WINDOWS KERNEL HIJACKING IS NOT AN OPTION: MEMORYRANGER COMES TO THE RESCUE AGAIN Igor Korkin, PhD Independent Researcher Moscow, Russian Federation [email protected] ABSTRACT The security of a computer system depends on OS kernel protection. It is crucial to reveal and inspect new attacks on kernel data, as these are used by hackers. The purpose of this paper is to continue research into attacks on dynamically allocated data in the Windows OS kernel and demonstrate the capacity of MemoryRanger to prevent these attacks. This paper discusses three new hijacking attacks on kernel data, which are based on bypassing OS security mechanisms. The first two hijacking attacks result in illegal access to files open in exclusive access. The third attack escalates process privileges, without applying token swapping. Although Windows security experts have issued new protection features, access attempts to the dynamically allocated data in the kernel are not fully controlled. MemoryRanger hypervisor is designed to fill this security gap. The updated MemoryRanger prevents these new attacks as well as supporting the Windows 10 1903 x64. Keywords: hypervisor-based protection, Windows kernel, hijacking attacks on memory, memory isolation, Kernel Data Protection. 1. INTRODUCTION the same high privilege level as the OS kernel, and they also include a variety The security of users’ data and of vulnerabilities. Researchers applications depends on the security of consider that “kernel modules (drivers) the OS kernel code and data. Modern introduce additional attack surface, as operating systems include millions of they have full access to the kernel’s lines of code, which makes it address space” (Yitbarek and Austin, impossible to reveal and remediate all 2019). vulnerabilities. Attackers can exploit the OS vulnerabilities to perform At the recent DEF CON hacking malicious actions. Windows OS kernel conference researchers from remains one of the most desired targets Eclypsium released a list of more than for hackers. 40 drivers from Microsoft-certified hardware vendors, which are prone to Another big challenge of OS privilege escalation attacks (Jesse and kernel protection is the third-party Shkatov, 2019). kernel-mode drivers, which execute at Another vulnerability in a signed The Microsoft Security team do third-party driver was presented at the their best to maintain a high level of Blue Hat IL conference by security OS kernel protection by issuing experts from the Microsoft Defender various security features, for example, ATP Research Team. The vulnerable Microsoft Kernel Patch Protection driver uses a watchdog mechanism (KPP) aka PatchGuard etc. At the based on user APC injection, which same, time security researchers and can also be exploited by attackers to rootkit developers are discovering bypass driver signature enforcement different techniques to bypass and gain escalated privileges. PatchGuard. The most notable of them (Rapaport, 2019). was GhostHook, which abused the Recently revealed Banking trojan Intel Processor Trace (PT) feature to “Banload”, which targets bank overcome PatchGuard and patch the customers in Brazil and Thailand, kernel. Cimpanu (2019) underlines that applied a malicious kernel-mode two recently published bypassing component to fight with anti-malware techniques InfinityHook and ByePg and banking protection programs. This “establish a permanent foothold in the digitally signed malware driver is kernel itself and open the door for the designed “to remove software drivers return of rootkits on Windows 10”. and executables belonging to anti- We can see that on the one hand, malware and banking protection all drivers and the OS kernel share the programs”, such as AVG, Avast, IBM same memory space, and on the other Trusteer Rapport (Bisson, 2019; hand, there are no built-in mechanisms Kremez, 2019). to restrict access to the kernel memory. Kernel-mode drivers were also All drivers have full access to the used during the recent RobbinHood system and can be used by attackers. ransomware attack. Hackers installed a Windows security features provide legitimate driver and exploited its limited kernel memory protection. vulnerability to temporarily disable the Threat model Windows OS driver signature Let us assume that using various enforcement. Finally, they installed a approaches, intruders are able to malicious kernel driver (Cimpanu, execute malicious kernel code. This 2020). paper analyses two types of attacks on Notorious cryptocurrency mining kernel data, which result in the malware also applies kernel-mode following, see Figure 1: rootkits to prevent them from being • gaining access to the files open terminated. Windows-based crypto in an exclusive mode (Handle miner infected more than 50000 Hijacking