Didier Stevens, a security researcher, writes about malicious PDF analysis and publishes tools for reverse engineering files.
HN commenters recommend his PDF tools as a Swiss Army knife for analyzing suspicious documents and for understanding the PDF format's quirks.
What is the MIME type of a .tar file; and what are the MIME types of the constituent concatenated files within an archive format like e.g. tar?
hachoir/subfile/main.py: https://github.com/vstinner/hachoir/blob/main/hachoir/subfile/main.py
File signature: https://en.wikipedia.org/wiki/File_signature
PhotoRec: https://en.wikipedia.org/wiki/PhotoRec
"File Format Gallery for Kaitai Struct"; 185+ binary file format specifications: https://formats.kaitai.io/
Table of ': https://formats.kaitai.io/xref.html
AntiVirus software > Identification methods > Signature-based detection, Heuristics, and ML/AI data mining: https://en.wikipedia.org/wiki/Antivirus_software#Identification_methods
Executable compression; packer/loader: https://en.wikipedia.org/wiki/Executable_compression
Shellcode database > MSF: https://en.wikipedia.org/wiki/Shellcode_database
sigtool.c: https://github.com/Cisco-Talos/clamav/blob/main/sigtool/sigtool.c
clamav sigtool: https://www.google.com/search?q=clamav+sigtool
https://blog.didierstevens.com/2017/07/14/clamav-sigtool-decode-sigs/ :
sigtool –-find-sigs "$name" | sigtool –-decode-sigs List of file signatures: https://en.wikipedia.org/wiki/List_of_file_signatures
And then also clusterfuzz/oss-fuzz scans .txt source files with (sandboxed) Static and Dynamic Analysis tools, and `debsums`/`rpm -Va` verify that files on disk have the same (GPG signed) checksums as the package they are supposed to have been installed from, and a file-based…
This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently.
SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx
AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<)
SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-srp-with-dll-restrictions/
I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).
The PDF specification is wild. My current favourite trivia is that it supports all of Photoshop's layer blend modes for rendering overlapping elements.[1] My second-favourite is that it supports appended content that modifies earlier content, so one should always look for forensic evidence in all distinct versions represented in a given file.[2]
It's also a fun example of the futility of DRM. The spec includes password-based encryption, and allows for different "owner" and "user" passwords. There's a bitfield with options for things like "prevent printing", "prevent copying text", and so forth,[3] but because reading the document necessarily involves decrypting it, one can use the "user" password to open an encrypted PDF in a non-compliant tool,[4] then save the unencrypted version to get an editable equivalent.
[1] "More than just transparency" section of https://blog.adobe.com/en/publish/2022/01/31/20-years-of-transparency-in-pdf
[2] https://blog.didierstevens.com/2008/05/07/solving-a-little-pdf-puzzle/
[3] Page 61 of https://opensource.adobe.com/dc-acrobat-sdk-docs/pdfstandards/PDF32000_2008.pdf
[4] For example, a script that uses the pypdf library.
This should do:
> In the first demo, I just select the PDF document with one click. This is enough to exploit the vulnerability, because the PDF document is implicitly read to gather extra information.
> In the second demo, I change the view to Thumbnails view. In a thumbnail view, the first page of a PDF document is rendered to be displayed in a thumbnail. Rendering the first page implies reading the PDF document, and hence triggering the vulnerability.
> In the third demo, I use my special PDF document with the malformed stream object in the metadata. When I hover with the mouse cursor over the document (I don’t click), a tooltip will appear with the file properties and metadata. But with my specially crafted PDF document, the vulnerability is triggered because the metadata is read to display the tooltip…
https://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/
TLDR: X.509 certificate collision attack where the uptime of the signing server appears to have been guessed successfully to an accuracy of 1 millisecond (!)
Some further technical details:
Dump of the full certificate chain: http://blog.didierstevens.com/2012/06/06/flame-authenticode-dumps-kb2718704/
Technical analysis and information about the certificate from Microsoft (MSRC): https://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx
Discussion on the cryptography@randombit.net mailing list: http://www.mail-archive.com/cryptography@randombit.net/msg02916.html
svchost.exe is literally what the name implies. It's a generic service host. You pass it a dll and an entrypoint (via command line arguments and registry keys) and it runs it.
You should look at which thing it's actually running to see what's using all your CPU.
Some articles detailing what it does and how it works: [1] https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747 [2] https://pusha.be/index.php/2020/05/07/exploration-of-svchost-exe-p-flag/ [3] https://blog.didierstevens.com/2019/10/29/quickpost-running-a-service-dll/