Analysing a Firefox Malware browserassist.dll - FLARE-On 2018

[@liteoner]

5:48 when a Mac/Linux user first encounters modern IE

[@PwnFunction]

LOL

[@firefish111]

I send a smile, not a frown.

[@liteoner]

@@Anti-i25 Microsoft does this in many products, including Office

[@TimLF]

Firefox had the smile feature for a long time...

[@k1ngjulien_]

windows users too, noone opens IE on purpose :D

[@aumpalosa]

Man, I don't know, but something in the way you explain things, the way you organize your thoughts, or maybe the way you confidently talk, makes your videos fun to watch. Not to mention the actual great information that you learn from them. Keep it up. You are really up for something great.

[@CarlvanEijk]

man, I was thinking exactly the same thing!!

[@Hans5958]

Linux user being paranoid on Internet Explorer

[@kirschitz64]

stop WINEing

[@zombie_pigdragon]

@Alfie Yes, though it's just a program, not an apt package (apt does package it though).

[@gersomwastaken]

:eyes:

[@bumbixp]

The funniest thing about that IE smiley is the keyboard shortcut for sending a frowny face.

[@rootabeta9015]

5:51 LiveOverflow: "Is this a virus?"

[@sashimisub8536]

Lol

[@cy8berpunk831]

"I decided to approach it again with logic" 😂👍

[@richardp7412]

It would be amazing if you started a 0 to hero series explaining the basics of reverse engineering malware, as someone who also enjoys malware I find your videos fascinating but I would always love to learn more from you.

[@TB-tv2zf]

Vouch

[@martysh1226]

a bit late, but check out his binary exploitation videos. this should get you started.

[@zecekobold2140]

Well... This is neat. Not entirely sure why youtube decided this is my jam, but I do appreciate a good explanation and seeing someone put a lot of effort towards something.

[@chylex]

Maybe it was an NPAPI plugin, those stopped being supported in FF 52.

[@oisins.6066]

All new addons have to use the WebExtensionsApi now, which is quite limiting in some ways, so they probably wrote the addon on the old api

[@samfoxman7046]

For some reason, the malware prevents itself from running if firefox is newer than version 55. Probably, the developers wanted to make the challenge more difficult.

[@alfoncejean8826]

6:00 *open IE *see the smile thing *OK this actually exist!

[@lonelycount1]

I dont understand shit here but i feel a lot smarter now, thanks @LiveOverflow.

[@anishagrawal7068]

ur videos are amazingggg!!Thanks for bringing such quality content

[@adfadff6361]

There is a function to get version of ur firefox in that .dll file. Btw, ur way to solve this challenge is awesomeeeee =]] i never imagine u can solve this challenge in ur way =]]]] amazing video

[@zanidd]

wow, didn't know about flare vm! Might get into analysing malware soon as well! thanks for the great video, as always!

[@kiritsu9582]

i have little to no idea what youre talking about but im loving every second of it

[@justfaysou738]

This is very complex but interesting, ty for your contents

[@RobinObinray]

Ty😠 LEECHERS!!!!!

[@asafcohen3562]

This not that complicated look at his other stuff

[@Zooiest]

You can try shutdown -a when you boot the VM. Also Ctrl + Alt + Del when shutting down and opening task manager from there actually interrupts the shutdown... I found the last one myself testing the very combination on shutdown

[@TymoteuszCzech]

12:37 laughed my head off :D

[@user-vn7ce5ig1z]

Sadly, he's right. Adults ain't got time for solving problems and enjoying the challenge of it; we've got stuff to get done!

[@strategyoracle]

What was the mechanism by which the browserassist.dll got loaded into the Firefox process? Did I miss something?

