>> Alright, so. My name's Mike, thank you for coming to the talk, sorry for those... the
long delay there. They make us test our VGA to HDMI converters in the green room, but it turns
out that the green room equipment is not the same as the equipment in this room, so,
didn't work. Anyway, um, I'm going to talk about loading code from a copier. Now I've
mentioned this title sereval times over the weekend, you know with the blue badge people ask
me all the time what I'm talking about, so I had to disabuse some notions right away. I'm not
infecting the printers I'm talking about here, the scanners, by doing the firmware,
I'm using them as designed as a scanner and moving documents from the scanner to a target
workstation on a closed network and interpreting those documents in a way to draw binary files
onto the, uh, onto the target machine. So I just wanted to make sure you understood that
right away. Um, and this is a definitely an insider attack, this is for something I worked
on to do, um, work on a closed network to load arbitrary tools. Here's what I'm going to go
over, um, and it's, uh, it's a phased attack, and each step of the phase kind of changes the
amount of, uh, data I get per page on the scanner into the machine until I go from basic
just text, uh, analysis down all the way to getting about 80 kilobytes of data, uh, per page
onto a targetted machine So that's the different phases that we're going to go through that
all with you. So, the way this all started is I was at work on a closed network and it had a
collaboration portal on that network, and it was kind of Sharepoint based, kind of thing,
um, and it had these text entry boxes, like you can see here, um, and it didn't take me long
to discover that they are being uh, the data's being [inaudible] on the client side with some
javascript. And I was like "oh, well I bet I can beat that and put some cross site scripting
attacks on my colloaboration portal at work." Um, but, uh, and that's easy to do when
you're at home, right, when you're using your machine, you do something like Tamper Data,
or Burp Suite to intercept the call and modify it after its been through the javascript
modification. Um, but I didn't have any those tools available to me. So I said, I kept trying
to think through, what would I do to make this happen? I was like, well, um, like I said,
Tamper Data, Burp Suite to intercept the post call, don't have those, I could forge the
post call but I didn't have Perl or wget available to me, and eventually I came to the
conclusion that what I really wanted to know how to do was put whatever tool I wanted on this
machine without making anybody mad. Without getting caught, really. So um... [laughter] So,
uh, that's kind of where I ended up working on this particular problem. So these are the
conditions that I had to work with. I had a closed network, uh, sort of, right, there are no
really truly closed networks anywhere because they're basically not useful. Um, but
this is for all intents and purposes a closed, secure network. Uh, and this network
the USB ports are secured, monitored, sometimes they're physically locked, uh, CD use is
secured and monitored, typically from a, uh, a writing standpoint, not so much a
reading standpoint, but nonetheless it is monitored. Uh, there's a endpoint security
system on this, on my workstation, um, and, you know, it's generating logs for
everything I do down to the mouse click I guess, I don't know, but only certain things it
logs are gonna draw attention from any kind of security people, right? So I wanted to
avoid those things. There does exist a data transfer point between my... between a less
secure network that's closer to the internet than this secure network, um, but I didn't know
how it worked, um, I didn't know, um, what it logged, I didn't know what rules it had
per scanning, I didn't know who it alerted, and I wasn't really in the mood to try and keep
poking at it to see what I could figure out and raise my noise level til I got through what I
wanted to, um, because I didn't want to get fired, so... um, I didn't want to use that. And
basically its a Windows and Microsft Office environment. These are the tools I had
available when it got right down to it. I had Microsoft Office which provides access to Visual
Basic for applications. Uh, I had professional level printers and scanners, uh, that can, you
know, print and scan to a very fine level which is really useful for what I was doing, and
Adobe Acrobat with optimal character recognition is what I used. Alright, so first is
getting Excel into attack mode, and this is just turning on delevoper mode in Excel. Now,
you know, we all get those little pop ups that say "hey, don't, you know, don't run the
