Trend Micro Data Loss Prevention 5.2 Data Leakage

[nitrØus <nitrousenador () gmail com>]

========================================================
Trend Micro Data Loss Prevention 5.2 (formerly LeakProof)
Data Leakage through certain HTTP/HTTPS channels

nitrØus
http://www.brainoverflow.org
Mexico

###############################################################
I encourage you to take a look to the ilustrated advisory that you would 
find at
http://www.brainoverflow.org/advisories/TrendMicro_DLP_data_leakage.pdf
###############################################################

1.- VULNERABILITY INFORMATION
========================================================
Vendor: Trend Micro
Product Name: Data Loss Prevention (formerly LeakProof).
Vulnerable versions: DLP 5.2 and LeakProof <= 5.0
Product URL:
http://us.trendmicro.com/us/products/enterprise/data-loss-prevention/index.html
Author: nitrØus [ Alejandro Hernandez H. ]
Discovery Date: 09/Sept/2009
Disclosure Date: 01/Jun/2010
Attack Vector: Local
Attack Channels: Some HTTP/HTTPS non-analyzed channels
Impact: Data Theft / Data Leakage / Data Loss
Risk: Medium


2.- PRODUCT INFORMATION
========================================================
Trend Micro Data Loss Prevention (DLP) is a family of solutions that 
secure your
private data and intellectual property, while reducing complexity and 
costs.
You’ll gain broad coverage, high performance, and deployment flexibility 
needed
to comply with regulatory mandates that protect employee and customer data.
Trend Micro DLP solutions also offer advanced DataDNA fingerprinting to 
secure
unstructured data and intellectual property and protect all data modalities:
data at rest, data in use and data in motion.

Trend Micro DLP for Endpoint – non-intrusive monitoring and enforcement 
client
software detects and prevents data loss at each endpoint, across the 
broadest
variety of threat vectors, whether online or off.

Trend Micro DLP Management Server – provides a central point of 
visibility and
control for discovery, fingerprint extraction, policy enforcement, and 
reporting
violations. The server is available as a hardware appliance or software 
virtual
appliance—for greater flexibility and lower costs.

File Types Supported
* Recognizes and processes 300+ file types
* Microsoft Office files including Office 2007: Microsoft Word, Excel,
PowerPoint, Outlook email; Lotus 1-2-3, OpenOffice, RTF, Wordpad, Text, etc.
* Graphics files: Visio, Postscript, PDF, TIFF, etc.
* Software/engineering files: C/C++, JAVA, Verilog, AutoCAD, etc.
* Archived/compressed files: Win ZIP, RAR, TAR, JAR, ARJ, 7Z, RPM, CPIO, 
GZIP,
BZIP2, Unix/Linux ZIP, LZH, etc.

Network/Applications Controlled
* Email: Microsoft Outlook, Lotus Notes and SMTP Email
* Web mail: MSN/Hotmail, Yahoo, GMail, AOL Mail, and more
* Instant Messaging: MSN, AIM, Yahoo, and more
* Network Protocols: FTP, HTTP/HTTPS and SMTP Endpoint Devices Controlled
* USB, CD/DVD, COM & LPT ports, removable disks, floppy, infrared and 
imaging
devices, print screen, modems, PCMCIA


3.- DISCLOSURE TIMELINE
========================================================

DD/MM/YYYY
09/09/2009 The vulnerability was discovered.
20/02/2010 Trend Micro was informed about the vulnerability.
21/02/2010 Trend Micro assigned a Service Request Number #1
23/02/2010 Trend Micro asked to reproduce the vulnerability with certain 
policies
and Web browsers as well as the details of the testing environment.
23/02/2010 Details sent, including screenshots.
25/02/2010 Trend Micro, asked again to retest LeakProof in certain 
circumstances.
03/03/2010 Service Request #1 automatically closed due to inactivity
16/03/2010 Trend Micro assigned a Service Request Number #2
16/03/2010 Thread retaken and I explained to Trend Micro about the 
technical
nature of the flaw.
18/03/2010 I got no response, so, I warned them about the soon public 
disclosure
24/03/2010 Service Request #2 automatically closed due to inactivity
23/03/2010 Trend Micro assigned a Service Request Number #3
23/03/2010 Thread retaken and Trend Micro asked me to debug and log all the
endpoint activity
31/03/2010 Explained about the results and no answer received from Trend 
Micro
06/04/2010 Service Request #3 automatically closed due to inactivity
21/05/2010 Retested the vulnerability against the latest version of Data 
Loss
Prevention (5.2)
01/06/2010 Public Disclosure


4.- TESTING ENVIRONMENT
========================================================
4.1.- Management Server
Operating System: CentOS 4.6 (Kernel 2.6.18-92.el5)
Management Server: DLP 5.2.1050

4.2.- Endpoints
Operating System: Windows VistaTM Business SP1
DLP Agent: 5.2.1053 (Patch applied)


5.- VULNERABILITY EXPLAINATION / EXPLOIT

###############################################################
I encourage you to take a look to the ilustrated advisory that you would 
find at
http://www.brainoverflow.org/advisories/TrendMicro_DLP_data_leakage.pdf
###############################################################

5.1.- Files to protect
The information contained in these files are for demonstration purposes 
only,
hence, the shown data is not real.

- MS Word document (.doc) containing a valid Credit Card Number
- MS Word document (.doc) containing the keywords (Boards of Directors)

5.2.- Constraint
For a successfully exploitation, the "Clipboard" channel must not be 
selected
in order to allow the copy from the original file to the attack vector 
of your
preference. (Gmail chat, facebook chat, etc.).

5.3.- Configuration of the environment to be tested

5.4.- Test to validate if the DLP works properly

5.5.- Exploitation (Data Leakage Proof-of-Concept)
The flaw as such is in the lack of analysis of certain HTTP/HTTPS 
channels such
as Web chats. Two attack vectors were used, Gmail Chat and Facebook 
Chat, and the
successful exploitation was achieved in both of them.
It's important to mention that there could be others attack vectors than 
those listed
above, but for demonstration purposes, I'll only include in this 
advisory the
popular ones, Gmail and Facebook webchats.

5.6.- Reports after the tests


6.- GREETS
I’d like to thank Yess G., F. Vilchis and Raaka_elgaupo for testing... 
And, as usual, all the dogs in
the scene, CRAc, nahual, ran, chr1x, hkm, nediam, Federico L. Bossi 
Bonin, dex, Cj, crypkey,
Bucio, beck, Optix, sunLevy, sdc, tr3w, zeus, Héctor López, alt3kx, 
underground.org.mx, beavis,
vendetta, Armin, #mendozaaaa.


EOF