HEXACON2024 – What the hell is Windows’s CLIP Service by Philippe Laulheret

Summary: The video discusses the Windows Clip Service, specifically focusing on the Client Licensed Platform (CLIP) and its System Policy (CPSP). Philip Lett, a researcher at Cisco Talos, explains the architecture and functions of CPSP, the process of reversing it, and the vulnerabilities discovered during his research. He emphasizes the undocumented nature of CPSP and offers insights into the reverse engineering process, potential attack surfaces, and the significance of the findings in the context of Windows security.

Keypoints:

• The Windows Clip Service relates to license management, focusing on system policies and cryptographic measures.
• CLIP stands for Client Licensed Platform and consists of various components, including clip.dll and clipsp.sys.
• The talk includes details on the reversing process for understanding CPSP, which is largely undocumented.
• Vulnerabilities were identified, particularly around elevation of privileges (EOP) within Windows drivers.
• The process involves investigating how Windows communicates with CPSP and examining potential vulnerabilities in its API.
• Warbird, a proprietary obfuscator used by Microsoft, complicates understanding and reversing CPSP.
• Two notable vulnerabilities were discussed: a signature bypass allowing modification of licenses and a device ID manipulation leading to out-of-bounds reads.
• The research reveals potential for exploiting these vulnerabilities to manipulate software licenses and possibly escape from application containers.
• Future considerations include ongoing development of CPSP and potential new vulnerabilities as more features are integrated.
• The importance of understanding obfuscated code in security research and the ongoing relevance of EOP vulnerabilities.