{"id":37011,"date":"2019-10-31T22:15:16","date_gmt":"2019-10-31T19:15:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite\/"},"modified":"2019-10-31T22:15:16","modified_gmt":"2019-10-31T19:15:16","slug":"predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","title":{"rendered":"A fost prezentat\u0103 o nou\u0103 tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bilor \u00een SQLite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la Check Point au dezv\u0103luit<\/a><\/noindex> la conferin\u021ba DEF CON, detalii despre o nou\u0103 tehnic\u0103 de atac asupra aplica\u021biilor care folosesc versiuni vulnerabile de SQLite. Metoda Check Point consider\u0103 fi\u0219ierele cu baze de date ca o oportunitate de integrare a scenariilor de exploatare a vulnerabilit\u0103\u021bilor \u00een diverse subsisteme interne SQLite, inaccesibile pentru exploatare direct\u0103. Cercet\u0103torii au preg\u0103tit, de asemenea, o tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bilor cu codificarea exploatului sub form\u0103 de \u0219iruri de interog\u0103ri SELECT \u00een baza de date SQLite, permi\u021b\u00e2nd ocolirea ASLR.<\/p>\n

Pentru un atac de succes este necesar\u0103 abilitatea de a modifica fi\u0219ierele bazei de date ale aplica\u021biilor atacate, ceea ce limiteaz\u0103 metoda la atacuri asupra aplica\u021biilor care utilizeaz\u0103 SQLite ca format pentru datele de tranzit \u0219i de intrare. Metoda poate fi, de asemenea, utilizat\u0103 pentru a extinde accesul local deja ob\u021binut, de exemplu, pentru a integra backdoor-uri ascunse \u00een aplica\u021biile utilizate, dar \u0219i pentru a ocoli mecanismele de protec\u021bie \u00een timpul analizei malware-ului. Exploatarea dup\u0103 \u00eenlocuirea fi\u0219ierului are loc \u00een momentul \u00een care aplica\u021bia execut\u0103 prima interogare SELECT c\u0103tre tabelul din baza de date modificat\u0103.<\/p>\n

Ca exemplu, este demonstrat\u0103 capacitatea de a rula cod \u00een iOS la deschiderea agendei, fi\u0219ierul cu baza de date «AddressBook.sqlitedb» fiind modificat prin metoda propus\u0103. Pentru atac a fost folosit\u0103 o vulnerabilitate \u00een func\u021bia fts3_tokenizer (CVE-2019-8602, posibilitatea de dereferen\u021biere a unui pointer), corectat\u0103 \u00een actualizarea din aprilie a SQLite 2.28, \u00eempreun\u0103 cu alte vulnerabilit\u0103\u021bi. vulnerabilitate<\/a><\/noindex> \u00een implementarea func\u021biilor fereastr\u0103. \u00cen plus, a fost demonstrat\u0103 aplicarea metodei pentru capturarea de la distan\u021b\u0103 a controlului asupra serverului backend scris \u00een PHP de c\u0103tre atacatorii care str\u00e2ng parolele interceptate \u00een timpul func\u021bion\u0103rii codului mali\u021bios (parolele interceptate erau transmise sub form\u0103 de baz\u0103 de date SQLite).<\/p>\n

Metoda de atac se bazeaz\u0103 pe utilizarea a dou\u0103 tehnici «Query Hijacking» \u0219i «Query Oriented Programming», care permit exploatarea problemelor aleatoare ce conduc la coruperea memoriei \u00een motorul SQLite. Esen\u021ba «Query Hijacking» const\u0103 \u00een substituirea con\u021binutului c\u00e2mpului «sql» din tabela auxiliare sqlite_master, care define\u0219te structura bazei de date. C\u00e2mpul men\u021bionat con\u021bine un bloc DDL (Data Definition Language), utilizat pentru a descrie structura obiectelor din baza de date. Descrierea se stabile\u0219te folosind sintaxa standard SQL, adic\u0103 se folose\u0219te construc\u021bia «CREATE TABLE».
\ncare este executat\u0103 \u00een timpul ini\u021bializ\u0103rii bazei de date (\u00een timpul primei rul\u0103ri
\na func\u021biei sqlite3LocateTable) pentru a crea structuri interne asociate cu tabela \u00een memorie.<\/p>\n

Ideea este c\u0103 prin \u00eenlocuirea «CREATE TABLE» cu «CREATE VIEW» se deschide posibilitatea de a controla orice acces la baza de date prin definirea propriei vizualiz\u0103ri. Cu ajutorul «CREATE VIEW», opera\u021bia «SELECT» se asociaz\u0103 tabelului, care va fi apelat\u0103 \u00een loc de «CREATE TABLE» \u0219i permite accesul la diferite p\u0103r\u021bi ale interpretului SQLite. A\u0219adar, cea mai simpl\u0103 metod\u0103 de atac ar fi apelarea func\u021biei «load_extension», care permite \u00eenc\u0103rcarea unei biblioteci arbitrare cu extensie, dar aceast\u0103 func\u021bie este dezactivat\u0103 \u00een mod implicit.<\/p>\n

Pentru a efectua atacul \u00een condi\u021biile \u00een care se poate executa opera\u021bia «SELECT», este propus\u0103 tehnica «Query Oriented Programming», care ofer\u0103 posibilitatea de a exploata problemele din SQLite care duc la coruperea memoriei. Tehnica aminte\u0219te de programarea orientat\u0103 pe returnare (ROP<\/a><\/noindex>, Return-Oriented Programming), dar folose\u0219te pentru construirea unei lan\u021buri de apeluri («gadgets») nu fragmente existente de cod ma\u0219in\u0103, ci inser\u021bii dintr-un set de subinterog\u0103ri \u00een interiorul SELECT.<\/p>\n

\"A<\/a><\/noindex><\/center>
\n
\"A<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a \u043d\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 SQLite. \u041c\u0435\u0442\u043e\u0434 Check Point \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441 \u0411\u0414 \u043a\u0430\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 SQLite, \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u043b\u043e\u0431. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0432 \u0444\u043e\u0440\u043c\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27740,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37011","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost prezentat\u0103 o nou\u0103 tehnic\u0103 de exploatare a vulnerabilit\u0103\u021bilor \u00een SQLite | ProHoster","description":"Cercet\u0103torii de la Check Point au dezv\u0103luit la conferin\u021ba DEF CON detalii ale unei noi tehnici de atac.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0442\u0435\u0445\u043d\u0438\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 SQLite | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Check Point \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON \u0434\u0435\u0442\u0430\u043b\u0438 \u043d\u043e\u0432\u043e\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/predstavlena-novaya-tehnika-ekspluatatsii-uyazvimostej-v-sqlite","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:16+00:00","article:modified_time":"2019-10-31T19:15:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:43:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:35:26","updated":"2026-01-22 05:43:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37011\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/27740"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}