psj06lagadec-j.ppt

Size: px

Start display at page:

Download "psj06lagadec-j.ppt"

えいじろうやすもと
7 years ago
Views:

1 OpenOffice / OpenDocument MS Office 2007 / Open XML PacSec /11/ Philippe Lagadec DGA/CELAR philippe.lagadec(à)laposte.net

2 OpenOffice OpenDocument OpenOffice.org Sun StarOffice OOo MS-Office OpenDocument OpenOffice v2 OpenOffice v1 (Koffice, Abiword ) XML ZIP ISO, 2005 OASIS DGA/CELAR 29/11/2006 Diapositive N 2 / 6036

3 MS Office 2007 Open XML Microsoft Office 2007 Office 12 MS-Office 2006 Open XML Office 2007 (Word, Excel, PowerPoint, except Access) XML * ZIP (?) ECMA (*): sometimes stuffed with bits of binary OLE or BIFF files (it is Microsoft after all) DGA/CELAR 29/11/2006 Diapositive N 3 / 6036

4 OpenDocument OpenXML : active content????? 2003 F-Secure OpenOffice v1.0 : DGA/CELAR 29/11/2006 Diapositive N 4 / 6036

5 OpenOffice.org OpenDocument v1.0 MS Office 2007 Beta 2 Technical Refresh Open XML : ECMA v1.4 and (9th Oct 06) Office 2007 Windows XP SP2 fr DGA/CELAR 29/11/2006 Diapositive N 5 / 6036

pdf MS Office 2007 Beta 2 Technical Refresh Open XML : ECMA v1.

6 : :-) OpenDocument : 700 Open XML final draft: 6036!! ;-( VBA macros for example DGA/CELAR 29/11/2006 Diapositive N 6 / 6036

7 1: : EXE, COM, PIF, SCR, : BAT, CMD, VBS, JS, :, HTML, XML, XHTML : PDF :,, Word, Excel, PowerPoint, Access, :, OLE,, See (in French, sorry). DGA/CELAR 29/11/2006 Diapositive N 7 / 6036

Access, :, OLE,, See http://actes.sstic.

8 2: :,,,, (!) DGA/CELAR 29/11/2006 Diapositive N 8 / 6036

9 Part 1: OpenOffice.org OpenDocument Nom de l entité émettrice 30/06/2005 Diapositive N 9

10 OpenOffice.org OOo v2 OOo v2 OOo v1 Writer.odt.ott.sxw.stw Calc.ods.ots.sxc.stc Impress.odp.otp.sxi.sti Draw.odg.otg.sxd.std Base.odb HTML Writer/Web (.html).oth (.html).stw Writer.odm.sxg Math.odf.sxm OOo v1 Only OOo v2 Text, Spreadsheet, Presentation and Draw are covered by OpenDocument v1 specifications. DGA/CELAR 29/11/2006 Diapositive N 10 / 6036

11 OpenDocument ZIP : content.xml: styles.xml: meta.xml: (,, ) settings.xml: Ooo META-INF/manifest.xml: : : JPEG, PNG, SVG, / / OLE DGA/CELAR 29/11/2006 Diapositive N 11 / 6036

12 OpenOffice OpenOffice v2.0.x 4 : Basic, Javascript, Java (Beanshell), Python UNO : UNO: Universal Network Objects API: OpenOffice. (document open, ). DGA/CELAR 29/11/2006 Diapositive N 12 / 6036

13 OpenOffice MS Office : ( ): ( ):.. :. : only MS Office 97 OpenOffice :. DGA/CELAR 29/11/2006 Diapositive N 13 / 6036

14 OpenOffice DGA/CELAR 29/11/2006 Diapositive N 14 / 6036

15 OpenOffice OOo Basic Java, Javascript Python Scripts : Basic/Standard/Module1.xml Scripts/beanshell/Library1/MyMacro.bsh Scripts/javascript/Library1/MyMacro.js Scripts/python/MyMacro.py DGA/CELAR 29/11/2006 Diapositive N 15 / 6036

16 OpenDocument OLE OLE OpenDocument OLEobject (Windows ). OLE object. Microsoft OLE2 ( ) OLE Package ( ). DGA/CELAR 29/11/2006 Diapositive N 16 / 6036

17 OpenDocument OLE OLE OpenOffice OLE object Windows (packager.exe) Windows (2000 SP4) Windows MS : OLE object : cmd.exe /c [ bad commands ] /joke.txt DGA/CELAR 29/11/2006 Diapositive N 17 / 6036

exe) Windows (2000 SP4) Windows MS06-065 : OLE object :