macros" that kind of stuff, or "do you want to approve these macros" but if you're the
insider writing the macros, that kind of is pointless, right? So, um, and, I call Excel 'attack
mode' because inside of Excel you can write arbitrary script, and Excel with Visual Basic for
applications can modify files at the byte level. Uh, and not only that, you can call arbitrary
DLL's with arbitrary functions, with arbitrary inputs to those functions. And that's an awful
lot of arbitrary for any insider to have available to them as an attack service. So I call it
putting Excel into 'attack mode', and it's not hard to do, and I'm sure you guys all know
how to do it, but you just go to the File, Options, you turn on Customized Ribbon, you turn on
the Developer checkbox, then you get a new ribbon on your Microsoft Excel, um, uh, page,
and you click the ribbon there and you click Visual Basic and then you would now have access
to a fully functional integrated development environment on your workstation. Now I think the
important point here is you're an unpriveleged user and you know have an integrated
development environment, and I know in many places the users who are developers, who
[inaudible] to write binaries, they, they get, you know, extra monitoring, they get extra
scrutiny. But the point is every user on a Microsoft Office based network, um, can do this, and
it's probably not being watched. So this is called putting, I call this putting Phase 0,
getting it set up. Now the next thing you want to do is you want to get an arbitrary script into
your Microsoft Excel. Um, and the way I do that is by, uh, printing it and scanning it,
basically. There's some, there's some tricks to it, uh, I'll show it you here, this is a Mac so
I'm gonna mess this up, but that's alright, let's see... So this is the script that I'm
gonna talk about a little bit later, this is a script is the Phase 1 of the attack. Um, and
you can see some things you need to do is you don't have any indentation, because indentation
on the OCR messes up the order of execution in the script. So that's not super useful. Um, and
a lot of other things will kind of go wrong here... um, when you do this. Now, um, let's see...
[inaudible] Alright, now, I would show you if my Windows machine were here, that I would
do this live here, I would just cut and paste this whole thing, so basically you scan this on
your work computer, your work scanner, you have it emailed to you, that's how the documents
get to you, you just, uh, you OCR it, you highlight it all, um, and then cut and paste it
into Visual Basic. Now let's see what happens if I do that here... of course Visual Basic
isn't turned on here, because this is not my machine, and I don't know how to do it on a...
[audience member yells] Yeah... I don't know how to do it on a Mac. Alright, so we're not gonna
do the scripts. Okay, so, um, I have some samples in my presentation though, so let's go
back to my presentation. Nope, no... so we're not gonna drop out of that anymore, okay...
Alright, um, so I talked about how you do it, you can print down to about 8pt font, you scan
it, no demo at the time, so let's skip it. Alright, so these are the screenshots from a
previous briefing I did on this, um, so when you drop it into Microsoft Excel Visual Basic it
doens't work exactly right, um, you can see here that these, uh, these lines here, these are all
comment lines. And uh, the comment deliminer has fallen off. So that's one kind of
error. Let's see, um, another error, common one, is right here, it gets rid of an equals
sign, uh, that happens quite a lot. And, let's see if I can find any of the function flow
ones... Nope, I don't see it. Um, other kind of weird errors that happen, um, sometimes it
interprets 1's as L's, so I had a, uh, I have a function called, uh, 'calculate checked',
'checksum', '1 byte', 'exclusive or', it turned in to 'L byte exlusive or', but it did that
for every instance of that word, so basically it would still work, even though it changed the
many names of the function, so that was kind of a happy failure. But you have to watch
out for all the, um, the change in the program flow. Then I wanted to go through [inaudible]
your stuff... um, you know, you'll still find more errors, when you go ahead and you click,
uh, you know, you click F5 to run it, you can see there's one highlighted right there, the
value is kind of in the middle of nowhere there, and um, not exactly sure where that came
from on this one... um, so, but it'll help you fix it. The bottom line is you can do this,
you can get an artibrary script into place, um, using a scanner without too much of a problem.
