Penetration Test Report (iSEC): ncc osquery security assessment 2016 01 25

OSQuery Application Security Assessment
Facebook
October 23, 2015 – Version 1.3
Preparedfor
MikeArpaia
Preparedby
RaphaelSalas
AndrewRahimi
RobertSeacord
©2016–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forFacebook. Portionsofthisdocumentandthetemplatesusedinitsproduction
arethepropertyofNCCGroupandcannotbecopied(infullorinpart)withoutNCCGroup'spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,andtheauthor(s)assumeno
responsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformationcontainedherein.UseofNCCGroup's
servicesdoesnotguaranteethesecurityofasystem,orthatcomputerintrusionswillnotoccur.
2|Facebookosquery
DocumentChangeLog
Version Date Change
1.0 2015-10-23 DistributedreporttoFacebook.
1.1 2015-11-05 Incorporateddiscussionsduringreadoutregardingexploitabilityofkeyfindings.
1.2 2016-01-18 Preparingforpublicreleaseafterroundsofadditionalpeerreview.
1.3 2016-01-25 Publicrelease.
3|Facebookosquery
Executive Summary
Synopsis accesstoanauthenticatedTLSendpoint.
Facebook engaged NCC Group to conduct a security • Comparisons between integers of different signs
assessmentoftheosqueryinstrumentationframework. and unsigned integer wrap-around throughout the
Thisassessmentwasconductedby3consultantsduring osquerycode.
the weeks of October 12th and October 19th, 2015.
Non-securityfindingsarelistedinAppendixF.
The entire application was in scope, as sourced from
theproject'sofficialGitHubpage. TheFacebookteam Limitations
requested that formal status meetings be foregone in
While NCC Group was able to review the majority of
exchange for active collaboration between Facebook
thetargetedcomponents,theassessmentofindividual
and NCC Group via email and GitHub. This resulted
tables was inconsistent. Table implementations are
inseveralissuesbeingfixedinreal-timealongsidethe
specific to the various operating systems supported
disclosureprocess.
by osquery making complete coverage across all sup-
Scope portedplatformsimpracticalinthetimeprovided. Due
to time constraints, NCC Group prioritized the assess-
NCC Group's assessment included osquery core and
ment of common table functionality across supported
plugininterfaces,focusingonthefollowingmainattack
platforms, withmosttestingperformedontheUbuntu
surfaces:
14.04 LTS Vagrant VM and OS X 10.10.3 (Yosemite)
• Data Collection: An analysis of the set of osquery configurations. Consequently, details specific to other
tables used to represent operating system state Linux distributions such as CentOS and FreeBSD table
information, including the plugin interface allowing implementationsonlyreceivedacursoryreview.
tableimplementationviatheThriftAPI.
StrategicRecommendations
• KernelIntegration:AreviewofOSXspecificfunction-
ality exposed to the osqueryd daemon through the Consider implementing a least-privilege model, where
privileges are temporarily dropped before performing
includedkernelextension.
I/O operations on behalf of an unprivileged user. For
• TransportSecurity: Areviewoftheosquerydplugin
example, user-owned files should be accessed with
interface that exposes its subsystems remotely over
the effective privileges of the user to avoid allowing
authenticatedTLSendpoints.
unprivilegeduserstooperateonrestrictedfiles.
• DatabaseSecurity: AreviewoftheRocksDBinstance
used to house and cache information about the Enforce coding guidelines and fix violations. Do not
system. disablewarningssuchasdifferingsignednesscompar-
• ConfigurationParsing&SecureDefaults:Codereview isons and continue to test sanitized versions, adding
ofpluginsthatreadandparseconfigurationfromdisk, additionalsanitizers. Instrumentedexecutablesshould
commandline,orremoteservers. betestedmoreaggressivelytoidentifypotentialissues
atruntime.
Testing was performed on the Git revision 4d0cd46
dated10/09/2015. Extendreadlimitationsacrosstables,particularlythose
that are OS specific. For instance, size checking
KeyFindings
against read limitations in the Safari Extensions table
Theassessmentdiscoveredthefollowingkeyfindings:
canpreventdecompressionbombsthatcannegatively
impact the result of a query. Consistently applying
• A Time-of-Check Time-of-Use TOCTOU issue in the
limitationscanpreventthisandotherconditionswhere
osquery::readFile function used throughout the
unprivilegeduserscaninterferewithnormaloperation.
framework allowing an attacker to cause osquery to
read arbitrary files where the attacker may not have
Maintain and test an updated build chain. NCC
sufficientpermissionstodoso.
