microsoft / microsoft/AttackSurfaceAnalyzer

PE Net exception on Google drive files

Open
#591 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
3k
Forks
294
PR merge metrics
No merged PRs in 30d

Description

To reproduce: Install "Google Drive for Desktop". You should now have a virtual drive letter (e.g. G:) mapped to Google Drive.

Run: asa collect -a

Get the following error once it gets to scanning the virtual drive:

[10:16:01 INF] Scanning root G:
Fatal error. Fatal error. System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception.
System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception.
at System.IO.UnmanagedMemoryAccessor.ReadInt32(Int64)
at System.Buffer.Memmove(Byte*, Byte*, UIntPtr)
at PeNet.Header.Pe.WinCertificate.get_BCertificate()
at System.Runtime.InteropServices.SafeBuffer.ReadArray[[System.Byte, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](UInt64, Byte[], Int32, Int32)
at PeNet.Header.Authenticode.AuthenticodeInfo..ctor(PeNet.PeFile)
at System.IO.UnmanagedMemoryAccessor.ReadArray[[System.Byte, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]](Int64, Byte[], Int32, Int32)
at PeNet.HeaderParser.Authenticode.AuthenticodeParser.ParseTarget()
at PeNet.FileParser.MMFile.ToArray()
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.WindowsFileSystemUtils.GetSignatureStatus(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo.ComputeAuthenticodeHashFromPeFile(System.Security.Cryptography.HashAlgorithm)
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.FilePathToFileSystemObject(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo.VerifyHash()
at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.ParseFile(System.String)
at PeNet.Header.Authenticode.AuthenticodeInfo..ctor(PeNet.PeFile)
at System.Threading.Tasks.Parallel+<>c__DisplayClass44_02[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<PartitionerForEachWorker>b__1(System.Collections.IEnumerator ByRef, Int32, Boolean ByRef) at PeNet.HeaderParser.Authenticode.AuthenticodeParser.ParseTarget() at System.Threading.Tasks.TaskReplicator+Replica.Execute() at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.WindowsFileSystemUtils.GetSignatureStatus(System.String) at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.FilePathToFileSystemObject(System.String) at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread) at Microsoft.CST.AttackSurfaceAnalyzer.Collectors.FileSystemCollector.ParseFile(System.String) at System.Threading.ThreadPoolWorkQueue.Dispatch() at System.Threading.Tasks.Parallel+<>c__DisplayClass44_02[[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=5.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].b__1(System.Collections.IEnumerator ByRef, Int32, Boolean ByRef)
at System.Threading.Tasks.TaskReplicator+Replica.Execute()
at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread)
at System.Threading.ThreadPoolWorkQueue.Dispatch()

A potential workaround would be to allow specifying a list of drive letters to exclude.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with Google Drive for Desktop and asa collect -a against its virtual drive. Start at WindowsFileSystemUtils.GetSignatureStatus and FileSystemCollector, then trace the PeNet Authenticode path shown in the stack trace. Done means scanning the virtual drive no longer terminates with the SEHException, with drive exclusion considered as the reported workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.