WO2010048777A1

WO2010048777A1 - Method for excavating multimedia message protocol vulnerability and system thereof

Info

Publication number: WO2010048777A1
Application number: PCT/CN2009/001169
Authority: WO
Inventors: 张玉清; 杨丁宁; 宋杨; 徐鹏; 肖晖
Original assignee: 中国科学院研究生院
Priority date: 2008-10-28
Filing date: 2009-10-22
Publication date: 2010-05-06
Also published as: CN101459876A; CN101459876B

Abstract

A method and a system for excavating multimedia message protocol vulnerability are provided in the present invention, and they belong to software engineering technical field. The method according to the present invention includes that: constructing a malformed data packet based on a rothole to be detected of a multimedia message, then transmitting the constructed malformed data packet to a target device which uses a multimedia message protocol, judging whether the transmitted malformed data packet causes an abnormal response from the target device, determining the multimedia message protocol vulnerability of the target device based on the malformed data packet which causes an abnormal response from the target device; the system according to the present invention includes a WAP gateway, a simulation multimedia message service center, a MMS message generator, a target device using a multimedia message protocol, and a simulation short message service center. The present invention can excavate the multimedia message protocol vulnerability quickly and effectively, and is especially suitable for the intelligent handset platform.

Description

Multimedia message protocol vulnerability mining method and system thereof

The invention relates to a protocol vulnerability mining method and a system thereof, in particular to a multimedia message protocol vulnerability mining method and system thereof, and belongs to the technical field of software engineering. Background technique

Smartphones have become popular personal electronics in modern society. According to research forecasts, the smartphone market will continue to grow in the next few years. Global shipments will grow from 80.5 million in 2006 to 125 million in 2009. At that time, smartphones will grow to 16% of the global mobile phone market. On the other hand, smartphones are gradually enhanced, and now they can be used in complex applications such as Internet access, video on demand, stock trading, electronic conferencing and document processing. However, what comes with it is that mobile phone security issues are getting worse. At present, the number of malicious code on mobile phones has reached more than 1,000. Especially in the past two years, the growth rate of mobile phone viruses is almost 10 times that of PC viruses. What is especially serious is that more and more mobile phone viruses are beginning to use mobile phone platform vulnerabilities to attack, causing greater damage and impact. At present, most users are not sensitive to mobile phone security issues, and many manufacturers have neglected the security protection of mobile phones, which have provided convenience for malicious attackers. Due to the particularity of the mobile phone, it is difficult to upgrade the installation vulnerability patch. Once a security vulnerability is illegally exploited, the economic loss caused by such a huge user base cannot be estimated.

In view of the serious threat of mobile security vulnerabilities, more and more security research institutions are beginning to exploit the vulnerability of the smartphone platform. However, there are many differences between the smartphone platform and the PC platform, which also imposes many restrictions on the vulnerability mining technology. Especially in the process of testing the MMS service for the smartphone platform, security researchers will encounter many problems, which puts higher requirements on the implementation of MMS vulnerability mining technology.

First, the hardware processing power of smartphones is far less than that of PCs, which puts higher demands on software running on mobile platforms. Based on the same time complexity algorithm, the calculation may be completed quickly on the PC, but it takes a long time to get the execution result on the mobile platform. Therefore, the vulnerability mining analysis tools under many PC platforms are difficult to port to mobile platforms, such as IDA Pro, which also imposes many restrictions on vulnerability mining technology.

Second, although the openness of the smartphone operating system has been continuously enhanced, it still has a big gap with the computer platform. Affected by the closedness of the traditional mobile phone platform, the relevant development tools and technical support documents under various smart phone operating system platforms are still in the state of authorized protection. Only through the secure authorized mobile phone software developers or research institutions can the complete technology be obtained. Information and a more full-featured development platform. Therefore, the safety tester has no The law understands the specific implementation details of MMS services, which also increases the difficulty of smart phone MMS security research.

In addition, the PC platform generally runs on an open TCP/IP network, which is very convenient for security vulnerability testing. The MMS service network of the smartphone is mainly based on the mobile communication system, which is a closed network system, MMS service gateway, MMS. The servers are all located on the carrier's internal network and cannot be used for testing. It is impossible to build a test environment under the mobile platform through the network. Finally, the actual price of sending MMS messages is relatively high. In the process of excavating MMS vulnerabilities, it is often difficult to bear the cost of MMS sending, which is not cost-effective. Summary of the invention

The object of the present invention is to design a practical and effective MMS protocol vulnerability mining technology, construct a set of simulated MMS sending and receiving environment, and solve the difficulties and problems in the current security vulnerability analysis on the target device adopting the MMS protocol, thereby adopting MMS. The MMS service under the target device of the protocol performs vulnerability mining, especially the vulnerability testing and mining of the MMS protocol of the smartphone platform.

