More than 2 years ago I released Meltdown. It's a proof-of-concept tool that showed several security issues in Faronics DeepFreeze products. Faronics are infamous for their attempts to hide the issues, so I was really curious how it will work out.
Bugs in my code
First, a few bugs in my code surfaced. None of them were in the core components dealing with DeepFreeze, I had that part tested thoroughly. But I overlooked issues with UAC, possibility that Windows are not installed on drive C:\, empty passwords and other edge cases.
All in all, it was a good learning experience.
Requests for source code
The very first version of Meltdown came with a full source code and explanation of the vulnerabilities in Faronics products. Once I started fixing bugs, I released only the updated binary. Yet quite a few people kept asking for the updated source.
To be honest, I have no idea why. So far, I haven't seen a single tool that would be based on my source code, not even a straightforward rip with a changed name and copyrights. Weird..
Bug reports
People reported bugs. Big bugs, small bugs, non-bugs and everything in between.
Most bug reports came from arabic-speaking guys. Some of them even didn't bother to use Google Translate and wrote in their native language. No, I really don't speak Arabic, German, French or Indonesian.
Also, most bug reports came without any actionable information whatsoever. Just "It doesn't work". Well, that's not helpful at all! I really want to help you, but you must tell me more than that. In later versions, I added information to main window about detected OS, 32/64bits, detected DF version, etc, etc. And then I can just ask for a screenshot, it contains most of the info I need to replicate the issue.
It was a good learning experience again. I learned how to make my tools more user-proof.
Faronics response
For a year, there was none.
Then in June 2014 they released DeepFreeze Enterprise 8.11 where the issue was fixed. At least the changelog says so:
7936 Resolved a security issue that could result in the user accessing Deep Freeze without authorization.
Yeah, right.. In reality they just added yet-another-layer of xor-encryption and removed useful data from frzstate2k.exe. But the same data are still present in dfserv.exe.
Wow, that's what I call "resolving a security issue"! 🙂
In September 2014 they released DeepFreeze Standard 8.10 where the other vulnerability was fixed. However, there was no mention of anything like that in the changelog. From a quick glance, it looks like they finally got their code right and aren't sending xor-encrypted password from driver to usermode anymore.
What now?
I'm presenting you an updated version of Meltdown.
It shows that vulnerabilities in Enterprise version are still present, just slightly more obfuscated. But security through obscurity does not work!
The glaring vulnerability in Standard version is fixed, and 8.x Standard versions seem to be safe. Funny, isn't it - you'd expect a corporate product to provide better security than home-edition, yet this is not the case.. 🙂
Download link for Meltdown v1.5: http://www.mediafire.com/?0wc0vv1kauhwxbb
There's a good reason to publish the source code: trust. It's a lot harder to hide a backdoor or any other malicious stuff in source code than it is in a binary. Not impossible, but really really a lot harder.
I tend not to use tools without sources unless I have no alternative. And even then, sometimes I still prefer to use nothing at all.
i would this toolsoft and for deep freeze 8.23. 🙂
not work in enterprise 8.36