{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"En ny teknik til udnyttelse af s\u00e5rbarheder i SQLite er blevet pr\u00e6senteret","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Check Point har afsl\u00f8ret<\/a><\/noindex> pr\u00e6senterede detaljer om en ny angrebsteknik rettet mod applikationer, der bruger s\u00e5rbare versioner af SQLite, p\u00e5 DEF CON-konferencen. Check Point's metode betragter databaser som en mulighed for at integrere udnyttelsesscenarier i forskellige interne systemer i SQLite, som ikke kan udnyttes direkte. Forskerne har ogs\u00e5 udviklet en teknik til at udnytte s\u00e5rbarheder ved at kode exploiten som en k\u00e6de af SELECT-foresp\u00f8rgsler til SQLite-databasen, hvilket g\u00f8r det muligt at omg\u00e5 ASLR.<\/p>\n

For et vellykket angreb er det n\u00f8dvendigt at have mulighed for at modificere databasefilerne i de angrebne applikationer, hvilket begr\u00e6nser metoden til angreb p\u00e5 applikationer, der bruger SQLite-databaseformatet til transit- og indsendelsesdata. Metoden kan ogs\u00e5 bruges til at udvide allerede opn\u00e5et lokal adgang, f.eks. ved at integrere skjulte bagd\u00f8re i de anvendte applikationer samt for at omg\u00e5 sikkerhedsmekanismen under analysen af malware. Udnyttelsen efter filendringen sker, n\u00e5r applikationen udf\u00f8rer sin f\u00f8rste SELECT-foresp\u00f8rgsel til tabellen i den modificerede database.<\/p>\n

Som eksempel vises muligheden for at k\u00f8re kode i iOS ved \u00e5bning af adressebogen, hvor filen med databasen «AddressBook.sqlitedb» blev \u00e6ndret ved hj\u00e6lp af den foresl\u00e5ede metode. Angrebet udnyttede en s\u00e5rbarhed i funktionen fts3_tokenizer (CVE-2019-8602, muligheden for pegerdereferering), som blev rettet i aprilopdateringen af SQLite 2.28, sammen med andre. s\u00e5rbarhed<\/a><\/noindex> i implementeringen af vinduesfunktioner. Derudover blev det demonstreret, hvordan metoden kunne bruges til at overtage kontrol over en PHP-baseret backend-server fra angribere, der indsamlede adgangskoder, der blev opsnappet under udf\u00f8relsen af malware (de opsnappede adgangskoder blev sendt i form af en SQLite-database).<\/p>\n

Angrebsmetoden er baseret p\u00e5 brugen af to teknikker «Query Hijacking» og «Query Oriented Programming», der g\u00f8r det muligt at udnytte vilk\u00e5rlige problemer, der f\u00f8rer til hukommelsesskader i SQLite-motoren. Essensen af «Query Hijacking» er at \u00e6ndre indholdet af feltet «sql» i systemtabellen sqlite_master, som definerer databasedens struktur. Det n\u00e6vnte felt indeholder en DDL-blok (Data Definition Language), der bruges til at beskrive objekternes struktur i databasen. Beskrivelsen gives ved hj\u00e6lp af den standard SQL-syntaks, dvs. konstruktionen «CREATE TABLE» bruges.
\nsom udf\u00f8res under initialiseringen af databasen (ved f\u00f8rste opstart,
\nfunktionen sqlite3LocateTable) for at skabe tilknyttede interne strukturer i hukommelsen.<\/p>\n

Id\u00e9en er, at ved at erstatte «CREATE TABLE» med «CREATE VIEW» \u00e5bnes der en mulighed for at kontrollere enhver databaseforesp\u00f8rgsel gennem definitionen af sit eget view. Ved hj\u00e6lp af «CREATE VIEW» knyttes en «SELECT»-operation til tabellen, som vil blive kaldt i stedet for «CREATE TABLE» og g\u00f8r det muligt at tilg\u00e5 forskellige dele af SQLite-fortolkeren. Derudover ville den nemmeste angrebsmetode v\u00e6re at kalde funktionen «load_extension», der tillader indl\u00e6sning af vilk\u00e5rlig bibliotek med en udvidelse, men denne funktion er som standard deaktiveret.<\/p>\n

For at udf\u00f8re angrebet under omst\u00e6ndigheder, hvor det er muligt at udf\u00f8re en «SELECT»-operation, foresl\u00e5s teknikken «Query Oriented Programming», som giver mulighed for at udnytte problemer i SQLite, der f\u00f8rer til hukommelsesskader. Teknikkens struktur ligner return-oriented programming (ROP<\/a><\/noindex>, Return-Oriented Programming), men bruger ikke eksisterende fragmenter af maskinkode til at bygge en k\u00e6de af opkald («gadgets»), men inds\u00e6tter subforesp\u00f8rgsler i SELECT.<\/p>\n

\"En<\/a><\/noindex><\/center>
\n
\"En<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ny teknik til udnyttelse af s\u00e5rbarheder i SQLite pr\u00e6senteret | ProHoster","description":"Forskere fra Check Point afsl\u00f8rede detaljer om den nye angrebsteknik p\u00e5 DEF CON-konferencen.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}