with its own MIME
type before it can be activated straight from a link?[nbsp][nbsp]If an executable
(.exe) file is linked, IE prompts the user with an Authenticode(tm)
dialog, warning the user that the .exe has not been digitally signed.
This adds a level of security.

However, with a .bat or .pif file, the file is executed from within the
browser once it is 'Opened'.[nbsp][nbsp]In the case of the example given, this
activates a format of the user's disk without warning.

Wouldn't it be prudent to change the handling of .bat and .pif files
such that they're either displayed to the screen as text (as with
Netscape Navigator / Communicator) or are treated with the same level of
security as an .exe?[nbsp][nbsp]I cannot think of a case where a user would want
to have a batch file (or .pif linked command) activated on their machine
from a remote location via web browser.

Could anyone propose a defense to a stealthy attack of this sort?

Thanks,

Charles D. O'Dale
Halifax, Nova Scotia
codale@hfx.andara.com

--
Terra
--Scary, eh?--
FutureQuest

PS: One possible solution is to rename your 'format' or 'fdisk' to like 'format-findme' or 'fdisk-lockdown'
[This message has been edited by ccTech (edited 09-23-99)]

Dean B

09-23-1999, 07:05 PM

HOLY FAQ !

I knew there was a reason I use Nutscrape ...

Dean.
--- Instant fix = NT disk administrator.[nbsp][nbsp]C drive ? wot C drive ? ;)[nbsp][nbsp]---
[This message has been edited by Dean B (edited 09-23-99)]

Jacob Stetser

09-23-1999, 07:56 PM

--- Instant fix = Mac OS.**C drive ? wot C drive ? **---

;)[nbsp][nbsp][nbsp]
------------------
icongarden.com/?fq (http://icongarden.com/?fq)
icongarden: making good ideas grow.

Ron

09-23-1999, 08:09 PM

Instant fix = rename all dangerous commands (ren format.exe myformat.exe) when the system is installed - which everyone should be doing any way...

Justin

09-23-1999, 08:44 PM

Here's one for you:

I open up VB 5, for which anyone w/Windows 98 has the run times (or use VC++ or Delphi etc). I write about 3 lines of code that calls an API function to format the hard disk (no DOS box needs to pop up). I compile the EXE and rename it to .SCR - a screen saver. Less than 2k in size (and MUCH more dangerous than any .DOC file).

Now, all you have to do is select the file in your display properties - you don't even have to click Settings or Preview - voila - all the free space on your C: drive you'll ever need :) I could also do an enum on all your drives and take them all out while I'm at it...

Just beware that screen savers in Windows are simply EXE files under a different name, and are just as potentially harmful...

Also note that an ActiveX control runs under the same basic principals - it's an executable file, and can access the Win32 API and cause all the havoc it wants. And it doesn't take much to have it "digitally signed" etc...

Better than a format - how about we destroy the registry, as well as all backups of it? Note - registry backups are logged (it's backed up every time you boot up), and are quite easily deleted before wiping the current registry. This wouldn't work on NT, however, as there are security "rules" in place on the registry in NT. You could also have a backup on a floppy/ZIP drive... but most people don't...

Are you prepared? ;)

HTH

------------------
Justin Nelson
FutureQuest Support

SneakyDave

09-24-1999, 03:33 PM

Coulnd't this malicious .bat file just rename your win.exe file? It wouldn't necessarily cause much "damage", but to someone that didn't know what was going on, it could be potentially pretty dangerous. Maybe it wouldn't work while Windows was running, but I could see just as much trouble happening if a non-popular, but required, file was renamed in your WINDOWS directory.

Leigh

09-24-1999, 04:25 PM

Thanks so much for the further explanation Justin.[nbsp][nbsp]I think perhaps I have been a little too trusting with things on the net and it is now time to tighten up a bit.[nbsp][nbsp]So long to that "it can't happen to me" attitude.[nbsp][nbsp]Sigh.

Leigh

Justin

09-24-1999, 08:09 PM

it can't happen to me
LOL - well, I used to think that... and believe me, I STILL hear about it almost daily...

Never open "happy99.exe"... ;)

------------------
Justin Nelson
FutureQuest Support

Leigh

09-25-1999, 12:35 AM

BTDT on the happy99.exe!!!!!![nbsp][nbsp]Have had to point out to several of our members that they have it.[nbsp][nbsp]Annoying critter...

Leigh

Leigh

09-25-1999, 01:05 AM

Forgive me, but are you guys telling me that there is something I can/should do to prevent this from happening since I too run IE5 and if so, can someone give specific instructions???? (aside from just using Netscape)

*concerned*

Leigh

Justin

09-25-1999, 01:22 AM

All this is saying is that when you click a link to a file, a box pops up. This box asks whether you want to download the file or open it.

If the file happens to be an EXE file, it gives you a warning that it may be unsafe to run an EXE file. It does not give you any warnings on a PIF, BAT, or SCR file - it's not really a "security" issue, but rather a wording issue... I guess it hadn't occurred to them that other file types can be just as harmful as an .EXE or OCX file (or DLL for that matter).

You still have to give IE permission to run the file - and in the case of a format command, I'm not sure Windows would allow the format to take place anyway, as when Windows is running certain files are locked... certainly am not going to prove this theory, but I'm pretty sure you would have to restart in "DOS Mode" to do a format...

Doing a format through the API, however, would be done without a second thought or a DOS box even popping up (such as can be done in an EXE, SCR, or OCX executable program).

The point of all of this, I guess, is just be careful what you let happen when you click a file download - never choose "Open" or "Run from current location" (as IE4 called it) unless you know what the file is (MID, WAV, MP3, etc are fine, just never do this to an EXE, DLL, OCX, or SCR).

Hope this helps.

------------------
Justin Nelson
FutureQuest Support