Now, um, you could also type them, if you took out the comment lines, my, the hex magic
stuff I'm gonna talk about in a second isn't that long, it's ony a few pages, so, um... but if
you had a really long complicated script you could get it in this way. Alright, so, the
goal is to use those methods I just talked about to make a script that will take an
arbitrary file, uh, encode it in binary, sorry, encode it in hex, um and make it so you can print
it out really nicely, um, and then take those to work and scan them. And why did I go with hex?
Well I did a bunch experiments, um, I found that I could get down to a much smaller, uh, size
font from a 12pt to 8pt so I could get more data on there between hex encoding and base64.
I didn't have any word length errors meaning when it goes through [inaudible] through the
document it interpreted the length of the words as it was supposed to be whereas base64,
about, you know, um, over 10% of my words got messed up with lengths, so like missing symbols
or added symbols. Um, transcription errors, uh, I didn't have any transcription
errors in my initial experiments, it, uh, it decoded every word correctly, every, um,
hex code correctly, whereas base64 there was a ton of errors. Um, now, other
experiments showed me that there are errors in, uh, in hex encoding, but they're usually
one for one, and they're usually really easy, so it means, it's like uh, an 8 goes to an S, and
it always does that, it always interprets 8's as S's, so it's easy to fix that, and it's also
easy to realize that an S is not a valid hex code, so if it's an S it's actually supposed to be
an 8. Uh, base64 that won't work, because almost every typable character is included in
the base64 encoding and so you can't tell where your errors are. You don't know what your...
what's going wrong, so I didn't like base64 encoding even though it gave me a lot more data per
page. So this is what it looks like when you encode a file, um, the script, the hex attacked,
which I would have loved to shown you running real time, um, will create this, and it
generates two columns. This is the data column, uh, the information in the file there,
and this is a 2 byte exclusive or checksum which I'll talk about here in a little bit. Um,
and then you just export those as a CSV file and print them, and you can take these pages and
scan them. And uh, transfer your data into your uh, into your closed network, as long as the
secretary's not watching you scan. Alright, um, so, I realized with hex encoding it
wasn't gonna be perfect, I was gonna have errors, so I built this kind of compact exclusive
or checksum in there. Now, the reason why I used it, it needed to be really small, 'cause every
byte I give over to my parody, my checksums, is another byte that I lose in data, and I
needed to get as much on a page as possible. So on with this 2 byte exclusive or, I was taking
a gamble that I wouldn't have that many collisions between, uh, failure modes to show that
the data would work. And it did work, um, and when you run the code if it can't match the
checksums it'll give you this little 'data is corrupt, cannot decode the data', um, and then
it'll highlight the offending line in red. Um, and, uh... I'm gonna have a hard time showing
you what I usually show... Now, the um, what you typically have to do here is... see. I'll do
this in a second. But, um, it's... you'd thing it'd be a pain in the butt to find these
broken lines in your printout, but it really isn't, you just take this, this exclusive or,
and you would find it in your Adobe document and find that line, and after you do this a
few times you realize there's a pattern to the failures. Uh, there's certain symbols that
show up, like tildes and stuff like that, and any dots that happen to be between the lines
of your actual printout, um, will cause errors. And so you learn to find them very fast, it
doesn't take very long to fix, even a large amount of hex data, um, using this method. Uh, and
now, since I'm briefing at defcon and I was warned that I have to have pictures of cats,
um, if you were to decode this hex code that generates this picture of an ocelot, this is
something I was working on at work, I didn't want to actually draw up a binary file, but I
figured a formatted file would work, so that's what that one does. Now when I really took
this... took this to the next step and I was going to use it to drop my DLL in place, um, I
discovered very quickly that it didn't work as well as I thought, I had quite a bit of
error, although it's only about 1% error, it's still a lot of problems to fix. And so I
discovered all of these kind of errors that you see here. You know B turns to 8 a lot, 1 to L,
5 to S, these kinds of things here. Um, and some of these are pretty bad, right, a B to a 8,
that's bad, because B's and 8's are valid hex code. Um, 1 to L's, not a problem, 5 to S is
not a problem, D to 0 or O, that can be a problem, and 6's, uh, get changed. So I came up with
some alternative characters that actually show up in the printouts. Um, we get, I used a
hash mark for a B and question mark for a D, and I just chose them because they didn't look
like anything else. So I thought that they would OCR pretty well, and I was right, they did work
really good. Um, and I auto replaced the other major errors and then, um, I put strong
visual indicators in the, uh, in the decoding, to show you where your problems are. Um, the only
thing I can show you about that right now is the one you already saw, the red one, um, but when I
did this with my actual DLL I only had 1 manual correction in 1210 lines of text. That's
about, like, 19 pages of decoded text. Um, and so it worked out really well. Um, uh, I think I
can show you, maybe I can try to show you... Let's see, I did open it, where did it go... Yeah
so here is, um... Nope, nope... there we go, okay. Alright so you can see here here's the, uh,
2 byte exclusive or, and here's the data line with the uh, the questions for the D's and hash
marks for the B's, and I don't think I can find the easy to see errors real quick, but uh...
