Re: Google Talk Denial of Service - BenjiBug

[unknown unknown <unknown.pentester () gmail com>]

If you successfully compromise the account of the victim user you can
just modify the update version file, the signature, and the URL of the
executable by changing the following Registry Keys:

HKEY_CURRENT_USER\Software\Google\Google Talk\Autoupdate\AvailableURL
HKEY_CURRENT_USER\Software\Google\Google Talk\Autoupdate\Signature
HKEY_CURRENT_USER\Software\Google\Google Talk\Autoupdate\UpdateURL

With this keys you should be able to download your spyware file with
its own signature so that Google Talk doesn't complain.

You can even set when the next update will take place:

HKEY_CURRENT_USER\Software\Google\Google Talk\Autoupdate\NextUpdate


I haven't tested this to be honest, but I believe it should work since
these are the locations where Google Talk saves all the settings you
discussed on your post.


Regards,
pagvac (Adrian Pastor)
www.ikwt.com


James Evans wrote:

> Title: Google Talk Denial of Service - BenjiBug
> Reported Date: October 15, 2005
> Public Disclosure: November 22, 2005
> Status: Vendor contacted. Unpatched.
>
>
> Software which automatically updates itself is often a good idea -
> especially where home users are concerned. It is often impossible to
> patch their systems otherwise. But automatic update mechanisms must be
> designed and implemented in ways which prevent malicious attackers
> from installing malware. Google Talk includes the ability to
> automatically update itself - a feature which cannot be disabled.
>
> Google Talk connects at random intervals (about once every day or so
> in testing) to dl.google.com via HTTP and fetches a .txt file
> (http://dl.google.com/googletalk/google-talk-versioncheck.txt) which
> lists the current version of Google Talk, as well as a digital
> signature of the new installer executable. If the version number is
> greater than the version currently running, Google Talk will download
> the .exe and, after checking its authenticity, execute it to
> automatically update.
>
> Assuming a user's DNS cache can be poisoned, a denial of service
> attack is possible. Thanks to the digital signature, malware will not
> execute. Yet, it is possible to force Google Talk to download a large
> file which it will then analyze to determine whether the signature
> matches. This will consume 100% CPU and large amounts of memory,
> resulting in an unstable machine which requires a reboot in some
> cases. It is also possible to plant incriminating files on a user's
> machine, as the files are at first downloaded and saved to the
> "Temporary Internet Files" directory before they are verified and
> moved to Google Talk's data directory.
>
> Google can patch this by checking the file size of the downloaded
> executable to ensure that it is within the range of a normal updater
> .exe.
>
> Addendum: Although Launch-Target can be manipulated to cause Google
> Talk to execute a file other than the one downloaded from the URL
> field, it will not execute files outside of the C:\Program
> Files\Google\Google Talk\googletalk-[version] directory, so this seems
> useless as an attack vector.
>
> Google Talk's request to Google's servers is as follows:
> GET 
> /googletalk/google-talk-versioncheck.txt?auv=1&r=4&up=30&p=w&ma=5&mi=1&b=2600&sp=ServicePack2&as=googletalk&pv=1.0.0.76
> ma = major version number, mi = minor version number, b = build
>
> -James Evans
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/