Client-based Application Attacks Adli Abdul Wahid Dept. of Comp. Science, IIUM

The Plan ● Network Based Attacks ● Client-based Applications Attacks ● Potential Solutions ● Conclusion

Network Based Attacks ● Attacks that are carried out 'remotely' – Internet or another machine on the LAN ● Most literature cover attacking applications that are server based – Always listening on specific port numbers – i.e. Web, mail, ftp, etc ● Attacks are essentially in the form of buffer overflows or (that can trigger) DoS

Network Based Attacks (2) ● Clients-based applications attacks are increasingly popular ● Exploit – Web Browsers – Instant Messengers – Mail Clients

Examples in 2005 ● Yahoo! Messenger ymsgr URI Arbitrary Command Execution ● Yahoo! Messenger Offline Mode Status Remote Overflow ● Gaim Away Message Processing Remote Overflow ● Mozilla Firefox IFRAME Width Overflow ● Opera Command Line URL Shell Command Injection ● Microsoft Windows Shimgvw.dll SETABORTPROC Function Crafted WMF Arbitrary Code Execution

Typical Scenario ● User use vulnerable browser to surf net – Firewall allows this ● User clicks on site with malicious code ● Browser execute code and (maybe) payload – Payload may contain worm that leads to other problems, cause DoS etc

The Issues (1) ● Attack techniques are more or less the same – buffer overflow, just different target ● Typically use – Some form of social engineering ● User click on the URL ● Need more than basic perimeter protection – Firewall and IDS ● Policy enforcement – How do you make sure that all of the 5000 Pcs in your network uses the updated version of Browser XYZ

Potential Solutions ● IDS / IPS – What if malicious attacker is on the same LAN ? ● Patch management – Large user base? – Different types of software, tied to policy ● OS level – Stack protection in the case of buffer overflow based attacks – What if network is open to all (hotspot) ● Antivirus

Conclusion ● Attacks don't just target server based programs ● Client-based applications are just as vulnerable and targeted by attackers ● Complexity in defending the user en-masse ● Multiple approaches need to be used to defend the network successfully.