[@LiveOverflow]

I have no clue 🤷‍♀️

[@strategyoracle]

@@LiveOverflow SPOILER ALERT: blog.attify.com/flare-on-5-writeup-part2/ "This method adds browserassist.dll to the AppInit_DLLs registry key. The AppInit_DLLs are a set of Dynamic Linked Libraries (DLL) that are loaded upon startup into the address space of every executable that links with user32.dll. Essentially, this means everytime a GUI application is run, browserassist.dll"

[@alexpaww]

It's like LD_PRELOAD on Linux, just using the registry :)

[@alexpaww]

@Richard Vaughn I was saying that it's the same principle. It both instructs the dynamic linker to load certain modules, no matter the scope

[@yellowcrescent]

@Richard Vaughn There is a similar feature on Linux that works globally-- /etc/ld.so.preload -- I've seen Linux malware utilize this to hide themselves from process and file listings.

[@mal-nr3ym]

firefox changed the way they deal with addons in quantum, including dropping support for (i believe) dll/native code based plugins (java, flash, etc.)

[@Mindflayer86]

6:45 Hmm. First thing which came to my mind after I heared that the challenge surrounds around a Firefox maleware was: "Better use an older firefox version for the analysis. They might have patched something"

[@IAMFeelings]

I don't understand most of the things you say but I'm sitting here enjoying your videos hoping one day I do understand.

[@mistsu1171]

I watch this video with no knowledge of hacking, but I really feel entertained and educated by your content ;'3

[@RicardoUngureanu]

The installer drops the dll and sets a registry key. My educated guess is that newer Firefox versions does not take that registry key into consideration when loading dlls, whereas the older version does. I solved the entire challenge statically, it was interesting to bypass a few checks and analyze all the dll requests. If I recall correctly, the dll has some checks then it does 2-3 HTTP requests, retrieves some encrypted data and after a few decryption stages and data manipulation it is possible to extract the javascript inserted into the browser alongside the JSON you observed in the stack trace. At this point, I manually injected the javascript code into my browser (after deobfuscation), ran the commands and got the flag. :)

[@ukaszMarianszki]

The registry key is used by all windows software. (iirc user32.dll injects these dlls from the registry) the dll simply checks the firefox version

[@shans2408]

how can you people check a whole pe file statically? :/ I give up if it is longer than two screen-fulls. teach me, sensei!!

[@amrojjeh]

Microsoft does the smiley thing with ALL of their windows products (And some open source ones too) as far as I am aware.

[@citroenboter]

Ye I think I saw it in Excel as well. It kind of tickled my virey-sense but apparently it belongs there.

[@longcat666]

I love this chall, because like in real case technique at banking malware, it will injection with external dll, which means it hooking the PR_Write function and this only work at old firefox version, CMIIW

[@JonJon2040]

I think that if you find what is the vulnerability by analyzing the dll, you can search for something like "dll injection Firefox", etc. And you'll see approximately in what version it was fixed.

[@jamesmadlangtuta3156]

Right since every infection has a condition to meet.

[@abgehn7869]

This video gave me the missing clue to solve my first CTF (a different one of course) on my own! Thanks a lot! :D

[@itscarve]

I'm sure you're busy.. but... You should totally still make your handwriting into a font ❤

[@eventhorizon8014]

10:00 'su' doesnt mean switch user, it means super user (root). The Linux command which switches to the root user. That's why sudo runs a command as root (super user do).

[@qwertyqwerty-jp8pr]

Yes but su can switch to other user too. It doesn't need to be root

[@qwertyqwerty-jp8pr]

Also, su stands for substitute user

[@vergil9397]

Wow your analysis skill is so good bro

[@danielkrajnik3817]

this is such a great content!

[@kbhasi]

4:45 Oh wow, the old Office 2003 UI kit thing. -5:57-- That was there since Windows 8, and I believe Internet Explorer is still in Windows 10 only for backward compatibility with older applications that use the Trident engine (which IE uses) in order to render Web content.- 6:15

[@mimizdani8194]

i am addicted to watching your videos

[@AmaroqStarwind]

I like puzzles. I want to obfuscate a whole bunch of code that, when deobfuscated, literally just congratulations you for solving the puzzle.

[@_crimson1624]

wow! what valuable material 👍👍👍👍

[@KidJV]

you deserve more subscribers. subscribed!