18 OpenDocument HTML : OpenDocument HTML (js or vbs) Java : Java Ooo sandbox OpenOffice sandbox. URLs: directly launched in the default web browser. Hopefully Javascript and VBscript URLs are not permitted by OpenOffice. DGA/CELAR 29/11/2006 Diapositive N 18 / 6036

19 MS Office VBA OpenOffice MS Office VBA OpenOffice. VBA OpenOffice DGA/CELAR 29/11/2006 Diapositive N 19 / 6036

20 ESAT OpenOffice / : De Drézigué, Fizaine, Hansma, In-depth Analysis of the Viral Threats with OpenOffice.org Documents, Journal in Computer Virology, Filiol, Fizaine, Le risque viral sous OpenOffice 2.0.x, MISC magazine n 27, 09/2006. DGA/CELAR 29/11/2006 Diapositive N 20 / 6036

21 OpenDocument MS Office OOo.,,,, OOo PDF OLE objects DGA/CELAR 29/11/2006 Diapositive N 21 / 6036

22 Ooo DGA/CELAR 29/11/2006 Diapositive N 22 / 6036

23 OpenOffice : OpenOffice MS Office OpenDocument OpenDocument ( ) DGA/CELAR 29/11/2006 Diapositive N 23 / 6036

24 Part 2 : MS Office 2007 Open XML Nom de l entité émettrice 30/06/2005 Diapositive N 24

25 MS Office 2007 : : Open XML Open XML : Word:.docx,.docm,.dotx,.dotm Excel:.xlsx,.xlsm,.xltx,.xltm,.xlsb,.xlam Powerpoint:.pptx,.pptm,.ppsx,.ppsm Access:.accdb (binary, not OpenXML) (binary OLE2 files): doc, dot, xls, xlt, ppt, pps, Office 2000, XP and 2003 to read/write OpenXML formats DGA/CELAR 29/11/2006 Diapositive N 25 / 6036

26 Open XML ZIP Open Packaging Conventions (OPC): Microsoft : Open XML, XPS [Content_Types].xml:.RELS files (XML): OPC XML (Word 2007 ): word/document.xml: word/styles.xml: word/settings.xml: docprops/app.xml and core.xml: (,, ) : : JPEG, PNG, GIF, TIFF, WMF, OLE,, DGA/CELAR 29/11/2006 Diapositive N 26 / 6036

27 Open XML Open XML Office VBA Office 2007 : (default):.docx,.xlsx and.pptx :.docm,.xlsm,.pptm x. Office 2007 DGA/CELAR 29/11/2006 Diapositive N 27 / 6036

28 MS Office 2007 MS Office 2000/XP/2003 ( ). MS Office 2007 UI :. DGA/CELAR 29/11/2006 Diapositive N 28 / 6036

29 MS Office 2007 : DGA/CELAR 29/11/2006 Diapositive N 29 / 6036

30 DGA/CELAR 29/11/2006 Diapositive N 30 / 6036

31 , 3 ( ). =>! : DGA/CELAR 29/11/2006 Diapositive N 31 / 6036

32 MS Office 2007 binary OLE2 : Word: word/vbaproject.bin Excel: xl/vbaproject.bin Powerpoint: ppt/vbaproject.bin XML draft 6036 OLE2. : Word 2007 (.docm) Document_Open Word in word/vbadata.xml : <wne:eventdocopen/> DGA/CELAR 29/11/2006 Diapositive N 32 / 6036

33 OLE Open XML OLE. Excel Word Excel An OLE ( ) OS (packager.exe). DGA/CELAR 29/11/2006 Diapositive N 33 / 6036

34 OLE Word OLE word/embeddings. OLE ( xlsx in docx). OLE MS OLE2. DGA/CELAR 29/11/2006 Diapositive N 34 / 6036

35 MS Office 2007 LA RHDtool for Office 2003/XP, OLE DGA/CELAR 29/11/2006 Diapositive N 35 / 6036

36 MS Office 2007 ( ( ) :, MS Office 2007 (, OLE, ) Open XML : VBA, OLE,.xlsb, (Open XML ) OpenXML Office 2007 Open XML DGA/CELAR 29/11/2006 Diapositive N 36 / 6036

37 Part 3 : Nom de l entité émettrice 30/06/2005 Diapositive N 37

38 2 : OpenOffice MS Office 2007 : SMTP, HTTP, FTP proxy DGA/CELAR 29/11/2006 Diapositive N 38 / 6036

39 OpenOffice MS Office ActiveX,. OLE Package C:\Windows\System32\Packager.exe if DGA/CELAR 29/11/2006 Diapositive N 39 / 6036

