Systems, methods, apparatus, and computer readable media for intercepting and modifying HMAC signed messages
View Patent ↗Systems, methods, apparatus and computer-executable instructions stored on computer-readable media for communicating a modified hash message authentication code (HMAC) signed message between two endpoints are provided. The HMAC signature of the message may include a plurality of components. In some cases, the HMAC signature is a Server Message Block (SMB) signature. The first and/or second endpoint may be a client, server, or host. Some embodiments of the present application utilize a proxy, such as a CIFS proxy. In one embodiment, HMAC signature information sent from the first endpoint to the second endpoint may be intercepted. A value for a component of the HMAC signature may be determined by, for example, using the intercepted HMAC signature information. The intercepted message may be modified, resigned using the intercepted HMAC signature information, and transmitted to a receiving endpoint.
1. A method for communicating a message having a Hash Message Authentication Code (HMAC) signature from a first endpoint to a second endpoint, wherein HMAC information associated with the message includes a plurality of components, the method comprising:
intercepting the HMAC information;
determining values for at least one of the plurality of components of the HMAC information using the intercepted HMAC information, wherein the values include a secret key determined from one or more of a Security Support Provider Interface (SSPI) and Generic Security Service Application Programming Interface (GSS-API) interface entry point using an application programming interface (API) hook, the API hook exposing, via a kernel mode dynamic-link library (DLL), one or more of the SSPI and GSS-API interface entry points so as to allow the secret key to be queried at one or more of the SSPI and GSS-API interface entry points;
intercepting the message having the HMAC signature;
modifying the message;
resigning the modified message using the determined values; and
transmitting the resigned message to the second endpoint.
2. The method of claim 1 , wherein the steps of claim 1 are performed by a Common Internet File System (CIFS) proxy.
3. The method of claim 1 , wherein the plurality of components of the HMAC information includes at least one of a sequence number, a connection signing use NT Lan Manager (NTLM) challenge response, the secret key, a public key, a connection signing NTLM challenge response, and a message.
4. The method of claim 3 , further comprising:
deriving at least one of the connection signing use NTLM challenge response, the connection signing NTLM challenge response, and the message, using the intercepted HMAC information.
5. The method of claim 3 , further comprising:
determining an initial sequence number for the beginning of an HMAC transmission session; and
deriving the sequence number of the intercepted message using the initial sequence number.
6. The method of claim 1 , wherein the HMAC signature is a Server Message Block (SMB) signature.
7. The method of claim 1 , wherein the first endpoint is at least one of a client, server, and host and the second endpoint is at least one of a client, server, and host.
8. A method for transmitting a message having a Hash Message Authentication Code (HMAC) signature from a first endpoint to a second endpoint, the method comprising:
intercepting HMAC signature information including a sequence number and a secret key, wherein the secret key is determined from one or more of a Security Support Provider Interface (SSPI) and Generic Security Service Application Programming Interface (GSS-API) interface entry point using an application programming interface (API) hook, the API hook exposing, via a kernel mode dynamic-link library (DLL), one or more of the SSPI and GSS-API interface entry points so as to allow the secret key to be queried at one or more of the SSPI and GSS-API interface entry points;
intercepting the message having the HMAC signature;
recognizing a boundary of the message;
determining the sequence number of the message;
determining the secret key for the message;
modifying the message;
resigning the modified message using the message boundary, sequence number and secret key; and
transmitting the resigned message to the second endpoint.
9. The method of claim 8 , wherein the steps of claim 8 are performed by a Common Internet File System (CIFS) proxy.
10. The method of claim 8 , wherein the HMAC signature is a Server Message Block (SMB) signature.
11. The method of claim 8 , wherein the first endpoint is at least one of a client, server, and host and the second endpoint is at least one of a client, server, and host.
12. A system, wherein the system is enabled to transmit a message having a Hash Message Authentication Code (HMAC) signature from a first endpoint to a second endpoint, wherein HMAC information associated with the message includes a plurality of components, the system comprising:
a storage device; and
a set of instructions on the storage device, including:
a software subroutine configured to intercept the HMAC information;
a software subroutine configured to determine values for at least one of the plurality of components of the HMAC signature information using the intercepted HMAC information, wherein the values include a secret key determined from one or more of a Security Support Provider Interface (SSPI) and Generic Security Service Application Programming Interface (GSS-API) interface entry point using an application programming interface (API) hook, the API hook exposing, via a kernel mode dynamic-link library (DLL), one or more of the SSPI and GSS-API interface entry points so as to allow the secret key to be queried at one or more of the SSPI and GSS-API interface entry points;
a software subroutine configured to intercept the message having the HMAC signature;
a software subroutine configured to modify the message;
a software subroutine configured to resign the modified message using the determined values; and
a software subroutine configured to transmit the resigned message to the second endpoint.
13. A non-transitory computer readable media including instructions for transmitting a message having a Hash Message Authentication Code (HMAC) signature from a first endpoint to a second endpoint, wherein HMAC information associated with the message includes a plurality of components, the non-transitory computer readable media further including instructions for:
intercepting HMAC information;
determining values for at least one of the plurality of components of the HMAC information using the intercepted HMAC information, wherein the values include a secret key determined from one or more of a Security Support Provider Interface (SSPI) and Generic Security Service Application Programming Interface (GSS-API) interface entry point using an application programming interface (API) hook, the API hook exposing, via a kernel mode dynamic-link library (DLL), one or more of the SSPI and GSS-API interface entry points so as to allow the secret key to be queried at one or more of the SSPI and GSS-API interface entry points;
intercepting the message having the HMAC signature;
modifying the message;
resigning the modified message using the determined values; and
transmitting the resigned message to the second endpoint.