Windows Vista Network Attack Surface Analysis Dr
Total Page：16
File Type：pdf, Size：1020Kb
Windows Vista Network Attack Surface Analysis Dr. James Hoagland, Principal Security Researcher Matt Conover, Principal Security Researcher, Tim Newsham, Independent Contractor, Ollie Whitehouse, Architect Symantec Advanced Threat Research Abstract A broad analysis was performed on the network-facing components of the Microsoft Windows VistaTM release version. Our analysis explores how it affects network security and how it differs from previous versions of Microsoft Windows. Windows Vista features a rewritten network stack, which introduces a number of core behavior changes. Windows Vista also introduces a number of new protocols, most importantly IPv6, its supporting protocols, and several IPv4 to IPv6 transition protocols. As a client operating system, Windows Vista will be widely deployed and as such is an important topic for security research. We studied the following protocols and technologies: LLTD, IPv4, IPv6, Teredo, TCP, SMB2 named pipes, MS-RPC, and the Windows Firewall. We also studied ARP, NDP, IGMP, MLD, ICMPv6, and UDP. CONTENTS I Introduction 5 II Link Layer Protocols 5 II-A LinkLayerTopologyDiscoveryprotocol . ................... 5 II-B AddressResolution .............................. .............. 6 III Network Layer 7 III-A IPBehavior .................................... ............ 7 III-A.1 IPv4IDGeneration ............................ ............ 7 III-A.2 IPFragmentationReassembly . ............... 7 III-A.3 SourceRouting ............................... ........... 8 III-B IPv4andIPv6SupportedProtocols . .................. 8 III-C TeredoandOtherTunnelingProtocols . .................... 8 III-D ICMP.......................................... .......... 9 III-E IGMPandMLD.................................... .......... 10 III-F DefectTesting................................. .............. 10 IV Transport Layer 10 IV-A EphemeralPorts................................. ............. 10 IV-B TCP ............................................ ........ 10 IV-C UDP ............................................ ........ 11 V Firewall 11 V-A FirewallRules................................... ............ 11 V-B InitialState.................................... ............. 11 V-C Configuration .................................... ........... 11 V-D Discovery ....................................... .......... 12 V-E Tunneling ....................................... .......... 12 VI Network Services 12 VI-A ActiveTCPPorts ................................. ............ 12 VI-B ActiveUDPPorts ................................. ............ 13 VI-C FileSharing .................................... ............ 13 VI-D RPCServicesOverTCP ............................. ............ 14 VII Unsolicited Traffic 14 VIII Conclusion 15 IX Future Work 16 References 16 Appendix I: Test networks 19 I-A MainTestNetwork ................................. ........... 19 I-B LLTDTestNetwork................................. ........... 19 I-C TeredoTestNetwork ............................... ............ 20 Appendix II: LLTD Introduction 21 II-A Background ..................................... ........... 21 II-B LLTDProtocolOverview ........................... .............. 21 II-C LLTDSecurityModel.............................. ............. 21 Appendix III: LLTD Analysis and Findings 24 III-A VistaLLTDImplementation . ................ 24 III-B DisablingLLTDWithinVista. ................. 24 III-C TopologyMapinVista ............................ .............. 25 III-D HostswithMultipleInterfaces . ................... 25 III-E InteractionwithOtherProtocols . .................... 26 III-F PolicyControls ................................ .............. 26 III-G MapperandResponderRelationship . ................... 27 III-H GenerationandSequenceNumbers. .................. 27 III-I DeviceSuppliedImages.. .... ... .... .... .... .... ................ 28 III-J InternalXMLRepresentation . .................. 29 III-K Attack: Spoof and ManagementURL IP Redirect . .................... 29 III-L Attack:SpoofonBridge .......................... ............... 29 III-M Attack:TotalSpoof ............................. ............... 30 III-N DenialofService ............................... .............. 30 III-O QualityofServiceComponent . ................. 32 III-P OtherAttemptedTestCases . ................ 33 Appendix IV: XML Format Used by Network Map 35 Appendix V: ARP Spoofing 36 Appendix VI: Neighbor Discovery Spoofing 37 Appendix VII: IPv4 ID Generation 38 Appendix VIII: IP Fragment Reassembly 40 VIII-A FragmentationBackground . .................. 40 VIII-B FragmentationTesting Methodology . ..................... 40 VIII-B.1 IPv4Methodology. ............. 40 VIII-B.2 IPv6Methodology. ............. 