40 OpenOffice :? : :? :, PKI : + : DGA/CELAR 29/11/2006 Diapositive N 40 / 6036

41 MS Office 2007 ActiveX :. disable all macros except digitally signed if signature is used. And disable the Message bar notifications to block unsigned macros. HKLM. : Currently Office 2007 Beta 2 TR GPO ( Office 2007 Resource Kit ) DGA/CELAR 29/11/2006 Diapositive N 41 / 6036

42 ? DGA/CELAR 29/11/2006 Diapositive N 42 / 6036

43 OOo Office 2007 OLE. PDF : PDF. DGA/CELAR 29/11/2006 Diapositive N 43 / 6036

44 Part 4 : OpenDocument OpenXML Nom de l entité émettrice 30/06/2005 Diapositive N 44

45 / active content filter ( ) OpenDocument Open XML DGA/CELAR 29/11/2006 Diapositive N 45 / 6036

46 OpenDocument OpenDocument : : OLE : Object* content.xml : OLE : <draw:object-ole> : <text:script> : <draw:applet> : <draw:plugin> events : <office:event-listeners> DGA/CELAR 29/11/2006 Diapositive N 46 / 6036

47 Open XML Open XML : : vbaproject.bin vbadata.xml ( vbaproject / vbadata, [Content_Types].xml) : entrymacro, exitmacro, OLE : *.bin ( oleobject ) DGA/CELAR 29/11/2006 Diapositive N 47 / 6036

48 Open XML Open XML :.docx,.xlsx and.pptx: OK, no macros..docm,.xlsm,.pptm: NOK, macros. OLE.docm.docx ( Word ) :.docm.doc.docm DGA/CELAR 29/11/2006 Diapositive N 48 / 6036

49 ZIP : OpenOffice: zip d mydoc.odt Scripts/* Basic/* object* Open XML: zip d mydoc.docm *.bin : zip d, whereas! «scripts/*» zip XML DGA/CELAR 29/11/2006 Diapositive N 49 / 6036

50 Python : ( ) import zipfile, sys try: infile = zipfile.zipfile(sys.argv[1], "r") outfile = zipfile.zipfile(sys.argv[2], "w") except: sys.exit("usage: %s infile outfile" % file ) for f in infile.infolist(): fname = f.filename.lower() if not fname.startswith("scripts") \ and not fname.startswith("basic") \ and not fname.startswith("object") \ and not fname.endswith(".bin") : data = infile.read(f.filename) outfile.writestr(f, data) DGA/CELAR 29/11/2006 Diapositive N 50 / 6036

51 OpenOffice manifest.xml content.xml : Scripts/python/BadMacro.txt Ooo Scripts Basic DGA/CELAR 29/11/2006 Diapositive N 51 / 6036

52 Office 2007 Open XML VBA Word : vbaproject.bin dummy.txt word/_rels/document.xml.rels [Content_Types].xml bin by txt! => Office 2007! XML. DGA/CELAR 29/11/2006 Diapositive N 52 / 6036

53 Open XML «ASCII 7 bit» Internet Explorer Office 2007 XML ASCII (7 ) : 8 «obfuscation bit» : <?xml version="1.0" encoding="us-ascii" standalone="yes"?> ¼HIDDENTAG¾ malware[ ] ¼/HIDDENTAG¾ DGA/CELAR 29/11/2006 Diapositive N 53 / 6036

54 Open XML UTF-7 UTF-7 : <?xml version="1.0" encoding= UTF-7" standalone="yes"?> +ADw-HIDDENTAG+AD4- malware[ ] +ADw-/HIDDENTAG+AD4- ECMA, Open XML UTF-8 or UTF-16 encodings! UTF-7 US-ASCII MS Office 2007 (OpenOffice XML ) DGA/CELAR 29/11/2006 Diapositive N 54 / 6036

55 ZIP ZIP ( ) : ( ) ZIP : DGA/CELAR 29/11/2006 Diapositive N 55 / 6036

56 ZIP : File 1 Name: Document.xml, size: 4000 File 1 (compressed) File 2 Name: vbaproject.bin, size: 1024 File 2 (compressed) File 3 Name: HiddenMalware.exe, size: File 3 (compressed) Central Dir File 1: Document.xml, size: 4000 File 2: nothing.xml, size: 1024 File 3: nothing2.txt, size: 0 DGA/CELAR 29/11/2006 Diapositive N 56 / 6036

57 OOo and MS Office 2007 ZIP OpenOffice ZIP : ZIP / MS Office 2007 ZIP! / DGA/CELAR 29/11/2006 Diapositive N 57 / 6036

58 / ZIP ( ) (Zip64,, ) XML XML (UTF-8, ) ( ) XML (XSD, RNG) XML : Open XML named.doc, easier said than done. ;-) DGA/CELAR 29/11/2006 Diapositive N 58 / 6036

