Welcome.
This is Java every day exploiting
It's an honor to be speaking to you
I'm been coming to this for a decade.
And first time speaking and I'm happy
By the looks of you, many
Hope you enjoy this tour
And you walk away
of vulnerabilities that affect Java
Zero Day.
The first thing we're going to do
Actually provided to us by the U.S.
government.
Unless it's absolutely necessary
disable it as described
will help mitigate other vulnerabilities
This came from an advisory
So the U.S.
government
the latest version of the software,
for a piece of software.
But as you know, nobody
to follow what the U.S.
government is going
to do this presentation.
So for the agenda.
We're going to take a tour
to describe
exist and we're going to go
in the Java framework.
Provide you Of concepts
and we released them last week.
They've been passed there
in the Zero Day Initiative program
of the classic vulnerability of Java.
We're going to take that and look
in landscape and look at what Oracle
I'm Brian Gorenc.
I work for Hewlett Packard.
I run the Zero Day Initiative program,
is the world's largest bug bounty
So, if you have bugs and you want
I also run the Pwn2Own hacking
I'm a family man, have two kids
And, when I'm not spending time
at assembly code looking for bugs.
JASIEL SPELMAN: I'm Jasiel
I report to Brian.
I spent a lot of time looking at IDA
the cases that get submitted to ZDI.
I'm known as wandering glitch
and also behind the ZDI account.
So why did we choose Java to look at?
It had what we wanted to get
of the attack surface itself
of submissions
at the time industry razz focused
We wanted to look independently
if that was actually the case.
We wanted to determine what
was, which part
the subcomponents
the most vulnerabilities and which one
the most severe vulnerabilities.
Tying that with what's being used
whether the CDSS scoring system was
and we wanted to take
at Oracle's response
discoveries in their product.
So let's talk
for this analysis.
We scoped ourselves
every issue passed between 2011
We performed a root cause analysis
These are probably
of Java vulnerabilities
or other nation states.
We have the entire Zero Day Initiative
all the big name penetration testing
that we've submitted to Oracle
So this is actually trending
When we looked
with reversing labs and
of 52,000 Java malware samples so we
used out there today.
If we look at the footprint of Java,
and that's what makes it
they actually boast about it,
during the installation process,
According to Oracle,
itself and somebody produces 1.4 Java
I have no idea what a Java card is,
and if it's running any part of Java,
The other interesting thing
for their base language
have thousands and thousands
out every year and they're core
there's been
of Java in the marketplace,
in the mobile space.
So it's a really good target for attackers.
If you look at the architecture itself,
There's over 50 subcomponents
on in this presentation, what
of this architecture and we'll cover
up later in the presentation.
The employment subcomponent
of the Java web star capabilities
Java is differing rich applications.
Java 2D produces 2D graphics
and UTIL components provide
for almost every application that's
So there is wide range
to quickly implement tasks
Write once, run everywhere.
Let's look
What you're seeing here
from their patch releases.
They've actually patched year
year with 50 vulnerabilities being
in 2011 with over 130 remotely exploit
There's been a huge increase
When they release a patch,
of metadata and what you see
is Java's SE risk matrix and it
and people deploying
they should know
is a 2D vulnerability.
It is remotely CDD score
is the most severe vulnerability so
of information there we can look
to determine what
of the architecture is.
The most interesting thing
they score CVSS is they assume
and applets are running
So they're giving themselves
on CVSS than most vendors probably
If we take a look just
from the patches,
to determine
for the most vulnerable components
the 5 you see
for the 2011 through 2013.
Deployment being number one,
by libraries, Java FX and AWT.
But, if you look at the rankings,
is producing vulnerabilities
on average that
in the architecture.
Other interesting statistics it
that have been patched
in the last 2 1/2 years,
At one point there was two components
The deployment had 10 vulnerabilities
in February of 2013.
If we tie that
we start to see interesting stuff.
We see that on average,
is receiving
with a high of 33
to Ben Murphy and Vitali
to our program in one quarter.
Our researchers actually account
with CVSS score 9 or higher, that's
On average our researchers are scoring
on severe vulnerabilities
We can look at it two ways.
Either they're focusing
vulnerabilities or what they're focusing
you start looking at them.
Depends on perspective.
So we took
and performed a root cause analysis
into the blue boxes up here.
And the first one is privilege
Followed by buffer overflows,
on buffer operations,
integer overflow and a bunch
And what we found out was that
the most popular vulnerability
by buffer over flows.