Nope... I can't do it fast enough. So, it'll scan pretty well. Alright, does anyone know
how to make Powerpoint come back to the slide you just left? [audience member yells] Say
again? [audience member yells] I'm on it. [audience member yells] Alright, there we go.
Thank you. Alright. Okay, so the hex attack is really, uh, super reliable. You really can get
data very easily onto a machine and its not gonna fail, uh, pretty much at all. And you can,
if you really had to, you can enter in by hand. You can type in those hex lines if you really
wanted to, um, and uh, I know it get's kind of tedious after 19 pages but if you didn't have a
scanner available you could do this and still get arbitrary binaries on your system. The bad
part is it does have a low data density, about 3.6 kilobytes of data per page, and I put some
common tools here... No, go back... Put some common tools here between PowerSploit,
Mimikatz, like 200 pages of data, you would be trying to scan at work, so that would
probably raise some flags. Um, so that's a little... little too much. Um and there's no
exfiltration compression advantage. If you wanted to remove a binary file from this
closed network and print it out in hex code and take it home and recreate it, um, you wouldn't
really be able to do it, um, with any kind of real, uh, compression. If that file was
3.6 kilobytes long and you printed it, it probably would be a page long and you're not
getting any real benefit, unless it's an unprintable, uh, document. So, I needed to do
better. And so I got to thinking. "What... how could I possibly put more data on a
page? How could... if there was just some technology somewhere that would allow me to encode
data black and white, 2 dimensionally on a piece of paper at the pixel level, what
could I possibly use?" Well yeah, so, it didn't take me too long to figure out that there's
an awful lot of 3D Barcode stuff out there. And so I went with uh, some barcode experiments.
First I had to practice with data matrices, I wanted to see how close I could get them down,
um, and I just took this big one you see here and I kept shrinking it using Powerpoint,
um, and saving it as an image, until it got to the point where the lines between the data bits
started to blur and it wouldn't work anymore. Um, and I just tried to see how small I get get
onto a page that way. But I kept thinking about it, um, and with the amount of error correction
built into most 2 dimensional barcodes, I was only getting to about 20 kilobytes of data per
page. Um, they have about 60% error correction, it depends on the, uh, barcode, but it's
because they're designed for machine purposes. They're designed for low light. They're
designed for weird orientation, for people using cell phones, um, and that's a different
design problem that I've got, where I'm basically taking the sheet, putting it on a scanner
that scans very well, in a, in a perfect environment, and I control the orientation from the
get-go. So, I thought about, well, maybe I can make it better. I took some features
from, uh, from these barcodes, timing lines in order to help locate the data and Reed-Solomon
error correction, but I was like "I can make it better for my purposes", so lo and behold I
generated the 8 and a half by 11 inch big barcode. [audience reacts] And that's what it looks
like. Um, and with that I can get, um, about 85 kilobytes of data per page. And this is what
it looks like up close when you zoom in, it has the timing line on all 4 sides, um, and it has
the data, I caught the data, meet in the middle. And if I print that image at about 72
dots per inch I can get about 88 bytes of information accross a single pixel line. Um, and uh,
[inaudible] is a bit, right, I mean that's an off bit, those are on bits, um, and uh, and I
get about 80 kilobytes of data on a page. So I was pretty happy with that, um, and, so
interpreting it, uh, I basically, I start with a raster scan going across the image
until I find the top, uh, top left most timing mark, and then I kind of stop, and from there I
do a thing which I, uh, technically call 'wiggle fit', where I've got my mask and I put
it over the timing mark that I found, and I just keep moving it around until I find the most
black part of it, because you can see it when they scan, the edges get pretty, uh, fuzzed
out. That was cool, the thing got all big, anyway, um, and so I wanted to find the most black
part, so, so what it does, it moves the masks around... it finds the mask that has the most
dark, it picks a center point and move across to the next timing line, uh, timing mark,
and it just finds the center of the next timing mark, and it works very well, and it, I do
this on all 4 sides. And in the end I end up with this, uh, where each of the centers are...