[@m42d]

I got such a nostalgic feeling when you opened PEid.

[@gokus22]

I'm a simple man. I get notification of LiveOverFlow uploading a video. I watch.

[@gokus22]

PS ~ F

[@martinpaul3383]

Same here.

[@mircoheitmann]

what would we do if the web shell didn't have sl

[@RobinObinray]

Google for solutions?

[@xseman]

So if you update your Firefox because of some vulnerability, the old injected code may work on the latest version? It sounds like the upgrade should clear the cache every time you upgrade.

[@shersanginov1792]

What are some other websites you guys recommend for challenges like flare-on.com?

[@gcanary562]

overthewire.org, hackthebox.eu

[@ИльяАпролов]

root-me.org is also great

[@shersanginov1792]

o

[@blueelvis2698]

As I remember the dll hooking some function to inject the javascript. In newer version of firefox those functions don't exist so it failed :)

[@Napert]

0:18 bruh so I'm vulnerable to attacks and malware just because I want to be private on the internet?

[@MasterNoxob]

your content is great, looking forward to see the next one!

[@FamilienSoelberg]

Flare-on 2018 was so hard. The hardest ever :-0. Took me a month to complete.

[@melihcelik9797]

Can someone explain why the dll was loaded to Firefox's memory map? I mean surely firefox did not request that dll and that dll wasn't even in the firefox folder. How does it get loaded with firefox?

[@ducphanduy534]

I don't recall the exact details of the code but the DLL does do version check of Firefox. If I recall correctly, it's any version before or equals to 40 that works. After the check, the DLL downloads the encrypted javascript from a pastebin and decrypts it.

[@cone16v]

1001000 1101111 1110100 1100101 1101100 111111 100000 1010100 1110010 1101001 1110110 1100001 1100111 1101111

[@videosambo01]

Umm is this normal on ie because i have some kind of smiley in ie and avast or malvare bytes does not reconize it?

[@redd_cat]

A reminder that IE is not broken per se. It's designed like that.

[@h3xad3cimaldev61]

5:48 me laughing my ass off knowing that I have been using Windows for years

[@dracenmarx]

Why does Firefox load a DLL that is stored in Internet Explorer's folder?

[@mugundhanbalaji]

@LiveOverflow you might already know this, to solve complicated key comparisons/generation, we can use Z3

[@LiveOverflow]

modelling this in z3 would have taken the at elast the sameamount or longer ;) Also: kzbin.info/www/bejne/iqHHdaRra7B7Z6s

[@mugundhanbalaji]

@@LiveOverflow ok, i was practicing z3 this week, totally forgot about that video, thanks again

[@asailijhijr]

Does the requirement for the older version relate to Firefox x64 vs x86 ?

[@HugeDisgrace]

Holy shit that was awesome. There is so much out there that i don't know!

[@ErikUden]

I could imagine someone just had the old Firefox because he didn't use a virtual machine as advised.

[@Retrovergo]

Great Job man

[@NOCTUMSEMPRA]

JAJJAAJAJAJAJ 11:21 "Awghh... F!" so funny. I'm just discovering your videos! All of these things you explain are amazing! Even to devs like with some years on the back! :D Super pedagogical, fun, talking pretty advanced shit (I come from the XSS video series you made, so rad) looks like a pretty deserved subscribe, that material must be assimilated by my mind. Greetings from Argentina!

[@user-qe3fh9lw5y]

Any good suggestions of a good /r/ for this community?

[@MoBeigi]

Off the top of my head, maybe using the latest Firefox version matching any datestamp found inside the binaries/strings?

[@Masterrunescapeer]

@LiveOverflow doesn't work in newer FF as web extensions don't allow JS injection (from FF Quantom on-wards). Was actually one of the big motivations of why we moved over. Too bad FF Quantum messed up multiple tab handler, it is annoying. We're finally getting it backed in.

[@Calumg89]

Could you have just set the model root to 1 and bypassed the need for reversing the password, or did the dll inject the extra stuff after the password was right?

