The Danger of Trusting an API

Lots of Programs Are Unwary

• Example: Custom AIX Mail Handler

  • Home-grown example captured in the wild: trusts an environment variable

• Example: The DB2 Client for Windows

  • How DB2 CAE misused OS security

• Example: Shatter and Windows Messaging

  • Demo: Automated Shatter-style Attack on Cisco VPN Client
  • Source code for the demo is available here: ToorConShatterSource.zip