If you are interested in talks with happy ending, you better be off listening to some other topic. In this talk, not only there is no happy ending, there is no happy beginning and a very few happy things in the middle. This is not only because we destroyed 10 smartphones during our reserach project, but rather due to our daily struggles that come along with being a hardware reverse engineer. You don't know what a netlist is? Good, then there is still time to save yourself. Otherwise, in this talk, you will learn how to extract it from a chip, analyze it, and understand it - and why, despite everything speaking against it, this is actually quite fun and exciting. We will also provide (painful) insights into conducting real-world netlist reverse engineering by presenting a case-study on a completely unknown modern hardware design. Welcome to HAL!

Seven different vulnerabilities and insecure design elements present in Microsoft Teams, can be leveraged by an attacker, to execute a reverse shell between an attacker and victim, where no communication is directly exchanged between an attacker and a victim, but is entirely piped through malicious GIFs sent in Teams messages, and Out of Bounds (OOB) lookups of GIFs conducted by Microsoft's own servers. This unique C2 infrastructure can be leveraged by sophisticated threat actors to avoid detection by EDR and other network monitoring tools. Particularly in secure network environments, where Microsoft Teams might be one of a handful of allowed, trusted hosts and programs, this attack chain can be particularly devastating.
Two additional vulnerabilities discovered in Microsoft Teams, a lack of permission enforcement and attachment spoofing, allow for the GIFShell stager to be convincingly dropped and executed on the victim's machine, completing the attack chain from victim compromise to covert communications. These two vulnerabilities can also lead to RCE directly via a crafted NTLM Relay attack.
This entire attack chain and related vulnerabilities, were reported to Microsoft in May and June of 2022, however after 85 days of review, the reports did not meet their “bar for immediate servicing” despite this being “great research”.
The reports were submitted for Teams — Version 1.5.00.11163 (And Earlier). These vulnerabilities and misconfigurations remain unpatched in the most recent version of Teams and the GIFShell attack chain can be carried on the most recent versions of Teams. Initial research reveals several malware samples which are potentially leveraging this attack chain in the wild. Microsoft has explicitly granted me permission to “blog about/discuss this case and/or present your findings publicly”.
Oftentimes, companies and engineering teams make design decisions based on “assumed risk”, whereby a potentially low impact vulnerability is left unpatched or a security feature is disabled by default, in order to achieve some business objective. I believe this research is demonstrative of an instance where a series of design decisions and “assumed risks” made by a product engineering team, can be chained together into a more pernicious attack chain, and a far higher risk exploit than the product designers imagined was possible.

Code Integrity is a threat protection feature first introduced by Microsoft over 15 years ago. On x64-based versions of Windows, kernel drivers must be digitally signed and checked each time they are loaded into memory. This is also referred to as Driver Signature Enforcement (DSE).
To overcome this restriction, attackers use valid digital certificates, either issued to them or they stole, or disable DSE during runtime instead. Obtaining a certificate is a logistical obstacle but tampering on the other hand is a technical challenge. Recent years prove the latter tactic only grew in popularity by various APTs as they continued to leverage the well-known DSE tampering technique.
Meanwhile, Microsoft rolled out new mitigations: driver blocklists and Kernel Data Protection (KDP), a new platform security technology for preventing data-oriented attacks. Since using blocklist only narrows the attack vector, we focused on how KDP was applied in this case to eliminate the attack surface.
We'll present two novel techniques we found to bypass KDP-protected DSE. Furthermore, they work on all Windows versions, starting with the first release of DSE. Each technique will be demonstrated on live machines. We'll also suggest a mitigation to cope with the issue, building upon the same premises as attackers, until HVCI becomes prevalent and really eliminates this attack surface.