is
uh
is
all right everyone welcome to our next
talk
uh just a couple quick notes before we
jump in the next talk
there was a schedule change there was a
talk schedule at 10 o'clock tonight on
social studies steganography that has
been moved to tomorrow morning at 10 a.m
uh in its place there will be a talk
called medical devices security and
privacy issues he's not dead jim not
really so that talk will be here at 10
pm tonight please come and and see it it
would be great
a
couple other notes thank you for wearing
your mask throughout the show we really
appreciate it it really helps us
remain keep keep with our commitment to
preserving our health and our sanity
uh
hackers got talent is tonight so if you
are interested please go in you don't
need to sign up in advance just walk up
and you can go in and participate
lastly workshops definitely need more
helpers for today and for tomorrow so if
you're interested in being a volunteer
and helping out in workshops please go
either the info desk or try and find
mitch either through the
matrix chat channel or
find him walking around in person
lastly please meet your phone during the
talk because the audio equipment is very
sensitive and we want to make sure that
we don't interrupt the talk
our next talk is on the ransomware
protection full of holes
from soya ayama so with that we'll pass
you on the soya enjoy
you're alive right now
you can go ahead
integration rabbit immediate
and
a honda and organized help inside tokyo
unfortunately
i could not
go to new york
because my boss did not allow me to
travel
now
it's
5 am
in tokyo
so i'm very sleepy
okay
today
i will give a presentation entitled
the last meal protection
of horse
may 12th
2017
do you remember
yes
it's the day of cyber attack by varacry
when i cry cause
tremendous damage
or of the world
microsoft has given one answer to learn
somewhere
if presented by one occli
it's
literally
nasa where protection
microsoft has added
a ransomware protection feature
in the windows 10 or greatest update
of the 2017 release
the new feature helps stop customer from
accessing important files in real time
even if
num somewhere infects the computer
when the feature enables
it protects
folder allowing only authorized apps to
access files
the foundation of windows ransomware
protection
controlled for the access
and
consists
of
protected folders
and
arrow and absolute control for the
access
note that
controlled all the access is disabled by
default
you need
administrator privilege to enable it
protected folders are folders that
protect your files
from being encrypted by nasa where
here you can add the folders you want to
protect
however the default projected folders
such as documents
or pictures are listed
even if you don't specify them
arrow and absolute control folder access
are apps that
can access protected orders
it says that
apps determined by microsoft as friendly
are always arrowed
but
they are not listed by default
unfortunately
microsoft's nasa may protection is full
of holes
so many researchers are researching way
to bypass nasa protection
this is the techniques to
exploit the inclusion of office apps in
the white list
and bypass control holder access using
office ore objects
this is the technique to bypass control
folder access that
writing the encrypted data from
memory to a new file
and
then using the
rename code to
replace the original file
this is a technique to bypass control
holder access that
takes
advantage of
the fact that security features are
disabled
when windows starts in safe mode
and
my research a technique to bypass
control holder access using
dll injection
this is
explained in detail
in
2018
when i was researching on ransomware
production
i found that file explorer has access to
protected orders
i use
the computer object model hijacked
to inject a merchant's dna into file
explorer
because com objects are managed
in the registry
they can be hijacked by
editing the registry
to
reference managers payloads rather than
this
estimate com object
under context many hundreds in include
a list of shell extensions
used by file explorer
i focus
on the
on this gu id
in that list
if
you search
for this guid in the registry
you will find it under clas id
so
this guid is the series id that
identifies the com object
and
the default value for
mproc server 32 is 032.dll
if you can change
this to myself dll
you can inject in and
inject it into file explorer
but
you cannot
change this
directory
because it's
managed view of its key classic route
as
described in msdn
the managed view of hp classes route
displays the money's value
hkey local machine and hd current user
and
if both have value
hkey current user will take
proceedings
in the case of this cls id
there is a value in hkey local machine
but
not
in hd current user
so
if you add the value to its
hd current user
you can change value of hd classes root
write a command
in a batch file
to add the path of the merciful
hd current user
in start file explorer it will load the
malicious dll
the mesh sdn runs on file explorer
process
so it can encrypt
rotated for our files
this completes the lassomen
poc
of course
i deported this research result to micro
microsoft
but
they told me that
this is not security vulnerability
for following
reason
resided
are predicated
of
the attacker having logging access
