 |
 |
|
January 31, 2004WSH: The demon of the darkRecently Peter posted a good comment about how the Windows Script Host (WSH) is not actually riddled with vulnerabilities, even though its one of the FBI's Top 10 Windows Vulnerabilities. He has a good point there. However, I do understand why its a nasty beast that is on the list. Combined with things like alternate data streams (ADS)... you can wreak HAVOK on a system that has scripting turned on (which it is by default on most Windows installations), and in many cases HIDE malicious code from even being detected. If you are new to ADS, consider reading my previous post on The Dark Side of NTFS (Microsoft’s Scarlet Letter). The very fact that you can hide malicious code in a stream which most anti-virus and IDS/IPS tools will miss astounds me even to this day. Once more virogens figure this out... we will have a new attack vector to fight with. Peter also brought up a great point though on how to stop scripts that are not signed. And that is to use Software Restriction Policies (SRP). One cavet is you must be running WSH 5.6 I believe, which means you will need to be running atleast Windows XP. (I may be wrong here). If you want to look at this method, consider reading this article on WSH on how to deal with this. If you don't want to use SRP, there are some registry keys you can set. Under either HKLM or HKCU, take a look at the \Software\Microsoft\Windows Script Host key. Four values are relevant here: Enabled, TrustPolicy, UseWINSAFER, and IgnoreUserSettings. Here are their effects:
It is sad that most of this is hidden away and unknown to most users. More sad that these "new features" are not turned off by default, reducing the attack surface of the platform. (Although as I have said before, Windows Server 2003 made a stronger effort in reducing the surface significantly) As Microsoft continues to work on this, hopefully the future will reduce the potential threats that can occur from such software, and move tools such as WSH off the FBI's top 10 list. Thanks for pointing out SRP Peter. Posted by SilverStr at January 31, 2004 11:24 PM | TrackBackComments
Great article Dana! eTrust Anti-virus from Computer Associates will virus check alternate streams, although the feature is off by default (?!?). Thanks for posting this -- I'll probably expand upon this in a future blog entry. If I recall correctly, SRP is available on Windows 2000 as well. Posted by: Eric Lippert at February 2, 2004 03:45 PMThanks for posting this -- I'll probably expand upon this in a future blog entry. If I recall correctly, SRP is available on Windows 2000 as well. Posted by: Eric Lippert at February 2, 2004 03:45 PMBeavis was here! :D Posted by: Cmdr. Beavis at February 4, 2004 11:49 AM |
 
My 5 Favorite Books
Writing Secure Code
Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind
My 5 Favorite Papers
Smashing the Stack
Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides
Archives
January 2007
December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 |
|
