My application ran away and called home from Redmond • Hacker News Board

Re: My application ran away and called home from Redmond

#121

Post by Buge » Tue, Oct 08, 2019, 7:40 AM UTC

MzHN wrote: post #14

I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…

>As a user, you can just disable automatic sample submission.

I don't think disabling it really helps. It sounds like the goal is to prevent malware on your machine from ever leaking data on your machine to some external server. But even if you disable automatic sample submission, the malware on your machine could still submit a program on its own to Microsoft that leaks your data.

Re: My application ran away and called home from Redmond

#122

Post by thomasdereyck » Tue, Oct 08, 2019, 7:47 AM UTC

Advanced Threat Protection in Office 365 does this as well. It's a security feature that scans all linked files and attachments sent through Outlook.

A while back in my company we were deploying a client management tool (think TeamViewer but with more background management and software deployment capabilities). It needed to be very easy to install, so we just had a link to an EXE file that needed to be opened by our on-site IT departments. No extra steps were required.

Imagine our surprise when we suddenly saw machines popping up that were totally unfamiliar. These were machines connecting from a Microsoft IP, and all had random (but similarly formatted) usernames. They also provided random mouse inputs. We could even take control of these machines (!) but apparently they were short lived VMs that only existed for a few minutes before being recycled.

I contacted Microsoft support because at first we thought this may be a manual process (because of the mouse inputs and the user names), and we didn't want Microsoft employees seeing user data. Afterwards I also commented to the support person that someone may use these temporary machines as an attack vector (to use as an anonymous source, or in a DDoS attack), but the ticket was closed and if I recall correctly this was deemed "working as designed".

Re: My application ran away and called home from Redmond

#123

Post by dTal » Tue, Oct 08, 2019, 7:50 AM UTC

Terr_ wrote: post #79

Havoc wrote: post #38

Also seems like a viable vector to DOS something - if Microsoft runs this on some sort of cloud infra with a fat pipe

I think that's less likely, if MS gets a thousand identical copies of a binary, they probably aren't going to bother test-analyzing more than one. There also might be some rate-limiting on what they'll do from a particular machine. So your attack might require first controlling a swam of Windows 10 machines, in which case you might as well do it directly :P

Who said anything about identical binaries? It's trivial to make two completely differently obfuscated binaries that do the same thing. If it were possible to determine behavior by static analysis, they wouldn't need to run it...

Re: My application ran away and called home from Redmond

#124

Post by philpem » Tue, Oct 08, 2019, 8:03 AM UTC

Uristqwerty wrote: post #102

mirimir wrote: post #96

Earlier quoted context omitted.

Also, in the image caption ... > Because of Windows Defender automatic sample submission, Beacon binary was uploaded to Redmond and Beacon called Home from there. ... and below ... > They run the executable in an environment where network connectivity is available. Why would they do that? To see what happens? And it's not just Microsoft. Many anti-malware apps (now, probably most) upload binaries. And I'm guessing th…

Consider: Malware that doesn't do anything suspicious unless it can first fetch a plausible benign file from what looks like a CDN. If the goal is to properly inspect the behaviour of potentially-malicious code, what it does after successfully fetching a set of ads is as, if not more important than what it does when the connection is blocked. Perhaps a multiplayer game with a backdoor triggered by the MotD service, t…

For bonus points, the C&C server realises the incoming IP has Microsoft's name attached, and only sends back the adverts. For anyone else, it sends a malicious image file as part of the drop, which exploits an intentional security vulnerability in the dropper...

That's actually disturbingly sneaky.

Re: My application ran away and called home from Redmond

#125

Post by philpem » Tue, Oct 08, 2019, 8:05 AM UTC

mirimir wrote: post #105

Uristqwerty wrote: post #102

Earlier quoted context omitted.

Consider: Malware that doesn't do anything suspicious unless it can first fetch a plausible benign file from what looks like a CDN. If the goal is to properly inspect the behaviour of potentially-malicious code, what it does after successfully fetching a set of ads is as, if not more important than what it does when the connection is blocked. Perhaps a multiplayer game with a backdoor triggered by the MotD service, t…

OK, that makes sense. So how would one block this exploit? You can't test the malware properly without letting it reach its servers. So then you're also letting it upload its exfiltrated data. Which would likely be encrypted.