to the target
account already
since you are only able to write to hkcu
you will not
be able to affect other users
the earth's soul does not appear to be
escalation of privileges
and finally
it
would appear the attacker would not
again
gain
anything
from this attack
the attacker would gain nothing from
this attack
so
i have
presented this research at similar
conference
this is my
previous
research
well
our hopes artists
in
2021
introduce
windows 10 national production as
effective in
protecting against ransomware
i questioned the windows 10 natural
protection is effective
out of this article
as
i thought my peoc was still valid
and could easily be included
but
just to be sure
i learn my poc on the latest windows
here is a video of the poc
i mentioned earlier learning on windows
11
here
the image of the antenna is
preserved in the high pictures folder
next
open the lasso protection settings
screen
and
enable contour folder access
plants match files that
are being successfully encrypted in the
past
the program was blocked
and
the program
the ekina is safe
finally a check of the block history
so that
the contour folder access protected this
picture folder from the file explorer
as you can see my previous
ex
exploitation is now no longer valid
microsoft said
my report is not vulnerability
but
they had
secretly fixed it
i was so trusted
that i decided
if there were any other holes
in the ransomware production
i checked control folder access registry
and the list was empty for
both
arrows applications and
rotated orders
the
default protected folders
such as documents and kick charts which
we discussed
in the first section
were not in protected orders
the default preset folder is in another
registry
and
is in hd current user
this means that folders protected by
default can be
changed with user privileges
when you actually check
the
property of picture folder
it says
you can change
a good idea
but a bad idea for microsoft
just
pops into my head
what happens happens
if you
if you change the location of picture
folder
before change
for that
eyes are protected and
cannot be
encrypted but
by change folder
files in the original folder
are not longer protected
and should be able to be encrypted
i actually try it
a new batch file
this time
reboot the system
after
changing the user folder
this is because the syst
system needs
a level to
recognize the changes
user folder
but
debuting
takes a long time
and i hate it
i'll go with more
unfortunately max has not rotated the
ekina
take
the blog history
out before
there's nothing in the block e3
yes
i
outfox microsoft again
microsoft miss
stimp things like this
well
ah sorry
well don't you want to know my first
the option to this viral tv ipod
what a surprise
this time
it's just
this one phrase
because control of the access is the
defense in depth security features
we cannot
accept merchants to deal with last
representation issue
we need to inform
many people
about this issue
so i created a poc looks even more
dangerous
i'm using the
component object model hijacking
method again
or injecting dln into file explorer
actually
component object order hijacking
can specify the network path
in other words
if you can write
the registry by exploiting
any vulnerability
you can encrypt the file without sending
vl to the target
i use
the cb 2018
3035
command index i command the injection
viability in this poc
this
this is a viability about apache
server
now let me show you
the ekina is safe
open the lasso protection
accepting screen
and
enable control folder access
check
the ip address
and
use it to execute the tica server
from here
the attacker
use
a carry to attack
the target
the message deal is on curry
are created as a samba
user using
ebay edit
and restart
already complete
i created a shade that
it executes the python scripts
downloaded from
expo
excluding
its arguments
the argument is a command to be executed
on the target
which is the change and execute
logical time
unfortunately microsoft could not rotate
the akina
yes
i brilliantly included files remotely
will
microsoft's
secretary fix it again
probably yes
in summary
as you can see this time
i could encrypt
the user data
in a very easy
and very ridiculous
way
it is so simple that
anyone can easily
imitate
i imitate it
but please never create rasam area using
this method
i think
backup is the only way
to protect your data from run somewhere
i suggest that you always
have a backup of your data
okay my presentation is over
thank you
all right thank you so much soya this is
a chance for anyone to ask any questions
he can't directly you hear your
questions but we can either have you i
can walk up to the mic we can bring the
mic around if anyone has a question or
you can relate to me and i'll relay it
to him
so the question soy is what was
microsoft's reaction or what was your
reaction back to microsoft from the
email you received saying it wasn't a
problem
did you hear the question soya
did you hear the question
ah
so
microsoft
says
[Music]
of course any other questions
all right well thank you again for the
talks toy it was fascinating and thank
you audience for
participating and please come back for
our next talk at the top of the hour
right what is our next one
right to repair
fixing the dmca and legalizing tinkerine
you