Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-15 Thread Stefan Kanthak 
"Michel Arboi"  wrote:

> On 11 January 2016 at 15:37, Stefan Kanthak  wrote:
>> Which but does not mean/imply that everybody abandons TrueCrypt.
> 
> The project has been abruptly killed by the developers without any
> clear explanation. There's something fishy and it cannot be trusted
> anymore.
> Spend your time and energy on forks like CipherShed or VeraCrypt!

See  alias CVE-2016-1281

And see  again:

| almost all executable installers (and self-extractors as well
| as "portable" applications too) for Windows have a well-known
| (trivial, trivial to detect and trivial to exploit) vulnerability:

>> STOP posting on top, but DON'T stop reading on top, read that
>> page COMPLETELY and notice the download(s) offered at its end!
> 
> AFAIK, TrueCrypt 7.2 is only capable of decryption. It is provided so
> that users can migrate their data to another system.

and has a vulnerable installer, like all its predecessors and all
forks of TrueCrypt.

stay tuned
Stefan Kanthak

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-15 Thread Michel Arboi 
On 11 January 2016 at 15:37, Stefan Kanthak  wrote:
> Which but does not mean/imply that everybody abandons TrueCrypt.

The project has been abruptly killed by the developers without any
clear explanation. There's something fishy and it cannot be trusted
anymore.
Spend your time and energy on forks like CipherShed or VeraCrypt!

> STOP posting on top, but DON'T stop reading on top, read that
> page COMPLETELY and notice the download(s) offered at its end!

AFAIK, TrueCrypt 7.2 is only capable of decryption. It is provided so
that users can migrate their data to another system.

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-11 Thread Douglas Held 
Stefan,

I really enjoy your submissions. This is great work.
But how did you expect to get a response from the TrueCrypt developers? I
think it is widely understood they are already pwned.

Regards,
Doug

On Sat, Jan 9, 2016 at 8:00 PM,  wrote:

> Send Fulldisclosure mailing list submissions to
> fulldisclosure@seclists.org
> ...
>

Message: 10
Date: Fri, 8 Jan 2016 14:32:51 +0100
From: "Stefan Kanthak" 
To: 
Cc: 
Subject: [FD] Executable installers are vulnerable^WEVIL (case 20):
TrueCrypt's installers allow arbitrary (remote) codeexecution
and
escalation of privilege
Message-ID: 
Content-Type: text/plain;   charset="iso-8859-1"

Hi @ll,

the executable installers "TrueCrypt Setup 7.1a.exe" and
TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll,


Timeline:
~

2015-12-23report sent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-01reports resent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-08report published


--

Subject: Digest Footer

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-11 Thread Stefan Kanthak 
"Sarah Allen"  wrote:

> TrueCrypt ceased development back in 2014.

Which but does not mean/imply that everybody abandons TrueCrypt.

> Please refer to the below link to migrate to an alternative
> (BitLocker) from TrueCrypt.
> http://truecrypt.sourceforge.net/

STOP posting on top, but DON'T stop reading on top, read that
page COMPLETELY and notice the download(s) offered at its end!

OUCH!

Also notice the MANY download sites that still offer TrueCrypt 7.1a
and its vulnerable executable installer:






...

stay tuned
Stefan

[braindead fullquote removed]

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-11 Thread Sarah Allen 
TrueCrypt ceased development back in 2014.

Please refer to the below link to migrate to an alternative (BitLocker) from 
TrueCrypt.
http://truecrypt.sourceforge.net/




From: Stefan Kanthak 
Sent: Friday, 8 January 2016 9:32 PM
To: fulldisclosure@seclists.org
Cc: bugt...@securityfocus.com
Subject: Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's 
installers allow arbitrary (remote) code execution and escalation of privilege

Hi @ll,

the executable installers "TrueCrypt Setup 7.1a.exe" and
TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll,
NTMarta.dll and SRClient.dll from their "application directory".

For software downloaded with a web browser the application
directory is typically the user's "Downloads" directory: see
,

and  for "prior art"
about this well-known and well-documented vulnerability.


If an attacker places the above named DLLs in the users "Downloads"
directory (for example per drive-by download or social engineering)
this vulnerability becomes a remote code execution.