are indicated, and, um, and then you end up with a, just a bunch, a grid of intersections for each
of these lines, you know, matching, this mark with the one all the way at the bottom, uh,
makes a straight line, this... this guy here matched all the way to the right makes a
straight line, I calculate the intersections and at the... at the intersection of each one is
a data pixel, and I pick the... I pick the data off that pixel, and I decide whether it's an on
bit or an off bit. Um, and it works fairly well, I do get some errors, I didn't expect it to be
perfect, my first test runs I ended up with something like this, this is a heat map, all
the black is, uh, bits that were read correectly in my scan, uh, these red ones here are bad
bits, and there's a couple of outliers, there's one here, there's a couple over here, um,
and this is what I really expect it to look like, uh, since I start in the upper left I
figured it would start getting bad by the bottom right. Turns out I wasn't really correct, um,
when I took the 8 and a half 11... 11, uh, document, I get this big heat problem in the
middle here. And, um... stop that... So, the uh, the big problem here is this is a lot of
error... Can't see the error? The red mark? [audience member yells] Yeah, okay, so imagine
red marks where I'm circling. [laughter] Uh, and I was afraid you weren't going to be able to
see it, um, when I was thinking of doing this brief, and then, sorry, but... So there's a bunch
of red marks in there kind of clustered. Now, the problem is I have to adjust my error
encoding, on the, um, on the... on the big barcode to handle the worst error, not the best error.
So, if you were able to see it, you would be amazed at how clean it is up here, and you would be
astounded at how nice it is around here, but you see this giant red stuff in the middle,
and that's what I have to base my error correction on, which causes a lot of data loss in
parody bytes. So, I knew needed... I knew I needed error correction. I knew it wasn't
going to work, so I went with Reed-Solomon forward error correction, and I, turns out I
don't understand Reed-Solomon foward error correction at all, and I don't understand the math
behind [inaudible] finite fields either. So I was like, well, I don't want to do this stuff from
scratch, I'm just going to find a library, there's lots of libraries out there, from
forward erasure correction and forward error correction, except, the pawn test I
discovered that the majority of the forward error correction ones I found out there just
don't work. I don't know who's writing these opaque API libraries that I can't figure
out and... I actually contacted university professors and they couldn't figure out, um, but...
but stop it. If you're going to put something out there make sure it works. So, but there's a
lot of forward erasure correction libraries out there, so I decided to go with forward
erasure correction to see if I could use it. Now the problem is forward erasure correction is
for a... a data stream, where the, uh, your missing data, that doesn't make it to the receiver.