[@cocosloan3748]

Congrats ! You are one smart puppy :)

[@Broughman9]

Really enjoy your videos despite not really getting everything. Guess I need to start learning c#, .net etc. I follow along but I would really get stuck if it was me doing the task.

[@kalderetangKambing69]

Nice content! Kudos

[@evertchin]

which also beg an important question, should browser update also invalidate the cache

[@cone16v]

1001000 1101111 1110100 1100101 1101100 111111 100000 1010100 1110010 1101001 1110110 1100001 1100111 1101111

[@Mxmnt]

bit late, but laughed that it uses ConfuserEx to obfuscate the application. Easy to tell by the "ConfusedByAttribute" as well as the decrypting, decompressing method. Also, dnspy is a lot better for reversing .NET applications. It has a clean GUI, stable, gets updated a bit, a IL Viewer; which can be handy in removing anti-debugging calls, such as CheckRemoteDebuggerPresentEx, and more functionality.

[@jazminakarainy]

idk w a single thing in this video but they are fun to watch

[@kisame_5331]

I love your work!

[@cntrix2047]

so why did firefox load a dll located in the ie file location?

[@666222333111]

I think IE just likes to hook up to different browsers, or different browsers just use IE's stuff.. not 100% sure. but using windows you can see these things quite often.

[@Android480]

This stuff looks really fun, but totally out of my skill level at the moment. Do you have / know of any places to find beginner reverse engineering challenges?

[@Kenny-xz4gw]

vulnhub.com hackthebox.eu are good places to start. Helps to know basic linux commands and a little kali knowledge.

[@overratedpancake9034]

That was awesome! I'd love to be able to de this some day, is there a place where I can start learning the basics?

[@TheActualTed]

Can someone explain the part of code with XOR statement? I thought ^ is the symbol for AND / conjuction and don't really understand how it works.

[@LiveOverflow]

In programming languges ^ is often XOR. It doesn’t follow the mathematical logic notation. An AND would be &&

[@no-trick-pony]

It depends on the programming language - in JavaScript ^ is the XOR operator (as it's in many other languages). XOR is just another logical operator like AND/OR/NOT and is the "either/or"-function. Look up the truth table for it. ^^ It is a very intersting function, because its inverse is XOR too. So, if you XOR two bits and get a third one, you can XOR this third one with any of the other two to retrieve the third one. This concept is very useful and used for RAIDs to duplicate data.

[@Kong_plays]

Dont really understand, but it was interesting :)

[@spooles]

The DLL loading behaviour if due to Firefox dropping support for native NPAPI (Netscape) style plugins. You cannot load them anymore since Firefox 52 I think. Browser extensions nowadays are written in JS.

[@LiEnby]

but there is still Adobe Flash capability back then .. so how does that work?

[@LiEnby]

but there is still Adobe Flash capability back then .. so how does that work?

[@elihillman8758]

Me, a Firefox user: *I'm in danger*

[@mirteb.1788]

So is this exploit for Firefox universally, like on Linux or Mac. Cuz I'm worried now

[@mirteb.1788]

Nvm probably not

[@LiveOverflow]

no, it's a malware.

[@Janrupf]

Well, I think it would be possible todo this on other platforms too, however, its not very likely to happen: 1. It was a Windows only Software 2. Its not that easy (for an application, ofcourse there are the PRELOAD variables on Mac and Linux) to inject some code into firefox 3. Looks like that has been patched in firefox or at least the injection doesn't work anymore. Still, it is possible

[@LiveOverflow]

There is nothing firefox can do to prevent this. The reason why it doesn’t work in a newer firefox versions are certainly just compatibility issues. The malware was not written to support these changes.

[@grave0x]

@@LiveOverflow exactly. Firefox still loads user32.dll which is the injection point

[@TheoParis]

This was really interesting!

[@R3gouify]

Why do you have 0x80 in for loop? Why not just a regular number?

[@LiveOverflow]

It is a regular number, or what do you mean? Also I have 0x80 in there, because 0x7F is the last valid ascii number

[@R3gouify]

@@LiveOverflow I just dont understand the format of 0x80. What value does it represent and what is the benefit of using it rather than having plain number like 80?