I think you'd more or less have to block *.microsoft.com at the gateway, then add explicit allows for WGA and Windows Update.

Or a group policy update to tell Defender not to upload stuff to MS.

Re: My application ran away and called home from Redmond

#126

Post by philpem » Tue, Oct 08, 2019, 8:12 AM UTC

SteveNuts wrote: post #74

jimnotgym wrote: post #67

I was interested in this Beacon software, but then I found you had to contact them for pricing and I gave up on the idea. Lesson: clear pricing keeps people like me in the game

I've found a lot more software startups and SaaS companies using this method lately. When I actually am interested enough to talk to their salespeople (and they're straightforward enough with me) they've told me it helps them target whales more easily. They can charge a lot more to a huge Enterprise and adjust lower for SMBs.

Of course the fun part of that is when the sales staff mistake a minnow for a whale.

Case in point, a large FTSE, NYSE, NASDAQ listed company with largely siloed internal departments, all with their own budgets. Your yearly budget might be $20,000 -- but they see the Inc. or Plc. with a turnover in the hundreds of millions and quote accordingly...

That situation makes for some fun sales calls.

Re: My application ran away and called home from Redmond

#127

Post by philpem » Tue, Oct 08, 2019, 8:13 AM UTC

LeoPanthera wrote: post #118

hiccuphippo wrote: post #64

Earlier quoted context omitted.

You could use it for crypto mining.

Assuming they only run it once, in one sandbox, that would probably not be particularly profitable.

Especially if there's a time limit on execution.

How many bitcoins can you mine in 30 seconds with a silly-low CPU cap?

Re: My application ran away and called home from Redmond

#128

Post by dagw » Tue, Oct 08, 2019, 8:22 AM UTC

philpem wrote: post #127

LeoPanthera wrote: post #118

Earlier quoted context omitted.

Assuming they only run it once, in one sandbox, that would probably not be particularly profitable.

Especially if there's a time limit on execution. How many bitcoins can you mine in 30 seconds with a silly-low CPU cap?

How many bitcoins can you mine in 30 seconds with a silly-low CPU cap?

Somewhere in the region of $5e-9 worth of bitcoins.

Re: My application ran away and called home from Redmond

#129

Post by philpem » Tue, Oct 08, 2019, 8:23 AM UTC

Silhouette wrote: post #66

One of the main reasons we don't want anything to do with most recent Microsoft software at my office is concern that unspecified data we're working with -- which might include information obtained under NDAs, clients' trade secrets, sometimes personal data, etc. -- might get sent up to the mothership when one of the telemetry systems phones home. People look at me as if we're crazy for worrying about this possibilit…

This. If they were at least up-front and said what it collects, how, when, and how to turn it off (or better yet, followed privacy best practice and turned it into informed opt-in), I'd be more eager to upgrade.

With that said -- there's still room for due diligence. I've built systems which handle personal data, and we pretty much started with Debian minimal and worked from there. To make damn sure, we stuck them behind a whitelisted firewall. They had access only to things we allowed them to see, and only in the direction we allowed.

Re: My application ran away and called home from Redmond

#130

Post by saiya-jin » Tue, Oct 08, 2019, 8:30 AM UTC

thomasdereyck wrote: post #122

Advanced Threat Protection in Office 365 does this as well. It's a security feature that scans all linked files and attachments sent through Outlook. A while back in my company we were deploying a client management tool (think TeamViewer but with more background management and software deployment capabilities). It needed to be very easy to install, so we just had a link to an EXE file that needed to be opened by our…

Anytime somebody here would like to claim that 'new' Microsoft is so much better and moral than 'old' one, I want to punch them in the face and start rant about Windows 10. Never met a single person, IT or not, who would not complain about it after moving from Windows 7.

Now I don't have to, I can just point to this thread and this comment.

This is pure arrogance - they know they have whole corporate world stuck with Office, even immediate move to Open source would take 20 years due to mostly Excel tight integration/expertise. We would all benefit from a good competition in this area...