Web2Own: Attacking Desktop Apps From Web Security's Perspective

Presented at DEF CON 27 (2019), Aug. 8, 2019, 2 p.m. (45 minutes)

People are always talking about binary vulnerabilities when attacking desktop applications. Memory corruptions are always costly to find. Meanwhile, mitigations introduced by operating systems make them harder to be exploited. More and more applications are using hybrid technologies, so we can try web security tricks to pwn them reliably with less effort. Our presentation will summarize attack surfaces and methods to find security issues in desktop applications. In particular, we will explicate some real-world cases, such as chaining multiple vulnerabilities (information leaking, CSP bypass, opened debugging port) to achieve RCE in a specialized IDE, sensitive file leaking in famous editors, privileged APIs abusing in many IM applications and so on. During our research, we find some issues actually reside in popular libraries. These flaws may affect more applications than we will demonstrate in this talk. Web security knowledge is usually unfamiliar to desktop application developers. Attacking desktop apps using web security tricks is a non-competitive "blue ocean". Our presentation will focus on many design misconceptions and implementation mistakes in desktop applications. By sharing these representative lessons, we hope to help desktop application developers improve the security of their products.

Presenters:

• Jianing Wang - Security Researcher in Tencent Security Xuanwu Lab
  Jianing Wang, Security Researcher in Tencent Security Xuanwu Lab, member of Syclover, is focusing on vulnerability research and web application security.
• Ce Qin - Security Researcher in Tencent Security Xuanwu Lab
  Ce Qin, Security Researcher in Tencent Security Xuanwu Lab for 3 years, focus on software security, mainly on browser and Desktop software.
• Junyu Zhou - Security Researcher in Tencent Security Xuanwu Lab
  Junyu Zhou, Security Researcher in Tencent Security Xuanwu Lab, CTF player from 0ops/A*0*E, is focusing on vulnerability research and web application security. Speaker of HITB2018Dubai and ZeroNights2018.

Links:

• https://defcon.org/html/defcon-27/dc-27-speakers.html#Zhou
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Junyu Zhou - Web2Own Attacking Desktop Apps From Web Securitys Perspective.mp4
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Junyu Zhou - Web2Own Attacking Desktop Apps From Web Securitys Perspective.srt (subtitles)
• https://www.youtube.com/watch?v=uXUA24xJsRQ

Similar Presentations:

• Kernelcon 2020 Virtual / Exploiting Modern Desktop Applications
• Kiwicon X: The Truth is In Here (2016) / Out of the Browser into the Fire: Exploiting Native Web-based Applications
• THOTCON 0x6 (2015) / Bypassing the Secure Desktop Protections