[@LiveOverflow]

Ah. It's a hex number. So 0x80 in hex is 128 in decimal. It's much nicer to represent byte values as hex numbers than decimal, but you have to get used to it first. The maximum byte number is 0xff, which is so much cleaner than 255. I have a video about "hex numbers" in my binary exploitation playlist. kzbin.info/www/bejne/o4WUh2p_gZd5frs

[@Sollace]

Weird. I've never seen someone exploring the start menu links with the file explorer before. People normally just use the start menu to look at start menu entries.

[@jamesmadlangtuta3156]

Can you include all the softwares and tools you used there in the vid description? Thanks a lot 😁

[@filipstamcar6553]

How that malware works? Why is it stored in Internet Explorer DLL file? Does old Firefox versions use it? Why it does not work in newer versions of Firefox and Chrome?

[@RichterVonFuchs]

How does it work? There's a library called user32.dll, a very basic windows library that is used in GUI programs. There's a registry key in charge of what libraries get loaded with user32.dll and the malware injects browserassist.dll into that registry to be called when a program uses user32.dll. The reason why it affects older version of firefox because the malicious software is specifically checking every software that uses user32.dll and if that program is firefox.exe it'll check what version it is and if it's version 55 or below it'll run the rest of the code. Most likely it only affects those version because they programmed the exploit to only effect those because it was fixed after version 55 or firefox became too different for their code to work after 55 or 55 was the latest version when the malware was made. At this point the malware was modified to have custom injection exclusively for flare-on.

[@filipstamcar6553]

So theoretically it could also attack new versions or other browsers?

[@pavelmisik4303]

Nice video....I love your videos...

[@therealb888]

Damn that’s such a complex challenge! Feeling dumb :( But at least learnt something. Gong to need a few more attempts to learn this well...

[@270jonp]

I cant speak for the .exe as i skipped that during my run. However there was no easy way to figure out the version needed for the .dll other than realizing that it must have been patched. Personally I found twitter to be fairly useful and not really giving away anything.

[@Sollace]

My guess is they knew you needed to use an older version of Firefox because the malware is installed as an extension and in one of their updates Mozilla removed support for most of the old extension apis.

[@chrisw1462]

You say Character correctly, so why the blank do you use a soft 'ch' for functions NAMED AFTER THAT WORD????

[@TheKanam99]

About using old version of firefox, just ask yourself a question - would they publish a malicous code that would be harmfull to current version of highly used browser? I think they are not that evil.

[@LiEnby]

well the malware in this case seems pretty harmless- it doesnt steal your bank or anything..

[@G0NZA11]

Definitely it's better the fridays, I can't watch this with hangover. At least I laugh at 6:26. Y ahora me despido, adios! Tengo que arrastrarme al baño devuelta

[@LiveOverflow]

Lol

[@BarryMcCockinerEsq]

What is your current computer setup?

[@xTunio]

15:06 When you have watched entire Taran Van Hemert's BIG TUTORIAL

[@DarkGT]

He is missing the multiple layers of effects and transitions and his screen looks much cleaner.

[@Menaceirl]

Would you please make a video (or post) at least listing all the software you use? (and preferably what you find them most useful for)

[@centdemeern1]

A trainer wants to battle: You were challenged by elder Internet Explorer

[@Mochi-kane]

Very Thanks !!

[@djrick1999]

Heard on some other video that an older version of firefox had an java injection leak

[@kamilgowacki568]

5:16 >this entry point It must be encrypted

[@OthmanAlikhan]

Thanks for the video =)

[@seanscon]

bruteforce all the versions ?

[@michaelscofield2652]

So if you want to still use this exploit on Firefox just write to the cache.

[@MrHamsterbacke756]

Good idea. I wonder it has any mechanism to prevent this. Because if you could just write your js into the cache, no exploit is needed.

[@RogerBarraud]

Impressive :-) Thanks!