Tomorrow at the Black Hat USA conference in Las Vegas, James Forshaw, a Principal Security Consultant at Context Information Security, will be presenting details of vulnerabilities discovered in the .NET framework that allow malicious remote code execution from within .NET applications. His paper, ‘Breaking .NET Through Serialization’ is also published today at: www.contextis.co.uk/research/white-papers/areyoumytype
Earlier this year, Microsoft released a patch to mitigate the risks after Context made Microsoft aware of the .NET vulnerabilities and helped to fix the issues. The patch makes changes to the workings of the serialization framework, a fundamental feature of .NET applications that allows data or objects to be easily transferred and stored. The risks identified by Context could allow an attacker to target an application, either via a remote interface or through code running within a sandbox, in order to disclose information such as authentication details or to circumvent security measures to execute code under malicious control. The applications in question could be remotely accessible business services, local privileged applications or sandboxed environments such as XAML browser applications.
“The process of serialization is a fundamental function of a number of common application frameworks due to the power it provides a developer,” says James Forshaw. “The .NET framework provides many such techniques to serialize the state of objects but by far the most powerful is the Binary Formatter, a set of functionality built into the framework since v1.0. The power provided by this serialization mechanism, the length of time it has been present, as well as the fact it is tied so closely into the .NET runtime, makes it a significant attack threat.”
The Context whitepaper describes some of the fundamental vulnerabilities which allow remote code execution, privilege escalation and information disclosure attacks against not just sandboxed .NET code such as in the browser, but also remote network services using common framework libraries. Understanding the attack techniques, which could also apply to other serialization technologies, will help developers to avoid common mistakes with binary serialization, says Context.
For more information about the Black Hat USA 2012 in Las Vegas, from 21-26 July, please visit: https://www.blackhat.com/html/bh-us-12/bh-us-12-briefings.html#Forshaw
The Microsoft patch for these issues can be viewed and downloaded at: http://technet.microsoft.com/en-us/security/bulletin/ms12-035
For more information on Context, visit www.contextis.com
About Context
Context was launched in 1998 and has a client base that includes some of the world’s most high profile blue chip companies, alongside government organisations. An exceptional level of technical expertise underpins all Context services, while a detailed and comprehensive approach helps clients to attain a deeper understanding of security vulnerabilities, threats or incidents. The company’s strong track record is based above all, on the technical skills, professionalism, independence and integrity of its consultants.
Many of the world's most successful organisations turn to Context for technical assurance, incident response and investigation services. Context is also at the forefront of research and development in security technology. As well as publishing white papers and blogs addressing current and emerging security threats and trends, Context consultants are frequently invited to present at open and closed industry events around the world. Context delivers a comprehensive portfolio of advanced technical services and with offices in the UK, Germany and Australia, is ideally placed to work with clients worldwide.
Distributed on behalf of PRPR by NeonDrum news distribution service (http://www.neondrum.com)