and Hijacking NTFS servers from 90 countries (Harpaz and data structures); Goldberg, 2019; O'Donnell, 2019). • escalating process privileges internal data structures, related to the without using the token Object Manager and NTFS driver swapping technique (Token components. Hijacking). The third attack escalates process For the attacks on files, a legal privileges by patching the static and driver creates a file via ZwCreateFile the variable portions of _TOKEN with zero flag ShareAccess, which structure, without using token gives the caller exclusive access to the swapping or token stealing techniques. open file. While the file remains This type of attack is mapped to opened all attempts to gain access to MITRE ATT&CK (2020) under this file via ZwCreateFile are in vain. Access Token Manipulation. The type Windows OS detects this illegal access of escalation privilege attack based on and returns a status sharing violation SeImpersonatePrivilege function is out code (0xC0000043), which indicates of the scope of this paper (Bisht, that “a file cannot be opened because 2020). the share access flags are All newly proposed attacks are incompatible” (Microsoft, 2019). working transparently on Windows 10 This research reveals two different 1903 64 bit as well as for its security attacks, which bypass Windows features, such as Patch Guard, Device security features and successfully gain Guard, and Security Reference unauthorized access to the files opened Monitor. without shared access by patching OS Researcher s Open file without Driver sharing access Secret Formula Attacker s Driver OS process OSstructures structures Figure 1. The following attacks will be considered: attacks on files and a privilege escalation attack. To prevent all these attacks on Section 5 and Section 6 focus on Windows OS kernel data the updated the main conclusions and further MemoryRanger hypervisor will be research directions respectively. presented. 2. TWO HIJACKING ATTACKS MemoryRanger prevents attacks ON THE FILES OPENED on files by running newly loaded WITHOUT SHARED ACCESS drivers in separated kernel spaces as well as restricting access to the This section describes the corresponding sensitive memory areas. internals of file operations in the Windows OS kernel: data structures The newest key feature of and correlations between them. Two MemoryRanger allows it to run a given hijacking attacks make it special data enclave for sensitive OS possible to illegally read and overwrite kernel data, such as _TOKEN the content of the file opened in an structures. This enclave includes these exclusive mode. These two hijacking sensitive OS structures, OS kernel attacks are based on modifying the OS core, and a limited number of OS internal data structures involved in file kernel built-in drivers. This new operations. scheme prevents illegal access from all drivers whether loaded before and after 2.1. Control Flow and Internal Data MemoryRanger. Structures Involved in Read and Write File Operations The remainder of the paper is as follows. Windows OS provides four main kernel API routines to create, Section 2 provides the details of read/write, and close files: the control flow and corresponding ZwCreateFile, ZwReadFile, internal data structures involved during ZwWriteFile, ZwClose. file operations in kernel mode. Two examples of hijacking attacks on files During file operations, several OS will be given. kernel components are involved (Russinovich, Solomon, and Ionescu, Section 3 presents the details of 2012; Tanenbaum and Bos, 2014). access control issues in the Windows Each time a driver calls ZwCreateFile OS kernel and shows how attackers the control goes to the following OS can hijack the corresponding structure kernel subsystems: I/O manager, in order to escalate the process Object Manager, Security Reference privileges. Monitor, NTFS driver, and finally, the Section 4 contains the details of control goes to the low-level drivers, adapting MemoryRanger to prevent such as Disk Filter Driver and Disk these attacks. Class Driver. These are in charge of access to the physical disk. The key features revealed by will be redirected by the OS to the Korkin (2019) are that Security secret file, see Figure 3. This is the key Reference Monitor checks access point of all hijacking attacks on files. rights to the file for ZwCreateFile Intruders can modify the routine, while routines ZwReadFile, following data to change the control ZwWriteFile are uncontrolled by the flow, the corresponding attacks are in Security Reference Monitor. brackets: Once a file is created via calling • handle table entries (Handle ZwCreateFile, the OS creates a file Table Hijacking); handle, adds an entry to the Handle • file object (Hijacking Table, allocates file object, NTFS data,