But we can take
at it those specific issues
out into even further subcategories.
So we broke them
is the abuse of the reflection APIs
to restricted components
Another subcategory was least
is the abuse
to execute code
confusion which are vulnerabilities
either through the use
data or other techniques.
We have the classic key based buffer
and various other process control
But the key takeaway for this
from every major class of bug that's
a really good case study
(Laughter.
So we take a look specifically
Those accounted for half
If you look at the pie chart,
the unsafe reflection vulnerability
of those and then followed
accounted for a quarter.
The interesting thing about these
in the exploited community
to bypass any OS mitigations.
They just work.
You don't have to bypass that.
You don't have to bypass ASOR,
Every time you click on it,
Quite good.
If you look
what you're seeing is the blue box,
the submissions
for sandbox bypass issues.
So we've been receiving these
So Oracle has actually known
If we look specifically
vulnerabilities, out of bounds rights
there's really two causes
in those two classes so we could
We found out that a third
by integer overflows causing
of a smaller than intended buffer
the rest were incorrect arithmetic
So it's interesting
of memory corruption issues and
So taking all this information,
all the information from the ZDI,
the top 7 vulnerability classes
the unsafe reflection vulnerability which
in the library subcomponent followed
is also most popular
by two classic memory corruption
most of these ended
would keep key based buffer overflows
Untrusted pointer dereference which
and Javascript framework.
I don't know why they exist but they do.
And they're quite funny when
by we have key based buffer overflows
confusion issues.
But to make it even more interesting,
all of that information on top
understand what type
in which subcomponents and this
This is one the first times there's been
for you to start looking for them.
What you see
the packages that had vulnerable code
of vulnerabilities that existed
from memory code issues
Deployment suffered
and process control problems and
on the slide here were sandbox bypass
The rest of the subcomponents
the Java FX component which was
of untrusted pointer dereferences
studies,
suffered from sandbox issues
is something because it suffers
and memory corruption issues.
So that's the sound component.
But this is really valuable
because it's
to go bug hunting and look for stuff
hopefully submit them
But the basically, you're able to take
at the 2d component and you know that
for key based buffer overflows
It's also useful when a patch comes
to scope what you need to look
they give you which component they're
Now what we're going to do
of case studies
we talked about in the slides.
We're going to do two case studies
Two different memory corruption
and untrusted Java FX component
So you know, this is probably one
been shown publicly.
All right, so the first bug we're going
over is in the JASIEL SPELMAN: So
over is library subcomponent
on what unsafe reflection is,
a dispatch method that takes
of arguments.
We'll look up the function
If you pass add it will look
invoke it.
Unsafe reflection
validation
the delete everything method
In CVE2436,
exploration issues 5034 you could
issue 5 fore makes use
to get protected method
a instance of it.
It requires the use
usually the use of framework such
if you really wanted you could hard
After you've done that,
to on the class litter and that
to the class litter such that you could
Once you've done that all you have
a permission domain that contains
to load a class and disable
You do that either through the use
or within a method in that class.
And I'll go into that in this slide.
So here you can see invoked dynamic
and get class handle would be
All that will do is make the call
the set define class method handle here
in this case it will be
to the define class method.
We save it
variable so we can access it later on.
Once we've done that we create
all permission
based off that.
Once we've done that, we get access
the method handle to our class loader.
That the point we can invoke
and load a malicious class that
the sandbox or the security manager.
This was patched
of convert method
The main takeaway is there's
if the parameter class is not
the given object to the given class.
We can see in the previous version that
And as a result,
in a class cast exception.
The next weakness is also
is a privilege and sandbox issue due
that exists
privilege blocks.
It takes two arguments or
arguments the first of which
or otherwise that exposes
This run method will get run
than you're currently within.
The second optional argument
and that's a save state
running within.
When you're running
to have a much lower privilege level
do whatever it wanted.
Ben Murphy found
instance does not save
and as a result it will use the libraries.
Unfortunately, it requires
to execute an arbitrary statement.
He then found that method handle
as interface instance that can do
And using this, you can access
And load a malicious class.
You still have one hurdled
to be able
without putting any user frames
So here we can see a little snippet
You'd start off by deciding
an instance method you want
And you would instantiate it.
You then create a method type
off the instance methods return value
the classes for primers it takes.
You then use the find virtual method
off the desired class, the name
the method type you just created.