The technical solution of the present invention is a method for mining a multimedia message protocol vulnerability, and the steps are as follows:

1) constructing a malformed data packet according to the vulnerable point of the MMS message;

2) sending the constructed malformed data packet to the target device using the MMS protocol;

3) determining whether the sent malformed data packet causes an abnormal response of the target device;

4) Determine the MMS protocol hole of the target device according to the malformed data packet that causes the target device to respond abnormally.

The MMS message includes a MMS notification message and a MMS content message; the vulnerability of the MMS notification message to be tested includes: X-Mms-Transaction-ID, X-Mms-Content-Location > From, Subject; The vulnerability to be tested includes: X-Mms-Transaction-ID, X-Mms-Content-Location, From, Subject, Content-Type, To, Cc, Bcc, Message-ID, Content-ID, ContentLocation.

The data types of the fields in the MMS message include: an integer type and a string type.

The malformed data packet includes but is not limited to one or several types of the following data packets: integer overflow type malformed data packet, long long string overflow type malformed data packet, special character exception type malformed data packet, formatted string type Malformed data packet.

In the method, for the MMS notification message, the configured malformed data packet is sent to the target device. The method is as follows: The short message service center uses the MMS notification message Fuzzing test tool to send a multimedia message notification to the target device, and the target device's tmail.exe monitors the MMS notification message through the SMS, and simultaneously monitors the MMS notification message on the UDP port 2948.

In the method, for the MMS content message, the method for sending the constructed malformed data packet to the target device is:

1) saving the malformed data packet to a specified directory of the analog multimedia information center;

2) simulating the short message center to construct a corresponding MMS notification message, and transmitting the MMS notification to the target device by using UDP/ WAP PUSH;

3) the target device constructs a corresponding WSP/WTP GET request according to the server address of the MMS content in the MMS notification, and sends the corresponding WSP/WTP GET request to the set analog WAP gateway;

4) The analog WAP gateway converts the WSP/WTP GET request into an HTTP GET request and sends it to the analog multimedia information service center specified therein;

5) The analog multimedia information service center sends the malformed multimedia message content back to the target device according to the GET request.

The abnormal response includes a timeout when a new MMS notification message is sent, a timeout is not received by the target device, an error message is displayed on the target device screen, or the target device cannot respond to the user's operation; the MMS protocol vulnerability of the target device is determined to include Determine the type, location, cause, and severity of the MMS protocol vulnerability for the target device.

A multimedia message protocol vulnerability mining system, comprising a WAP gateway, an analog multimedia information service center, an MMS message generator, a target device for using a multimedia message protocol, and an analog short message service center; the connection relationship is: the analog multimedia information center passes through a local area network Connecting to the WAP gateway; the target device adopting the MMS protocol is connected to the analog multimedia information center, the WAP gateway, and the analog short information service center through a local area network;

The WAP gateway is responsible for converting a WAP request of a target device using the MMS protocol into an HTTP request, and transmitting the request to the designated analog multimedia information service center therein;

The analog multimedia information service center is used to simulate a multimedia message server function in a real MMS service network;

The MMS message generator is configured to generate a malformed data packet for testing a multimedia message content message, and send the test data packet to a specified directory of an HTTP server running on the analog multimedia information center; The target device adopting the MMS protocol configures the MMS sending and receiving settings, sets the WAP gateway as the simulated WAP gateway address in the test environment, and sets the server address as the address of the analog multimedia information service center in the test environment;

The analog short message service center is configured to generate a malformed data packet or a multimedia message notification message used in the MMS notification message test.

The server where the analog multimedia information service center is located is an Apache HTTP server, wherein the Apache HTTP server is added with a MIME type for supporting a type file of the mms extension; the MMS message generator is for MMS message generation based on MMSLib. Device.

In view of the opacity of the source code of the MMS service under the smartphone platform, the present invention mainly adopts a vulnerability mining technology based on the Fuzzing test to solve the problem. Fuzzing technology is an automated security vulnerability mining technology. It does not need to know the specific implementation details of the tested object. It only needs to construct a large amount of semi-effective data or files as input, and then it can find out the existence of the test object according to the corresponding response. Security breach.

