Microsoft releases new version of Attack Surface Analyzer utility

guest · May 15, 2019

Microsoft releases new version of Attack Surface Analyzer utility
New Attack Surface Analyzer 2.0 works on Windows, but also Mac and Linux
May 16, 2019
https://www.zdnet.com/article/microsoft-releases-new-version-of-attack-surface-analyzer-utility/

Seven years after releasing version 1.0, Microsoft has published version 2.0 of its Attack Surface Analyzer utility, a tool that logs the changes made to a Windows OS during the installation of third-party applications.
HOW TO USE THE NEW TOOL
The new Attack Surface Analyzer 2.0 is pretty straightforward to use. The entire tool is just two sections -- one for scanning a system, and one for displaying the results.
The scan section supports two types of scans, a static scan, and a live monitoring mode.

Static scans can be used to detect changes made between a before and after state. Users are supposed to scan a system before installing an app, and after the app's installation. This will produce a report showing the changes between the two states.
The second scan mode is called Live Monitoring, and as the name suggests, records changes made to a Windows OS in real time.
Click to expand...

WHERE TO DOWNLOAD
The new Attack Surface Analyzer 2.0 is now available on GitHub, where Microsoft has open-sourced the code and opened the development process to any contributors.

Fans of the old Attack Surface Analyzer 1.0 release can still get the older version -- now known as the "classic" version -- from Microsoft's main download center.
Click to expand...

Microsoft: Announcing the all new Attack Surface Analyzer 2.0

EASTER · May 15, 2019

Guess this thing isn't even compiled yet. Not everyone compiles builds.

guest · Jun 21, 2019

Three-stage exploit turns Attack Surface Analyzer against hosts
June 20, 2019
https://portswigger.net/daily-swig/three-stage-exploit-turns-attack-surface-analyzer-against-hosts

The proof-of-concept exploit he put together is somewhat ironic because Attack Surface Analyzer is designed to scan an OS to analyze changes an installed application has made (i.e. potential problems) rather than becoming a conduit for the attack itself.

Stage one of the attack depends on ASA’s use of Electron.NET, a tool for packaging web apps as desktop applications.
ASA is built on top of Electron.NET but a bug in the implementation means an attacker can use a targeted victim’s web browser to access ASA, the underlying application.
[...] “A remote attacker can submit a runID with embedded JavaScript that is executed by the victim using the ASA Electron application,” Hakimian explains.

Hakimian reported the issue to Microsoft late last month. Redmond confirmed the problem and developed a fix, released earlier this month.
A full write-up of the three-stage attack can be found in a blog post by Hakimian.
Click to expand...

Floyd 57 · Jun 21, 2019

EASTER said: ↑

Guess this thing isn't even compiled yet. Not everyone compiles builds.
Click to expand...

It's not that hard, they even wrote instructions (quite a rarity ) - https://github.com/Microsoft/AttackSurfaceAnalyzer/blob/master/BUILD.md

EASTER · Jun 21, 2019

Floyd 57 said: ↑

It's not that hard, they even wrote instructions (quite a rarity ) - https://github.com/Microsoft/AttackSurfaceAnalyzer/blob/master/BUILD.md
Click to expand...

Thanks and that does help.

Floyd 57 · Jun 21, 2019

EASTER said: ↑

Thanks and that does help.
Click to expand...

I'm not sure if you're being sarcastic

Log in or Sign up

Microsoft releases new version of Attack Surface Analyzer utility

guest Guest

EASTER Registered Member

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

Floyd 57 Registered Member

Log in or Sign up

Microsoft releases new version of Attack Surface Analyzer utility

guest Guest

EASTER Registered Member

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

Floyd 57 Registered Member

Useful Searches