You bind it to the you bind
to the desired class and then you run
which
When the method handle
the first three method argument
be dropped and not sent
At this point you create your invocation
of method handles dot
to he create the proxy
And you'll have to do that
but that is doable.
We haven't added it
what the actual exploit is.
So this was patched in three classes.
First class
and that was patched first
makes use
The main takeaway from this
to be returned here which means when
below and find virtual,
null there.
In method handle proxies you have
as interface instance method which
of the maybe bind caller function.
And in the maybe bind caller,
if the parameter class is null or
is class libr null which means it's library
without any modification of it.
If that's not the case
the bind caller method The last class
of this patch
class and specifically
The main takeaway here is that
if it's null just throw an internal error.
Previous to this, you would try
That said,
because we would die
the eMethod handle.
And okay.
All right.
So the next bug
is a key based buffer overflow due
to us and exists in native C code.
Java has what's called Java native
to be called from Java land.
In this particular case the issue lies
the issue lies because of well,
You have four arguments that are
and which image creates the first
a type specifier that's used
You have three arguments.
Channel within height which
for a signed 32 bit integer.
So there are some bounds placed
and height must be greater than 1
greater than 1 and less than 4.
But once that's done, if the mlib type
and channels by 4 sorry, width
and later on multiply that by height.
So height times width times channels
to the 32nd power we'll send a value
As a result when we start writing
All right, this was patched
of the safe to mult macro and
of this macro time they did any sort
They're making use of the macro and
they'll actually do the multiplication
Here we can see that we're making use
and checking it against WB and 4
will we multiply WB by 4 same goes
before passing it to malloc.
So the next vulnerability
is out of bounds right due
It was reported by Vitali and it exists
Specifically in sun AWT image rep.
It's accessible via sun image,
the issue lies
is an integer component object which
is used
So we're we can see a snippet
is the vulnerable function
is the image component raster.
Here is where we're getting access
and we're now setting destination
you can see that
is being set based
the scan line field.
We have an outer
the source pointer and destination
and scan line stride and this
to prevent integer overflow.
We then update the source
actually going to be writing
destination pointer
Finally we actually have the right to it.
So this was patched
of three macros, check stride,
and Oracle did proper patch
So here are
And you can see that they're checking
by actually doing the calculations.
If one occurs, they'll false
Same goes for check source
Here you can see that X and W
validated and you can see that
is also being checked just this
Here you can see the use
The blast vulnerability
is an untrusted corner D reference
is his favorite bug in Java.
Reported by Vitali and this particular
in the com sun web page class.
The issues lies
functions that are executed
and one of them will allocate a buffer
to Java land.
This is stored
There is a public get page accessor
of the methods within the web class
the P page variable whereas, others
of the get page accessor method.
As a result we can subclass
and achieve memory corruption.
So here we can see that the class
subclass it.
Here we can see that
is also public which also means we can
And here is one of the native functions,
It's private but above it we can see that
is public so we can actually call it.
And within it we see a call
get page, the value returned
So this was patched
We actually got a slew
all at the same time and
of make the hurting stop reaction just
Any attempt to access that package
in a package access exception error.
There's a package restriction list
Brian will go into that a little later.
Then properly patches
the get page package private and final.
And with that, I'm going
he can go over to Pwn 2 own
in the threat landscape BRIAN
to look to see how people are using
This year when we access
the scope of the competition
into it mostly
by malware and we added flash reader
of course Java when we did that people
ZDI is giving out $20,000 for free.
At the time it felt like that
of Zero Day activity going
going
to highlight the browser plug ins.
0 you are expectation was
due to unsafe reflection
They actually brought
affecting Java.
If we look at the actual participants.
James fore Shaw brought
Josh Drake brought and
Luke brought overflow and Ben Murphy
It's interesting to see that
leveraged and used to win money
The one of my favorite quotes when we
in security.
We asked them to bring us
and Chuckie says of course
to bring you something interesting.
So they brought
Looking at the landscape itself,
This is depicting
You see a huge increase
The recent months.
The this actually mirrors
going on at the time.
That's just an interesting data point.
People are looking at Java.
It is a popular application to audit.
If you're a developer, you're required
just to stay competitive
on the market.
There's quite a competitive market
Attackers are upping their game.
One of the interesting things
is it shows vulnerabilities in 2011,
in 2011 are still actively being used
because the installation process
There's been several studies that have
of the install base hasn't updated
after release and sometimes
The fact is that multiple major versions
at one time and as a result,
So we wanted to look
compared to what's actually
And what we see
the most common bug to be utilized
of the sample set being
What you see
a quarter followed
and three
for almost 90% of the actual activity
Memory corruption issues do end
and so there's more focus in reality
because you don't have
Now we're going to go
and one that's not as common
JASIEL SPELMAN: All right.
