A Sheep in Wolf’s Clothing – Finding RCE in HP’s Printer Fleet
foxglovesecurity.com/2017/11/20/a-sheep-in-wo...Posted Nov 20, 2017, 7:31 PM UTC
585
foxglovesecurity.com
This was a really great read! Thanks for the write up !!!
2
HP just released the security bulletin to complement this issue https://support.hp.com/nz-en/document/c05839270
0
This is beautiful. So as I understand, the problem was that the signature verification did not restrict to code that could be executed in the DLL. That is, you could find a way to insert your own code while making the signature verification pass by having the signature verification only apply to the portion of the DLL that corresponded to a legitimately signed HP library. No need to break the crypto if you can wiggle your way around it. Well done :-)
Exactly! We were able to control the location within the DLL that the signature verification method was actually being applied to. We just stuffed some valid, signed code at the end of our malicious DLL and pointed it to that.
It's interesting though that HP didn't make this same mistake with their firmware signature verification. With that one, they verify the entire binary file and I didn't see any way around it.
haha, different people writing different crypto verification code.
Very nice writeup, btw :-)