Due to the application manifest embedded in the executables which
specifies "requireAdministrator" the executable installers are run
with administrative privileges ("protected" administrators are
prompted for consent, unprivileged standard users are prompted for
an administrator password); execution of the DLLs therefore results
in an escalation of privilege!


Proof of concept/demonstration:
~~~

(verified on Windows XP, Windows Vista, Windows 7, Windows Server
2008 [R2]; should work on newer versions too)

1. visit , download
    and store
   it as USP10.dll in your "Downloads" directory, then copy it as
   NTMarta.dll, RichEd20.dll and SRClient.dll;

2. download TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" and
   store them in your "Downloads" directory;

3. run TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" from your
   "Downloads" directory;

4. notice the message boxes displayed from the DLLs placed in step 1.

PWNED!


5. on Windows XP copy the downloaded USP10.dll as SetupAPI.dll (or
   create an empty file SetupAPI.dll), then rerun TrueCrypt*.exe
   from your "Downloads" directory.

DOSSED!


The denial of service from step 5. can easily be turned into an
arbitrary code execution with elevation of privilege too: add the
exports SetupDiOpenClassRegKey, SetupInstallFromInfSectionA,
SetupOpenInfFileA and SetupCloseInfFile to the SetupAPI.dll copied
to the "Downloads" directory.


For this well-known (trivial, easy to avoid, easy to detect and
easy to fix) beginner's error see
,
,
 and
 plus



See ,
 and
 plus
 and the still unfinished
 for more details and why
executable installers (and self-extractors too) are bad and should be
dumped.


stay tuned
Stefan Kanthak


PS: I really LOVE (security) software with such trivial beginner's
errors. It's a tell-tale sign to stay away from this crapware!


Timeline:
~

2015-12-23report sent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-01reports resent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-08report published

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege

2016-01-08 Thread Stefan Kanthak 
Hi @ll,

the executable installers "TrueCrypt Setup 7.1a.exe" and
TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll,
NTMarta.dll and SRClient.dll from their "application directory".

For software downloaded with a web browser the application
directory is typically the user's "Downloads" directory: see
,

and  for "prior art"
about this well-known and well-documented vulnerability.


If an attacker places the above named DLLs in the users "Downloads"
directory (for example per drive-by download or social engineering)
this vulnerability becomes a remote code execution.
 
Due to the application manifest embedded in the executables which
specifies "requireAdministrator" the executable installers are run
with administrative privileges ("protected" administrators are
prompted for consent, unprivileged standard users are prompted for
an administrator password); execution of the DLLs therefore results
in an escalation of privilege!


Proof of concept/demonstration:
~~~

(verified on Windows XP, Windows Vista, Windows 7, Windows Server
2008 [R2]; should work on newer versions too)

1. visit , download
    and store
   it as USP10.dll in your "Downloads" directory, then copy it as
   NTMarta.dll, RichEd20.dll and SRClient.dll;

2. download TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" and
   store them in your "Downloads" directory;

3. run TrueCrypt-7.2.exe and "TrueCrypt Setup 7.1a.exe" from your
   "Downloads" directory;

4. notice the message boxes displayed from the DLLs placed in step 1.

PWNED!


5. on Windows XP copy the downloaded USP10.dll as SetupAPI.dll (or
   create an empty file SetupAPI.dll), then rerun TrueCrypt*.exe
   from your "Downloads" directory.

DOSSED!


The denial of service from step 5. can easily be turned into an
arbitrary code execution with elevation of privilege too: add the
exports SetupDiOpenClassRegKey, SetupInstallFromInfSectionA,
SetupOpenInfFileA and SetupCloseInfFile to the SetupAPI.dll copied
to the "Downloads" directory.


For this well-known (trivial, easy to avoid, easy to detect and
easy to fix) beginner's error see
,
,
 and
 plus



See ,
 and
 plus
 and the still unfinished
 for more details and why
executable installers (and self-extractors too) are bad and should be
dumped.


stay tuned
Stefan Kanthak


PS: I really LOVE (security) software with such trivial beginner's
errors. It's a tell-tale sign to stay away from this crapware!


Timeline:
~

2015-12-23report sent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-01reports resent to vendor

  NO ANSWER, not even an acknowledgement of receipt

2016-01-08report published

___
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/