In view of the limitation of the operating environment in which the actual MMS service is closed to the closed mobile operation network, the present invention constructs a set of analog MMS transceiver platform, which performs the WAP gateway, the multimedia message server and the short message server in the actual operation environment of the MMS service. The simulation, and the use of an open TCP / IP local area network instead of the wireless GPRS network to transmit MMS messages. The whole system is economical and practical, and has high feasibility. Combined with Fuzzing test technology, it provides an effective and effective solution for MMS service vulnerability exploitation under the smartphone platform.

The positive effects of the present invention are:

The invention firstly proposes a technical scheme for exploiting the vulnerability of the MMS protocol using the Fuzzing technology under the smart phone platform, and completely implements a set of MMS protocol vulnerability mining system in the engineering, the system runs through the LAN pair of the TCP/IP protocol. The telecom operator's proprietary MMS service network was fully simulated. Based on this, the above technical solutions were used to exploit the MMS protocol. After using the system to exploit the current MMS protocol, two integer overflow vulnerabilities and eight ultra-long string vulnerabilities were discovered, including five unpublished vulnerabilities, which were discovered for the first time. This fully demonstrates the effectiveness of the vulnerability mining method and its system. At the same time, the technical solution of the present invention can be applied to other target devices using the MMS protocol for vulnerability testing and mining. DRAWINGS

Figure 1 is a specific implementation flow chart of the Fuzzing test;

Figure 2 is a vulnerable test point of the MMS notification message;

Figure 3 is a vulnerable test point of the MMS content message;

4 is a simulation running environment diagram of a multimedia message notification message;

Figure 5 is a Fuzzing test tool running interface for a MMS notification message;

Figure 6 is a simulation running environment diagram for MMS content message testing;

Figure 7 is a system connection diagram of the present invention in which the solid arrow is interconnected using a wired LAN operating TCP/IP protocol and the dashed arrows are interconnected using a wireless local area network. detailed description

Specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

1. The implementation process of the Fuzzing test

Figure 1 shows the implementation of the Fuzzing test used to exploit the vulnerability of the MMS service. First, you must analyze the MMS protocol in detail, understand the types of MMS messages, and the composition and meaning of the fields in each message. For a detailed description of the format of the MMS protocol, please refer to the Multimedia Messaging Service Encapsulation Specification provided by the Open Mobile Alliance (OMA), which will not be described here. The second is to determine the vulnerability points to be tested, and to construct the malformed data according to the vulnerability. The malformed data is designed to be a legal MMS protocol packet. The difference from the normal packet is that one or more specified fields in the malformed data. Specially constructed, these specially constructed fields are considered to be vulnerable points that could trigger security holes. After obtaining the malformed MMS message, the constructed MMS data packet can be sent to exploit the vulnerability of the MMS service.

The MMS service test under the smartphone platform is mainly for testing the local smart phone terminal. Therefore, the MMS message tested is mainly a MMS notification message (M-Notification.ind) and a MMS content message (MR _e tri _eve . _COn f) sent to the terminal handset. Based on the field definitions of the MMS notification message and the MMS content message, it can be determined that they have vulnerable test points as shown in FIGS. 2 and 3.

According to the vulnerable test point fields of different data types, the test data can be constructed according to the following rules: (1) The field type is an integer: the integer overflow type malformed data packet can be constructed by setting different special values, namely: very small numbers, For example, -1, 0, 1, 2, 10, 20, 30, etc.; very large numbers, such as Oxffff, 0x7fff, Ox, fff, etc.; values near the range of values, such as 2 ⁸ , 2 ⁸ -1 , 2 ⁸ +1 , 2 ¹⁶ , 2 ²⁴ or 2 ³¹ etc. (2) The field type is a string: Constructs a super-long string overflow type malformed packet, that is, constructs a long-length string to check whether there is a buffer overflow vulnerability; constructs a special character exception type malformed packet, that is, whether the special character check is mixed Exception handling failure vulnerability; construct a formatted string type malformed packet, that is, add a similar substring such as "%n" to test for the existence of a format string vulnerability; if the field represents a file name, you can also add "../" To determine if there is a directory spanning vulnerability.