41 VIII-C TestCasesandResults . ................ 41 VIII-D Analysis ..................................... ............. 44 Appendix IX: Source Routing 46 Appendix X: IPv4 Protocol Enumeration 50 Appendix XI: IPv6 Next Header Enumeration 51 Appendix XII: Teredo Introduction 52 XII-A ProtocolOverview.............................. ............... 52 XII-B TeredoSecurityImplications . ................... 54 Appendix XIII: Teredo Analysis and Findings 55 XIII-A TeredoUseUnderVista. ................ 55 XIII-B VistaTeredoComponents. ................. 56 XIII-C DefaultTeredosettings . .................. 56 XIII-D Requirements for Elevated Privileges. ....................... 56 XIII-E DisablingTeredowithinVista . ................... 57 XIII-F Disabling the Microsoft Windows Firewall Disables Teredo ...................... 57 XIII-G SettingsStorage .............................. ................ 58 XIII-H TracingCode .................................. ............. 58 XIII-I ClientServicePortSelection . .................... 58 XIII-J SecureQualification. ................. 58 XIII-K Same NonceUsed With DifferentUDP Ports . ................... 60 XIII-L PingTests .................................... ............. 60 XIII-M SourceRouting ................................ .............. 61 XIII-N UseofAddressFlagBits . ................ 61 XIII-O OtherAttemptedTestCases . ................. 62 XIII-P VistaTeredoConclusions . .................. 62 Appendix XIV: Teredo IPHLPSVC Investigation 63 XIV-A IPHLPSVC.DLLTracingOutput . ................ 63 XIV-B AddressChecksinIPHLPSVC.DLL . ................ 64 XIV-C TeredoFunctionsfromIPHLPSVC.DLL . .................. 66 Appendix XV: Historic Attacks 68 Appendix XVI: IPv6 Options 69 XVI-A RandomOptionSending . .............. 69 XVI-B OrderedOptionSending . ............... 69 Appendix XVII: Ephemeral Ports 70 Appendix XVIII: TCP Initial Sequence Number Generation 72 Appendix XIX: TCP Segment Reassembly 75 XIX-A TestData...................................... ............ 75 XIX-B Analysis ...................................... ............ 75 Appendix XX: Stack Fingerprint 76 Appendix XXI: Windows Firewall Configuration 79 XXI-A Firewallruleset ............................... ............... 79 XXI-B InitialState.................................. ............... 79 XXI-C Firewall Changes with Configuration Changes . ...................... 83 XXI-C.1 SharingandDiscoveryControls . ................ 84 XXI-C.2 PeopleNearMe ................................ .......... 85 XXI-C.3 WindowsMeetingSpace . ............ 85 XXI-D Active Socket Changes with Configuration Changes . ...................... 86 XXI-D.1 FileSharing ................................. ........... 86 XXI-D.2 SharingandDiscoveryControls . ................ 86 XXI-D.3 PeopleNearMe ................................ .......... 87 XXI-D.4 WindowsMeetingSpace . ............ 87 Appendix XXII: Exposed TCP Services 89 Appendix XXIII: Exposed UDP Services 91 Appendix XXIV: RPC Endpoint Mapper Enumeration 92 Appendix XXV: Anonymous and Authenticated Access to Named Pipes 96 XXV-A NullSessionAccesstoNamedPipes. .................. 97 XXV-B Authenticated Session Access to Named Pipes . ..................... 97 Appendix XXVI: RPC Procedure Access 99 XXVI-A Tools........................................ ............ 99 XXVI-B DirectTCPAccess .............................. .............. 99 XXVI-C NullSessionNamedPipeAccess. .................. 106 XXVI-D Authenticated Session Named Pipe Access . ..................... 107 Appendix XXVII: Transition Traffic 112 XXVII-AVistaStartingUp . ................ 112 XXVII-BVistaShuttingDown . ................ 112 XXVII-C Vista Changing Static IPv4 Addresses . ...................... 113 Appendix XXVIII: Unsolicited Traffic 115 SYMANTEC ADVANCED THREAT RESEARCH 5 I. INTRODUCTION This paper details our analysis of the Windows Vista INDOWS VistaTM is Microsoft’s long anticipated, new network stack. The following sections give an overview of W client operating system. It is due to replace Windows our research and findings. The details of our testing scope, XP as Microsoft’s premier desktop operating system. Windows testing methodology, and results are in the appendices. The Vista represents a significant departure from previous Win- information is organized by network layer. In section II we dows systems, both in terms of its emphasis on security and discuss link layer protocols. Section III covers network layer its many new features. As security has grown in importance, protocols, and section IV covers transport layer protocols. Microsoft has paid increasing attention to it, evidenced by Section V covers Windows Firewall, a component whose the significant investment of resources that has been made. design encompasses many protocol layers. Section VI covers Windows Vista