That's what it's really for. Um, and it works a bit like this. You have a... you have, uh, some
data and you separate it into blocks, you assign a parody byte to each block, parody bytes to
each block, and then if one of those blocks turns up missing, um, you use the parody bytes in
the remaining blocks to recreate the, the missing block, and that's how forward erasure
correction works. Now my problem is not missing data, my problem is corrupted data. So I decided
"well what if I, uh, did a checksum and if the checksum didn't match I consider that
block dead and I just take it out. So that's what I did. I got my block of data, and my pardody
data, and then I've got my checksum for the whole thing, and if one of the one of the
parody bytes turns bad, or if one of the checksums is bad, then I ignore that block and try
and recreate it. But it didn't work. Um, it uh, I had too many collisions and so it was
actually trying to recreate the, uh, missing data with corrupt data, and the math will still
work and it will generally generate a corrupted response, generate a corrupted file. So it
just didn't work. So I knew I had to go do forward error correction, and forward error
correction is for corrupted data. So you have a word of data, you separate it into
bytes... um, you add parody bytes to that data... um, if 2 of your bytes go bad, you can
use 2 parody bytes to find the bad data, and then 2 parody bytes to correct it, and it
works very well. And this is what I needed. But like I said the problem was there weren't
any working libraries out there for me to use. Uh, so I had to write one, um, much against my
will. Uh, but I found this really good Python, uh based, uh, library at Wikiversity, and
line for line I just recreated it in C, basically, C++, until I got the thing working, and it
was a lot of debugging, and pain and suffering involved in there, but I finally got it working,
um, and uh, and this is what I had to do to get Reed-Solomon forward error correction working
for my big barcode. Alright... so, um, because of the big heat map of error in the middle that
I told you about that you couldn't see, but you're just going to have to trust me, um, I
needed about 45% error correction for it to work, um, which means I only got about 47
kilobytes of data per page. Which resulted in, um, uh, you know, it's order of magnitude
better, so PowerSploit you can get it in 18 pages versus 232, so you can really get, really
start moving some data now. You have a good, kind of, uh, compression advantage over the
previous method. And, uh, the demo is awesome, it really is, so... [laughter] Uh... uh, I'll
show you how it all works, I'll show you how you use a script... [clears throat] ...and the DLL
to open the, uh, um... uh, to... to create the barcodes and to interpret them and I do live
drops of everything, so, yeah, it's, uh... it was really good in my room, you guys should have
been there last night. Alright, um, but, so I decided to give myself a grade on how this went
for me, um, so my goal was to install PowerSploit on a machine, uh, that didn't have it
on it, using these methods, and not using magnetting media. So, just some grades. Interpret a
page sized barcode, yeah, I could do it. Um, the Reed-Solomon encoder decoded,
uh, I was able to make it work, uh, eventually, um, there's a yellow mark there and I'll talk
about that in a second. Um, I built the library, I caught side loading, uh, I was able to get
the payload dedcoded onto my target machine except because it was like 18 pages of data I just
made a portion of PowerSploit, so it was only 3 pages long, um, so I only gave myself a yellow
on that, or I guess a orange. Um, the hex encoder works, I was able to implace the library I
used in the OCR method, and I was able to generate... write my DLL, hex encode it and drop it
on my target machine so that I could read my big barcodes, it all... it all works, after
much... much effort. Um, just take my word for it. So, um... so the POCOC status and the
constant stuff I learned from this, was that, uh, standard office tools provide a lot of
power to the user. Um, that, you know, maybe you're not fully aware of. We, uh, basically the
user can code, the system is not secure, but the bottom line is any user a Microsoft based
machine can code. Um, and that, uh, is a big attack surface to pay attention to, and a
determined insider can do it. Um, and you can use an office input output systems for
creative purposes that weren't intended, and that no one's really monitoring. Uh, no one's
really monitoring the printing and scan load even of the secure network that I was using, um,
they're not watching for information to come in this way. Uh, so, it just provides a, uh,
kind of a hole there, to kind of squeeze throught. Alright, some future branch research. I'd like
to reduce the size of the big barcode DLL, the sideload DLL, it was, uh, 19 pages of hex
code, I'd like to make that a lot smaller, um, size optimization is not really my
thing, but that's something that, uh, I could, uh, work on. The error rates, uh, I was... I
made an expirement to add more timing lines into my big barcode thinking it would help with the
error rates, for reading the big barcode, and I was 100% incorrect, it actually messed it
up. Um, and I still don't know why, it doens't make any sense, but I'd like to improve the
error rates so that I can use less parody bytes. But, um, this next line is the real key. If I
can use, pardon me... If I can use 2 to the 16th Reed-Solomon encoding, I can do a lot better.