(3) Also consider combining multiple fields for testing. For example, if there are two fields representing the file name and the directory name, then you can consider constructing the data so that the sum of the lengths of the "file name" and the "directory name" is very large to test for the existence of an exception handling failure vulnerability.

2. The test environment of the MMS notification message is set up.

In the actual running MMS service system, the MMS notification message is implemented by the short message service center sending a WAP PUSH message through SMS. FIG. 4 is a simulation running environment for sending a local MMS notification message built by the present invention.

In the simulated operating environment, the GSM network of the mobile operator is replaced by a wireless local area network, and the constructed malformed MMS notification message is sent to the smart phone terminal by using the PC analog short message service center. The running process is as follows:

(1) The smartphone terminal supports the wireless LAN function. The Dopod 818 pro is used in the simulation environment built in Figure 4. The smart phone terminal connects to the wireless local area network through the wireless router, and realizes UDP protocol communication with the PC-side analog short message service center. The tmail.exe of the smartphone terminal not only monitors the MMS notification message through SMS, but also monitors the MMS notification message on the UDP port 2948.

(2) Using a normal PC to simulate a short message service center. The analog short message service center is interconnected with the smart phone via a connected LAN. Use the MMS notification message Fuzzing test tool to send a structured malformed MMS notification to the smartphone via UDP/ WAP PUSH. The malformed MMS notification message is structured as follows: For domains other than the vulnerable test points listed in Figure 2, use normal and valid data for padding; for domains that are vulnerable test points, use the following for each test Fill in various ways or combinations of various ways:

• Set the byte representing the length of the string to a special integer value, including 0x0, 0x7f, Oxff, and so on.

• If a string is contained in a field, a string of a general type is filled with a randomly generated long string; for a string representing a file name, a URL address, etc., which do not allow special characters, a special type is randomly mixed in the string. Character; For a formatted string, a similar substring such as "%n" is randomly added to the string; for a string representing the filename, "../" is randomly added to the string.

In each test, you can choose to test a single vulnerable test point or test a combination of some vulnerable test points. (3) If the smartphone loses the response after receiving the notification message (the new MMS notification message is timed out due to no response, the error message is displayed on the phone screen or the user's operation cannot be responded at all), then it can be judged that The sent notification message triggers a vulnerability in the smartphone MMS protocol stack to complete the MMS notification message test, as shown in Figure 5. The vulnerability researcher can reproduce the vulnerability based on the content of the MMS notification message that triggered the vulnerability, and further explore the cause, severity, and utilization of the vulnerability.

3. The test environment for MMS content messages is set up.

The test environment for MMS content messages is shown in Figure 6. The functions of each key participating role are described as follows:

(1) WAP gateway. The actual use of the WAP gateway is very expensive. For the convenience of testing, the present invention utilizes the free and open source WAP gateway software Kannel, which is responsible for converting the WAP request of the smartphone into an HTTP request;

(2) Analog multimedia information service center. It is built using the Apache HTTP server and is used to emulate multimedia messaging server functionality. Here, the present invention extends the server by adding a new MIME type so that it can support the type file of the mms extension;

(3) MMS message generator. The module is based on MMSLib implementation, which is mainly used to generate MMS data packets for testing, and sends test data packets to a specified directory of the HTTP server, so that the smartphone client can be obtained for vulnerability mining;

(4) Smartphone terminal. Configure the MMS send and receive settings of the smartphone terminal, set the WAP gateway to the WAP gateway address in the test environment, and set the server address to the address of the analog multimedia information service center in the test environment. In this way, the test environment for receiving MMS is set up.

The smart phone terminal and each analog PC terminal are interconnected through a local area network to realize transmission and reception of different MMS message types. The Fuzzing test process for MMS content is as follows:

(1) Using the MMS message generator to generate a malformed test multimedia message according to the Fuzzing test data construction rule, and save the MMS message in a specified directory of the analog multimedia information center. The specific configuration of the malformed test MMS is as follows: For the domains other than the vulnerable test points listed in Figure 3, use normal and valid data for filling; for the domains belonging to the vulnerable test points, use the following in each test Fill in a way or a combination of ways:

• Set the bytes in the field that represent the length of the string to special integer values, including 0x0, 0x7f, Oxff, and so on. • If a string is contained in a field, a string of a general type is filled with a randomly generated long string; for a string representing a file name, a URL address, etc., which do not allow special characters, it is randomly mixed in the string. Special characters are added; for formatted strings, similar substrings such as "%n" are randomly added to the string; for strings representing file names, "../" is randomly added to the string. In each test, you can choose to test a single vulnerable test point or test a combination of some vulnerable test points.

