Journal of Digital Forensics, Security and Law Volume 16 Article 4 June 2021 Windows Kernel Hijacking Is Not an Option: MemoryRanger Comes to the Rescue Again Igor Korkin Independent Researcher, [email protected] Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer and Systems Architecture Commons, Information Security Commons, OS and Networks Commons, Software Engineering Commons, and the Systems Architecture Commons Recommended Citation Korkin, Igor (2021) "Windows Kernel Hijacking Is Not an Option: MemoryRanger Comes to the Rescue Again," Journal of Digital Forensics, Security and Law: Vol. 16 , Article 4. Available at: https://commons.erau.edu/jdfsl/vol16/iss1/4 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Windows Kernel Hijacking Is Not an Option: MemoryRanger Comes to the Rescue Again Cover Page Footnote I would like to thank Benjamin Stein, a teacher of English, Kings Education, London, UK for his invaluable corrections of the paper. I am also extremely grateful to Michael Chaney, ERAU alumni, Cyber-Research Editor, USA, for his time and effort in checking a preliminary version of this paper and providing constructive feedback, which significantly contributed ot improving the quality of this paper. This article is available in Journal of Digital Forensics, Security and Law: https://commons.erau.edu/jdfsl/vol16/iss1/ 4 JDFSL 2021 WINDOWS KERNEL HIJACKING IS NOT AN OPTION: MEMORYRANGER COMES TO THE RESCUE AGAIN Igor Korkin, PhD Independent Researcher Moscow, Russian Federation [email protected] ABSTRACT The security of a computer system depends on OS kernel protection. It is crucial to reveal and inspect new attacks on kernel data, as these are used by hackers. The purpose of this paper is to continue research into attacks on dynamically allocated data in the Windows OS kernel and demonstrate the capacity of MemoryRanger to prevent these attacks. This paper discusses three new hijacking attacks on kernel data, which are based on bypassing OS security mechanisms. The first two hijacking attacks result in illegal access to files open in exclusive access. The third attack escalates process privileges, without applying token swapping. Although Windows security experts have issued new protection features, access attempts to the dynamically allocated data in the kernel are not fully controlled. MemoryRanger hypervisor is designed to fill this security gap. The updated MemoryRanger prevents these new attacks as well as supporting the Windows 10 1903 x64. Keywords: hypervisor-based protection, Windows kernel, hijacking attacks on memory, memory isolation, Kernel Data Protection 1. INTRODUCTION nerabilities. Researchers consider that “ker- nel modules (drivers) introduce additional The security of users’ data and applications attack surface, as they have full access to depends on the security of the OS kernel the kernel’s address space” (Yitbarek and code and data. Modern operating systems Austin, 2019). At the recent DEF CON include millions of lines of code, which makes hacking conference researchers from Eclyp- it impossible to reveal and remediate all vul- sium released a list of more than 40 drivers nerabilities. Attackers can exploit the OS from Microsoft-certified hardware vendors, vulnerabilities to perform malicious actions. which are prone to privilege escalation at- Windows OS kernel remains one of the most tacks (Jesse and Shkatov, 2019). Another vul- desired targets for hackers. Another big chal- nerability in a signed third-party driver was lenge of OS kernel protection is the third- presented at the Blue Hat IL conference by party kernel-mode drivers, which execute at security experts from the Microsoft Defender the same high privilege level as the OS ker- ATP Research Team. The vulnerable driver nel, and they also include a variety of vul- uses a watchdog mechanism based on user © 2021 JDFSL Page 1 JDFSL 2021 APC injection, which can also be exploited access to the kernel memory. All drivers have by attackers to bypass driver signature en- full access to the system and can be used by forcement and gain escalated privileges. (Ra- attackers. Windows security features provide paport, 2019). Recently revealed Banking limited kernel memory protection. trojan “Banload”, which targets bank cus- Threat model Let us assume that using tomers in Brazil and Thailand, applied a various approaches, intruders are able to exe- malicious kernel-mode component to fight cute malicious kernel code. This paper analy- with anti-malware and banking protection ses