59 Nom de l entité émettrice 30/06/2005 Diapositive N 59

60 OpenOffice OpenDocument MS Office 2007 Open XML (1) ZIP XML, OOo: 1 Office 2007: 3 OLE (MS OLE2 ) OS DGA/CELAR 29/11/2006 Diapositive N 60 / 6036

61 OpenOffice OpenDocument MS Office 2007 Open XML (2)( Open XML OpenDocument (,,, ) / OLE PD (ZIP, XML) DGA/CELAR 29/11/2006 Diapositive N 61 / 6036

62 OpenDocument Open XML :, ZIP, XML OpenOffice Office 2007, OLE, HTM,, ActiveX, DGA/CELAR 29/11/2006 Diapositive N 62 / 6036

63 : Some ZIP XML ( ) Office 2007 DGA/CELAR 29/11/2006 Diapositive N 63 / 6036

64 ZIP XML OOo MS Office ( ZIP/XML, OLE, ). DGA/CELAR 29/11/2006 Diapositive N 64 / 6036

65 The End <??> See for updates DGA/CELAR 29/11/2006 Diapositive N 65 / 6036

66 ( ) DGA/CELAR 29/11/2006 Diapositive N 66 / 6036

67 PowerPoint 3D OLE Excel! ;-) DGA/CELAR 29/11/2006 Diapositive N 67 / 6036

68 : MS Office API ( / ) OLE cmd.exe,,,,,, DGA/CELAR 29/11/2006 Diapositive N 68 / 6036

69 OpenOffice - UNO UNO UNO: Universal Network Objects API: OpenOffice UNO (C++,.NET, Java, Python, ) OpenOffice UNO ( ) DGA/CELAR 29/11/2006 Diapositive N 69 / 6036

70 OPC: Open Packaging Conventions Open XML OPC files: ZIP XML ( ) relationships ( ).rels XML OpenDocument OPC : XPS: Microsoft PDF DGA/CELAR 29/11/2006 Diapositive N 70 / 6036

71 Excel 2007.xlsx : ( ).xlsm:.xlsb: XML.xlsx/.xlsm ZIP XML (BIFF ) (.rels),, (.xlsm ) DGA/CELAR 29/11/2006 Diapositive N 71 / 6036

72 Office HTML MS Office 2003 HTML ( ) HTML/MHTML OpenOffice MS Office 2007 B2TR HTML Open XML Office 2007 Office2003 HTML DGA/CELAR 29/11/2006 Diapositive N 72 / 6036

73 Office 2007 «MS Office / VBA» OpenOffice VBA / DGA/CELAR 29/11/2006 Diapositive N 73 / 6036

74 / :. (Word ): C:\Program Files\Microsoft Office\Templates Writable by administrators and power users only C:\Documents and Settings\user\Application Data\Microsoft\Templates Writable by user only C:\Documents and Settings\user\Application Data\Microsoft\Word\Startup Writable by user only MS-Office HKCU HKLM DGA/CELAR 29/11/2006 Diapositive N 74 / 6036

75 HTML : UTF-8 encoding ( ASCII ) <SCR<script>remove me</script>ipt> DGA/CELAR 29/11/2006 Diapositive N 75 / 6036

76 .NET API: System.IO.Packaging The new System.IO.Packaging API provides Open Packaging Conventions files access to.net applications. Open XML and XPS documents. Allows to develop Open XML security filters. For example, Microsoft provides a VBA removal code snippet. Windows OpenDocument DGA/CELAR 29/11/2006 Diapositive N 76 / 6036

77 OOoPy OOoPy OpenDocument Python ZIP / XML. Open XML. DGA/CELAR 29/11/2006 Diapositive N 77 / 6036

78 ZIP ZIP Open XML Zip64 compression ZIP. DGA/CELAR 29/11/2006 Diapositive N 78 / 6036

79 XML OpenDocument Open XML XML (XSD or Relax-NG). XML XML XML OpenXML Markup DGA/CELAR 29/11/2006 Diapositive N 79 / 6036

1 1.1 PC PC PC PC PC workstation PC hardsoft PC PC CPU 1 Gustavb, Wikimedia Commons.

1 PC PC 1 PC PC 1 PC PC PC PC 1 1 1 1.1 PC PC PC PC PC workstation PC 1.1.1 hardsoft 1.1.2 PC PC 1.1 1 1. 2. 3. CPU 1 Gustavb, Wikimedia Commons.http://en.wikipedia.org/wiki/Image:Personal_computer,_exploded_5.svg