(2) simulating the short message center to construct a corresponding MMS notification message, and transmitting the MMS notification to the smart phone terminal through UDP/ WAP PUSH;

(3) The smartphone terminal constructs the corresponding address according to the server address of the MMS content in the MMS notification

WSP/WTP GET request, and sent to the set analog WAP gateway;

(4) The analog WAP gateway converts the WSP/WTP GET request into an HTTP GET request and sends it to the analog multimedia information service center specified therein;

(5) The analog multimedia information service center sends the constructed malformed MMS content back to the mobile terminal according to the GET request, so that the security researcher can analyze the response of the smart phone terminal and determine whether there is a security hole. Record information such as the type and location of the vulnerability and repeat the above steps for the next round of vulnerability mining until the Fuzzing tool no longer reports new vulnerabilities.

Claims

Claim

A method for mining a multimedia message protocol vulnerability, the steps of which are:

2. The method according to claim 1, wherein the MMS message comprises a MMS notification message and a MMS content message; and the vulnerability of the MMS notification message to be tested comprises: X-Mms-Tmnsaction-ID, X-Mms -Content-Location From, Subject; The vulnerability of the MMS content message to be tested includes: X-Mms-Transaction-ID, X-Mms-Content-Location > From, Subject, Content-Type, To, Cc, Bcc, Message-ID, Content-ID, ContentLocation.

3. The method of claim 2, wherein the data type of the field in the MMS message comprises: an integer type and a string type.

4. The method of claim 3, wherein the malformed data packet includes but is not limited to one or more of the following types of data packets: integer overflow type malformed data packet, long long string overflow type malformed data packet , special character exception type malformed data packet, formatted string type malformed data packet.

5. The method according to claim 2, wherein for the MMS notification message, the method for transmitting the constructed malformed data packet to the target device is: simulating a short message service center using a multimedia message notification message Fuzzing test tool Sending a MMS notification to the target device, the tmail.exe of the target device monitors the MMS notification message through the SMS, and simultaneously monitors the MMS notification message on the UDP port 2948.

6. The method of claim 2, wherein the method of transmitting the constructed malformed data packet to the target device for the MMS content message is:

2) simulating the short message center to construct a corresponding MMS notification message, and sending the MMS notification to the target device through UDP/ WAP PUSH;

3) The target device constructs a corresponding WSP/WTP according to the server address of the MMS content in the MMS notification GET request, and sent to the set analog WAP gateway;

5) The simulated multimedia information service center sends the malformed multimedia message content back to the target device according to the GET request.

7. The method according to claim 2, wherein the abnormal response comprises timeout when a new MMS notification message is sent, failure to obtain a response from the target device, error message displayed on the target device screen, or the target device is unable to respond to the user. The determining the MMS protocol vulnerability of the target device includes determining a MMS protocol vulnerability type, location, cause, and severity of the target device.

A multimedia message protocol vulnerability mining system, comprising a WAP gateway, an analog multimedia information service center, an MMS message generator, a target device using a multimedia message protocol, and an analog short message service center; the connection relationship is: the analog multimedia information center passes The local area network is connected to the WAP gateway; the target device adopting the MMS protocol is connected to the analog multimedia information center, the WAP gateway, and the analog short message service center through a local area network; the maintenance gateway is responsible for the WAP of the target device that adopts the MMS protocol. Request to convert to an HTTP request and send the request to the analog multimedia information service center specified therein;

The MMS message generator is configured to generate a malformed data packet for testing a multimedia message content message, and send the test data packet to a specified directory of an HTTP server running on the analog multimedia information center; the target device configuration using the MMS protocol The MMS send and receive settings, the WAP gateway is set to the analog WAP gateway address in the test environment, and the server address is also set to the address of the analog multimedia information service center in the test environment;

9. The system according to claim 8, wherein the server in which the analog multimedia information service center is located is an Apache HTTP server, wherein the Apache HTTP server is added with a MIME type for supporting a type file of the mms extension; The MMS message generator is an MMS message generator based on the MMSLib implementation.

10. The system according to claim 8, wherein the malformed data packet includes but is not limited to one or more of the following types of data packets: integer overflow type malformed data packet, long long string overflow type malformed data packet , special character exception type malformed data packet, formatted string type malformed data packet.