QuickShell：分享即关爱——针对 QuickShare 的远程代码执行攻击链.pdf

1、Sharing is caring about an RCE attack chain on Quick Share Security Research Team Lead at SafeBreach 7?years in Security Research Past research in Linux,embedded,Android 4 years Windows research 6?years in Security Industry Past APT Malware Researcher 4?years Windows research Why Quick Share Protoco

2、l Overview Fuzzing Research Approach Shift?Vulnerability Discovery RCE Chain Takeaways GitHub?Q&A“were working with leading PC manufacturers like LG to expand Quick Share to Windows PCs as a pre-installed app.”Google:Various communication methods 1st time by Google on Windows 2019 by Daniele Antonio

3、li,Nils Ole Tippenhauer,Kasper Rasmussen:“Nearby Threats:Reversing,Analyzing,and Attacking Googles Nearby Connections on Android”About Nearby Connections API Only Android No CVEs https:/francozappa.github.io/publication/rearby/paper.pdf Contain part of the code for Quick Share for Windows New Window

4、s App?New App New vulns Windows app will be pre-installed Various communication methods?Various attack vectors Googles first Windows app to use these APIs Some of the code is open-source No CVEs Finding the communication functions?Send&Recv:offline_wire_formats.proto stHooking Quick Share to sniff s

5、ent and received Offline Frames on Windows Nearby Connections API Quick Share Implementation Protobuf Based Encryption?Googles Ukey2 Advertisement based on Service ID Multiple Connections Strategies P2P,Star,Cluster CONNECTION_REQUEST Ukey2 Client Init Ukey2 Handshake Completed CONNECTION_REQUEST Uk

6、ey2 Server Init Ukey2 Client Finish Ukey2 Client Init Ukey2 Key Exchange Proprietary communication begins CONNECTION_REQUEST Connection Response Connection Response Ukey2 Key Exchange Proprietary communication begins CONNECTION_REQUEST Connection Response Connection Response Enforces“Contacts”and“Yo