Hacking: The Next Generation

Finding Blended Threats

Although protocol handlers represent one of the most fruitful avenues for exploiting blended threats, attackers can use other techniques (as evidenced by the Conficker worm). Attackers can pinpoint possible blended vulnerabilities by examining the interaction between different software and determining whether behavior from one application can take advantage of a security weakness in a different application. Typically, the key piece to focus on is any bridge between the two different applications. In many of the examples we presented in this chapter, application protocol handlers provided the bridge between different applications. In the case of the Safari carpet bomb, the sqmapi.dll file on the user’s desktop created a link between the Safari browser and the Internet Explorer browser. In the case of the Conficker propagation techniques, the removable media, loose Autorun.inf parsing, and network shares provided the bridge from one system to the next. Although the examples presented in this chapter focused on blended attacks launched from the browser, blended threats are not limited to the browser. Application protocol handlers, for example, have nonbrowser attack vectors such as Word documents, PowerPoint documents, Excel spreadsheets, and PDF files. Identifying where the bridges are is essential in blended attacks and exploitation.

Attackers also attempt to identify security assumptions (both implicit and explicit) made by software packages. Once these assumptions ...