2

I have tried looking into this topic. I started with understanding how differently a .exe Desktop app and a .appx Universal Windows app works. And this is my understanding:

  1. UWP apps will run in a sandboxed environment with a virtualized registry and file system: Registry entries are redirected into a Registry.dat file in the app's installation folder, AppData redirects to a private app data store and the custim dlls are stored in folder within the app's installation folder.
  2. UWP apps will have access to a subset of the win32 APIs.
  3. UWP apps cannot run with elevated privileges.

The queries I have are:

  1. Are there any other internals which I've missed and worth noting.
  2. How would we approach pen-testing UWP apps targeted at Windows 10 tabs and devices.
  • 1
    I am thinking what would pentesting for universal app would mean? My guess is that if you can use DirectX then you can access the video card more or less "usual "way. And if you can access camera, then you can do screenshots. You can drop documents which might exploit MS Office running on user permissions (ransomware for example). I think, that for the corporation would could restrict apps with specific permissions. There can be also concealed malware which breaks the sandbox, or it can download it from internet, or via compromised website like injection / redirection. Usual stories. – Aria Jul 14 '16 at 11:23
  • 1
    Okay, so one potential point of confusion you might be about having is about the difference betw. "true" UWP apps written for Windows 8/8.1/10 and soon-to-debue "desktop" UWP apps As of August 2, when Windows 10 Anniversary Edition drops, there will actually be three categories of programs in Win 10.. One, of course, will be good old Win32 desktop programs. Another will be the "true" Universal Windows Program applications written for the new app model first introduced in Windows 8. But you'll also have a third variety: "Centennial" apps written for desktop but that will now be available.. – mostlyinformed Jul 16 '16 at 4:24
  • 2
    for distribution via the Windows Store thanks to the "Project Centennial" packaging technology I think you're reffering to above. But here's the kicker: despite Microsoft's use of the label "UWP" for these packaged desktop programs from a security standpoint real UWP apps (ie. written for Windows 8/8.1/10) are far different from these packaged desktop UWP apps. Most importantly, the packaged desktop apps will not be sandboxed as "real" UWP apps are. If you can, say, exploit a vulnerability in a packaged UWP desktop app you will have full access to everything the logged-in user can access – mostlyinformed Jul 16 '16 at 4:42
  • @halfinformed No, I'm not concerned about the "Project Centennial" packed apps. I'm looking at the "true" UWP apps which are written and compiled with the new Win10 SDK. I'm looking for ideas and know approaches to looking for vulnerabilities which lead to data leakage from the sandbox, privilege escalation, etc. – feral_fenrir Jul 25 '16 at 6:16
3
+100

1) "Are there any other internals which I've missed and worth noting."

I'm not sure if I've understood you correctly, especially at the "worth nothing" part but there is a big change on the sandboxing mechanism. According to a review at The Register, Microsoft removes a part of the sandboxing for the applications which have been downloaded from the Application Store (not sure if this applies to the 3rd party applications).

Also, they have been thinking of expanding the Windows API so that more features and libraries will be usable by the user applications. To defend this choice, they claim that it should be users responsibility to inspect the applications intent rather than blocking the applications capabilities.

Finally, Microsoft is still considering if it was a good idea to unify the platforms or not, according to the link above. If you ask me, these are some radical changes. I'm not an expert on the UWP topic but as far as I've seen, it is only a way of packaging rather than an effort to implement heightened security. A .appx file seems to contain; a standard executable, block map file which contains file hashes, an app signature and the rest of the data such as images and so on. Maybe they will take more and more radical decisions soon, such as reverting back to the old structure.

2) "How would we approach pen-testing UWP apps targeted at Windows 10 tabs and devices."

Test Types:

  • Debugger: Well, as with any other Windows application I would start with OllyDbg or an equivalent debugger to analyze the behavior. If you know how to read a debugger output, you can gain a lot of information quickly.

  • Fuzz Testing: Again same with the debugging, always a good choice to try. Forcing various data towards the application through input channels may reveal some information about the application.

Now, for the attack types:

  • DLL Injection: It seems to be working with the UWP applications too but only if the included DLLs in the .appx are not signed. Trying to hook different malicious DLLs might give you an insight on the security side. In here, actually somebody used this method as a game mod.

  • Privilege Escalation: Although there is a sandbox mechanism, it is not a guarantee for perfect encapsulation. In fact, the post in this link claims that somebody have managed to use an exploit in a 0-day payload to escape APPCONTAINER mechanism.

  • Input/Output Sniffing: Lets assume that your application is secure as a castle itself. All DLLs are signed, there are no exploits in the DLLs you use or in DLLs which belong the system. Fuzzing tests have found not even a slightest bug. Even in this situation, there might be design flaws in your application which you will have to consider. Does your application show a valuable information in clear text which can be obtained by a screenshot? Does your application communicate with an external source without an encryption? These questions actually do not depend on the UWP system but again they may reveal delicate information about the application or the user. Your application can be secure but Windows still uses Win32 applications beside the UWP ones so you have to be careful about the design flaws.

That is what I can think of now. I've never used any of these methods on a Windows 10 before since it would be more beneficial for a hacker to utilize phishing methods rather than look for cracks in the software. Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.