Cross Fax Scripting - New attack techniques use XSS and Fax Machines to Hack Victims
Dr Craig Wright has described a new attack vector known as Cross-Site Faxing (XSF) that abuses weaknesses in OCR 2.0 anti-phishing technology to bypass commercial anti-CSF appliances such as the i-XSS BloggerShield and UBsecure’s new XRCF Webfender 2.1.
On Nov 18, Dr Craig Wright (cwright@bdosyd.com.au) writes to pen-test:
“I have thought of an alternate path to loading a virus bases on a network OCR’d fax server. In the scenario, we have to assume that the system is sending the output to a web front end or HTTP enabled email (not that uncommon).”
Dr Wright subsequently illustrates to the reader what he has previously written using the following hypothetical scenario:
- The system has no input filters and prints all characters to the email, web app.
- The OCR engine is highly accurate and does not add spaces etc.
- The email or web app displays exactly what it received
“Now given that scenario, we have a possible XSS (cross-site-scripting) attack. If there are no filters for an outgoing connection (i.e. no firewall/proxy that strips scripts) and the client browser/email application allows access to the Internet, the attacker could create a script in the page that makes a call to an external system to download a file … a script could also embed a simple XOR obfuscation key to modify the downloaded code. On the web server it would be inert. When XOR’d with the key in the script (after being downloaded and installed), this will thus bypass the AV server (if there is one) and install the malware on the users system. […] Regards, Dr Craig Wright (GSE-Compliance)”
It is interesting to see this challenge considered by the security community. Are there currently any products we can purchase to scan incoming faxes? What about physical mail? A malicious attacker could embed scripting into an application form that is then printed and sent through snail mail to a recipient mail desk which scans the mail and forwards as a pdf or tiff image to the unsuspecting victim.
This attack is very deadly as it takes advantage of embed or macro or client side exploits against pdf or tiff clients and users. This is a very dangerous attack vector that must be explored, and all security consultants are encouraged to alert the wider community of the dangers of Cross Site Faxing and Cross-Site Postage exploits.
xssworm Said,
November 20, 2007 @ 10:42 am
More follow up information for readers to hear expert opinions is below.
Dr Craig Wright (cwright@bdosyd.com.au) wrote to [pen-test]:
—
Scott,
The question was originally posed as “Can anyone send a fax that includes a file infected with the virus/ worm” (Wed, 07 Mar)
My concern was not with sanitisation as you are trying to suggest. It is with the idea that a buffer overflow is the attack vector. That for instance a virus / worm could be embedded. This is a suggestion that I remain in disbelief of.
What I suggested is an alternative. Rather then sending a virus/worm, send a XSS attack and rely on the users in the organisation to exploit this.
If this is sent in a PDF, it is going to display as the scripted entry. So a conversion to an attached PDF is still not going to work as what is displayed is what is on the page. It will need to be sent directly to a web enabled email or web server.
So it is not that I am suggesting an attack against the document processor, but rather extending this by adding user interaction. It is thus the user who extends this through reading email with the link or opening a page. In this case the site would still also have a simpler attack against the user in any instance.
I also believe that you suggested “If you allow the asterisk and parenthesis through, you run the risk of allowing SQL injection passed to your service.” The idea you stated other then a buffer overflow was a SQL injection. Neither of these are valid. You failed to consider XSS and having user involvement at the time. I did not think of this either. If you had suggested this I would have conceded that as an attack vector has I now have.
The suggestion that an embedded buffer overflow or binary attack against the fax server is still out of the question.
You for example stated:
“The communication is one-way as Craig so eloquently pointed out. But what if the command is to drop a database? In that case there was never any intention of receiving data back, it’s a malicious vandalism of your database.”
Again, this is not a valid path or attack vector Scott. You are attempting to add too much complexity. So consider a XSS as a simplification of your idea. By over complicating the idea to send SQL commands to an unknown database or worse embed a buffer overflow (which I am still wondering how you could even propose as I see no way to fax a NOP sled) you take the thesis to a level where it may not be supported.
Regards,
Dr Craig Wright
“You are attempting to add too much complexity.” - Dr Craig Wright