Um, so, Reed-Solomon encoding it at 2 to the 8th means that your code words are 255 bytes long
and it has to include your parody bytes, so you have to base your error... on, the
amount of error you're expecting at 255 bytes, and because of the invisible heat map, um, the, I
have to plan that for the high error areas, not the... not the, not the really nice areas. 2 to
the 26th Reed-Solomon encoding means that I can have a, uh, a code word 135 kilobytes long
which is longer than my page, um, and I only get about 1% of error across that page as a
whole, so I wouldn't need very many parody bytes at all if I could use, um, 2 to the 16th
Reed-Solomon encoding, but I coudn't get that math to work, um, and, uh, it also runs much
much slower, and so running experiments to debug it was taking me too long. So, I didn't
keep pursuing that, but if I get that working, it would improve the amount of data I can put on
each page by quite a bit. Um, if I could add color to the big barcode, um, instead of just
black and white, you know, I did a 4 color experiment to see is that why I'm only using, uh, you
know, 4 blips instead of 8 to... to find my bytes, uh, I was able to get it to work, but there was
a lot of error and... and decoding color from a scan, quite frankly, um, but I think
it's an area for future research. Uh, and also I got real excited about using Excel
to mess with things, um, though Visual Basic for applications is kind of a... pain, um, the, uh,
it is powerful. Uh, the ability to write at the byte level means you can do anything with it you
want, making a hex editor out of Visual Basic for applications would be super wasy, I started
with that a little bit, um, steganographic encoder decoder, to, you know, I did that
already, so I could send stuff... myself stuff to work, um, that's easy to do. Restoring
the command prompt, if you're on a machine where the command prompt's locked down by the
security policy, it's just a matter of flipping a byte to get make work again, um, and you can
do that with Excel, and I don't know for sure, but I think you can get [inaudible] some direct
reflect DLL injection. Um, uh, as well. Messing with the way... Excel calls DLL's, and now, I
don't think any of this stuff is Earth shatterring new, I mean, people have been running macro
viruses forever, and they're, you know, all back and vogue now, um, but the, uh... this is
from the perspective of an insider being able to just do these things to your machine,
um, and it's something I think you need to watch out for. Um, I don't think I... can show you
much more, unfortunately, let's see... I really wish I could show you the demo. Um... let's
see. So here's some stuff that, looks like it's left over when I was practising. Let's see if I
can open this here real quick... [inaudible] Yep, you guys are watching me mess up this guy's
computer right here. [mumbling] Ah, what the heck's the... text editor, there you go. Alright,
uh, this thing here, I don't know if you guys can read it and I don't know if I can zoom in...
Nope. Say again? [audience member yells] It's amazingly hard to hear people down... from
down there... [laughs] Uh, I don't know if you can read it or not... a little bit... it
dropped a, ah, this data file gets dropped when you do a encoding with big barcode, and,
uh, these are the important parts here. You have to have this, encoded data length, and
you have to have the md5 sum in order to decode it with the big barcode on the backside. You
have to provide those as inputs to your... to your script. Um, so that's important there, uh...
Uh... when you decode the DLL it also drops this file here, which is a prototype for using the
DLL, um, because... Visual Basic is very very picky about how DLL's are called and used, so,
uh, this gives you the prototype for it, and this is all, um, in the... it's supposed to be in
the materials that are delivered with the brief. Um, so that's really about it, um, I'm sorry
that the... my machine was too old in order to use these super fancy, uh, screens, um... and
that's kind of all I've got. Any questions? Alright, thank you guys very much. [applause]
Không có nhận xét nào:
Đăng nhận xét