Group was able to leverage the updated Clang 3.7
• A parsing issue where the configuration parser ex- compilertoidentifynumerousdefectsthathadnotbeen
pects a ``query" JSON key resulting in osqueryd previously detected by Clang 3.5. Facebook should
abortingduetoanunhandledexception. Thiscanbe alsoensurethatthelatestversionsoftoolsandsoftware
triggered remotely via the TLS configuration plugin components,suchasThrift,areusedintheproduct.
tocausedenialofservice,providedanattackergains
4|Facebookosquery
Project Dashboard
TargetMetadata EngagementData
Name osquery Type ApplicationSecurityAssessment
Type Daemon Method Code-assisted
Language C++ Dates 2015-10-12to2015-10-23
Environment Testing(Vagrant-provisioned) Consultants 3
Levelof
effort 6person-weeks
Targets
osquerySourceCode https://github.com/facebook/osquery—Referencecommit: 4d0cd46
VulnerabilityBreakdown
CriticalRiskissues 0
HighRiskissues 0
MediumRiskissues 2
LowRiskissues 2
Informationalissues 4
Totalissues 8
CategoryBreakdown
DataExposure 1
DataValidation 5
DenialofService 2
Key
Critical High Medium Low Informational
5|Facebookosquery
Test Details
Synopsis
Theentireosquerycodebaseisopensource,howeverthenatureoftheapplicationrequiresthatitreadandacton
system-specificdatathatisinherentlynon-uniformacrossdifferentsystemsandplatforms. Therefore,theNCCGroup
teamdividedresourcesbetweentargetedsourcecodereview,dynamictestingoftheapplication,andminimalfuzzing.
Throughouttheassessment,theFacebookteamwasextremelyhelpfulandresponsiveineliminatingroadblocksand
providinginsightintothesecurityconsiderationsandarchitectureoftheproduct.Thiswasparticularlybeneficialinthe
initialstagesoftheassessment,allowingforastrongstart. TheFacebookteamprovidedextensivedocumentation,1
which allowed the NCC Group team to easily enumerate application functionality and identify attack surfaces. The
FacebookteamwasalsoextremelyresponsivetoissuesidentifiedviatheirGitHuboremailandworkedwiththeNCC
Groupteamtopatchvulnerabilitiesinrealtime.
FromNCCGroup,thetestingteamwasledbyRaphaelSalas,withadditionaltestingperformedbyAndrewRahimiand
RobertSeacord. TheprojectmanagerwasDeannaBjorkquist. TheaccountmanagerforFacebookisBryanSolari.
FromFacebook,theprojectwasmanagedbyMikeArpaia,withtechnicalsupportprovidedbyTedReed.PeterOehlert
istheproductsecuritydirector.
TestPlan
NCCGroupinstalledtheClang3.7compilerandperformedvarioustestsusingthe-fsanitizecompilerflag. The
teamalsousedvalgrind,afreelyavailabletool.
NCCGrouptestedthetransportsecurity, filesystemsecurity, permissions, anddefaultconfigurationsofosqueryon
multipleplatformstoensurewidecoverageacrosssupportedOSconfigurations.
Atestextensionbasedontheosquery/examples/example_extension.cppexamplewasconstructedtoverifythe
rightsofextensionsthroughosquery'sThriftAPI.Extensionsinosqueryoperateonwhitelistprinciples. NCCGroup
verifiedthatsafefilepermissionsareenforcedondirectoriesthatcontainextensionfileswhentheextensionautoload
featureisinuse. Likeanyextensionframework,extensionfunctionalityinosquerycanbeabusedbymaliciousexten-
sions. Thisriskisacceptedasosqueryprovidesoptionsforsecureconfigurationdeploymentandmanagement.
osquerymandatesTLSforallHTTPsocketconnectionsincludingConfiguration,Logger,Enrollment,andDistributed
Queries.TheapplicationwasevaluatedexclusivelyasaTLS/HTTPclient,andwasconfirmedtosupportonlysufficiently
strong,modernciphersuites. AtestingHTTPserverwasprovidedinosquery/tools/tests/test_http_server.py
thatwasusedinconjunctionwithdummycer