So the main goal
with sandbox bypass asks
and pass null as the argument.
This was the effect
means you can run anything you want.
With memory corruption you have
as overwriting
is a technique given to us
of Java being statement class.
So Java being statement represents
of the form instance variable.instance
What you can potentially do
an out of bounds rate and
buffer that's vulnerable
A statement has implicitly created
is clearly going to be weaker
in your untrusted applet.
You then create
by creating a permissions object,
Then you create
out of that and create access control
You then use your memory corruption
the statements,
and then you can just execute
with more privileges.
Now going to go through a piece
use of a sapped box bypass
Makes use
to instantiate
and then it uses object manager factory
to the load class protected methods
the it then invokes that class
on a malicious class that implements
And once it's done that it then nullifies
at stage 2.
So here we see that
the Java version and checking to see
So, if it's not JDK7, it's just going
If it is, it then grabs
exception action and turns it
We then make use
to instantiate
and we then get access
using manager objected
That the point we invoke
class and we then call method within it.
And forgot to mention
very clear and easy
because we've deobfuscated it.
This particular piece
but did not use advanced methods
We were able to use normal compiler
So continuing on, we call
and give it two arguments.
The class we just loaded and basically
by the HTML that served this piece
Within the malicious class we start
Sorry about that.
So we first take our string
by the characters H and J.
Then we turn that
later on.
We then get access
and instantiate it.
And pass it
At this point we end
the first thing we do is make a call
block and we pass this as the variable.
This has the effect of because we're
exception actions this has the effect
nullifies the security manager.
At this point everything after this
fully taken place.
So now we make now we call our stage
And the first thing we do is grab
to the URL that we were given
in our app data directories called Java
We then go through and download
into that download the file
into the Java IO tempter file
as an executable and falling that,
as a DLL At this point I'm going
he can go
with all this.
BRIAN GORENC: All right.
So we kind of have
and how
because we handle so many of them.
We've done over 200 just this year.
Zero Day's patched
In the case of Oracle,
about three months to turn
puts them in the middle of the pack
but in reality what's going
is they've decreased their turnaround
the vulnerability submissions have
So it's actually quite a feat when
in 2013 you patched over 130
turnaround time.
To from an external perspective,
over their patch organization
being discovered.
They're increased patch cycle.
They release four times
are discovered.
They've made public commitments
of time to get a patch when Zero Day
They're aggressively adjusting their
for Java which we'll go over next.
They killed several
in this perspective means we
We verify that it works and
a patch and killed the bug.
So in U13 they killed 3 and in U15
And this is due
and also a tightening
violation bugs.
What you see on the screen
to the attack surface that they've made
We've base lined it in U9.
They had about 12 packages
And you see in U10 and U11
in U13 they added another dozen
to the restriction list and one
the sun package that we went
They're actually adding those
And trying to tighten
In U15, you see that
is kind of strange.
But what they're actually doing
and adding higher level packages.
So you see that it's com, sun,
and they're further tightening
an applet can get to.
In U21 they made a lot
with the same sort of thing,
and add more packages.
The interesting thing for everybody
is those are where you want
if you're doing one day patch analysis
because there's vulnerabilities that
So you can take this and
and you can understand and reduce
to look for bugs in the program.
In Java itself.
And you can see that they're changing
So what you see on the screen
for JDK7U25.
There's 43 packages
is quite a change than U9.
You see a lot of com, sun,
they'll remove those and add
So in conclusion Oracle has weathered
three years, they've had
of vulnerability discoveries
we've had 50+ Zero Day submissions
Attackers are leveraging them
against Facebook and Apple.
And you've seen some
to date.
Everybody's focusing
With unsafe reflection being
in the architecture followed
the most properly used vulnerability,
The 2d component produces
But it's not used.
When they come out with 2d
in reality as important
usually garners around 8.7 or 7.6.
We talked about thousand
and increased patching so they're
We want to thank everybody
to thank the researchers who submitted
over the last three years,
and you'd like to sell it and make some
to do that.
You can submit it
you and handle
We also want
and security explorations
to help us validate some
on in the paper development.
So thanks for attending.
Good luck bud hunting and we'll be
out round to answer questions
has additional vulnerabilities.
Depends