{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"Apresentada nova t\u00e9cnica para explora\u00e7\u00e3o de vulnerabilidades no SQLite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pesquisadores da empresa Check Point revelaram<\/a><\/noindex> na confer\u00eancia DEF CON, detalhes da nova t\u00e9cnica de ataque a aplica\u00e7\u00f5es que usam vers\u00f5es vulner\u00e1veis do SQLite. O m\u00e9todo da Check Point considera arquivos de banco de dados como uma oportunidade para integrar scripts de explora\u00e7\u00e3o de vulnerabilidades em v\u00e1rias subsistemas internos do SQLite, inacess\u00edveis para explora\u00e7\u00e3o direta. Os pesquisadores tamb\u00e9m desenvolveram uma t\u00e9cnica de explora\u00e7\u00e3o que codifica o exploit na forma de uma cadeia de consultas SELECT no Banco de Dados SQLite, permitindo contornar o ASLR.<\/p>\n

Para um ataque bem-sucedido, \u00e9 necess\u00e1rio ter a capacidade de modificar os arquivos do banco de dados das aplica\u00e7\u00f5es alvo, o que limita o m\u00e9todo a ataques em aplica\u00e7\u00f5es que utilizam o SQLite como formato para dados transit\u00f3rios e de entrada. O m\u00e9todo tamb\u00e9m pode ser aplicado para expandir o acesso local j\u00e1 obtido, por exemplo, para integrar backdoors ocultos nas aplica\u00e7\u00f5es utilizadas, assim como contornar mecanismos de prote\u00e7\u00e3o durante a an\u00e1lise de malware. A explora\u00e7\u00e3o ap\u00f3s a substitui\u00e7\u00e3o do arquivo ocorre no momento em que a aplica\u00e7\u00e3o executa a primeira consulta SELECT na tabela do banco de dados modificado.<\/p>\n

Como exemplo, foi demonstrada a possibilidade de execu\u00e7\u00e3o de c\u00f3digo no iOS ao abrir a agenda, cujo arquivo de banco de dados «AddressBook.sqlitedb» foi alterado usando o m\u00e9todo proposto. A vulnerabilidade explorada estava na fun\u00e7\u00e3o fts3_tokenizer (CVE-2019-8602, possibilidade de desrefer\u00eancia de ponteiro), corrigida na atualiza\u00e7\u00e3o de abril do SQLite 2.28, juntamente com outras. vulnerabilidade<\/a><\/noindex> na implementa\u00e7\u00e3o de fun\u00e7\u00f5es de janela. Al\u00e9m disso, foi demonstrada a aplica\u00e7\u00e3o do m\u00e9todo para o controle remoto de um servidor backend em PHP por parte de invasores, que acumula senhas interceptadas durante a execu\u00e7\u00e3o do c\u00f3digo malicioso (as senhas interceptadas eram transmitidas na forma de Banco de Dados SQLite).<\/p>\n

O m\u00e9todo de ataque baseia-se no uso de duas t\u00e9cnicas «Query Hijacking» e «Query Oriented Programming», que permitem explorar problemas aleat\u00f3rios que levam a corrup\u00e7\u00e3o de mem\u00f3ria no mecanismo SQLite. A ess\u00eancia do «Query Hijacking» \u00e9 substituir o conte\u00fado do campo «sql» na tabela de sistema sqlite_master, que define a estrutura do banco de dados. O campo especificado cont\u00e9m um bloco DDL (Data Definition Language), utilizado para descrever a estrutura de objetos no banco de dados. A descri\u00e7\u00e3o \u00e9 feita usando a sintaxe padr\u00e3o SQL, ou seja, a constru\u00e7\u00e3o «CREATE TABLE» \u00e9 utilizada.
\nque \u00e9 executada durante a inicializa\u00e7\u00e3o do banco de dados (na primeira execu\u00e7\u00e3o
\nda fun\u00e7\u00e3o sqlite3LocateTable) para criar estruturas internas relacionadas \u00e0 tabela na mem\u00f3ria.<\/p>\n

A ideia \u00e9 que, ao substituir «CREATE TABLE» por «CREATE VIEW», torna-se poss\u00edvel, atrav\u00e9s da defini\u00e7\u00e3o da sua pr\u00f3pria vis\u00e3o, controlar qualquer chamada ao banco de dados. Com «CREATE VIEW», uma opera\u00e7\u00e3o «SELECT» \u00e9 vinculada \u00e0 tabela, que ser\u00e1 chamada em vez de «CREATE TABLE» e permite acessar v\u00e1rias partes do interpretador SQLite. Em seguida, a maneira mais simples de ataque seria chamar a fun\u00e7\u00e3o «load_extension», que permite carregar uma biblioteca arbitr\u00e1ria com uma extens\u00e3o, mas essa fun\u00e7\u00e3o est\u00e1 desativada por padr\u00e3o.<\/p>\n

Para realizar o ataque na presen\u00e7a da possibilidade de executar a opera\u00e7\u00e3o «SELECT», foi proposta a t\u00e9cnica «Query Oriented Programming», que permite explorar problemas no SQLite que levam \u00e0 corrup\u00e7\u00e3o de mem\u00f3ria. A t\u00e9cnica se assemelha \u00e0 programa\u00e7\u00e3o orientada a retornos (ROP<\/a><\/noindex>, Return-Oriented Programming), mas usa, para a constru\u00e7\u00e3o da cadeia de chamadas («gadgets»), n\u00e3o trechos existentes de c\u00f3digo de m\u00e1quina, mas inser\u00e7\u00f5es em um conjunto de subconsultas dentro do SELECT.<\/p>\n

\"Apresentada<\/a><\/noindex><\/center>
\n
\"Apresentada<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Foi apresentada uma nova t\u00e9cnica de explora\u00e7\u00e3o de vulnerabilidades no SQLite | ProHoster","description":"Pesquisadores da Check Point revelaram na confer\u00eancia DEF CON detalhes de uma nova t\u00e9cnica de ataque.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}