two types of attacks on kernel data, which programs. This digitally signed malware result in the following, see Figure 1: driver is designed “to remove software drivers and executables belonging to anti-malware • gaining access to the files open in an and banking protection programs”, such as exclusive mode (Handle Hijacking and AVG, Avast, IBM Trusteer Rapport (Bisson, Hijacking NTFS data structures); 2019; Kremez, 2019). Kernel-mode drivers • escalating process privileges without us- were also used during the recent RobbinHood ing the token swapping technique (Token ransomware attack. Hackers installed a le- Hijacking). gitimate driver and exploited its vulnerabil- ity to temporarily disable the Windows OS For the attacks on files, a legal driver cre- driver signature enforcement. Finally, they ates a file via ZwCreateFile with zero flag installed a malicious kernel driver (Cimpanu, ShareAccess, which gives the caller exclusive 2020). Notorious cryptocurrency mining mal- access to the open file. While the file remains ware also applies kernel-mode rootkits to pre- opened all attempts to gain access to this file vent them from being terminated. Windows- via ZwCreateFile are in vain. Windows OS based crypto miner infected more than 50000 detects this illegal access and returns a status servers from 90 countries (Harpaz and Gold- sharing violation code (0xC0000043), which berg, 2019; O’Donnell, 2019). The Microsoft indicates that “a file cannot be opened be- Security team do their best to maintain a cause the share access flags are incompatible” high level of OS kernel protection by issuing (Microsoft, 2019). various security features, for example, Mi- This research reveals two different attacks, crosoft Kernel Patch Protection (KPP) aka which bypass Windows security features and PatchGuard etc. At the same, time secu- successfully gain unauthorized access to the rity researchers and rootkit developers are files opened without shared access by patch- discovering different techniques to bypass ing OS internal data structures, related to PatchGuard. The most notable of them was the Object Manager and NTFS driver com- GhostHook, which abused the Intel Processor ponents. The third attack escalates process Trace (PT) feature to overcome PatchGuard privileges by patching the static and the vari- and patch the kernel. Cimpanu (2019) under- able portions of _TOKEN structure, without lines that two recently published bypassing using token swapping or token stealing tech- techniques InfinityHook and ByePg “estab- niques. This type of attack is mapped to lish a permanent foothold in the kernel itself MITRE ATTCK (2020) under Access Token and open the door for the return of rootkits Manipulation. The type of escalation privi- on Windows 10”. We can see that on the one lege attack based on SeImpersonatePrivilege hand, all drivers and the OS kernel share the function is out of the scope of this paper same memory space, and on the other hand, (Bisht, 2020). All newly proposed attacks are there are no built-in mechanisms to restrict working transparently on Windows 10 1903 Page 2 © 2021 JDFSL JDFSL 2021 64 bit as well as for its security features, such the file opened in an exclusive mode. These as Patch Guard, Device Guard, and Security two hijacking attacks are based on modifying Reference Monitor. the OS internal data structures involved in To prevent all these attacks on Windows file operations. OS kernel data the updated MemoryRanger hypervisor will be presented. MemoryRanger 2.1 Control Flow and Internal prevents attacks on files by running newly Data Structures Involved loaded drivers in separated kernel spaces as in Read and Write File well as restricting access to the correspond- Operations ing sensitive memory areas. The newest key feature of MemoryRanger allows it to run a Windows OS provides four main kernel API special data enclave for sensitive OS kernel routines to create, read/write, and close files: data, such as _TOKEN structures. This en- ZwCreateFile, ZwReadFile, ZwWriteFile, Zw- clave includes these sensitive OS structures, Close. During file operations, several OS ker- OS kernel core, and a limited number of OS nel components are involved (Russinovich, kernel built-in drivers. This new scheme pre- Solomon, and Ionescu, 2012; Tanenbaum and vents illegal access from all drivers whether Bos, 2014). Each time a driver calls ZwCre- loaded before and after MemoryRanger. The ateFile the control goes to the following OS remainder of the paper is as follows. Sec- kernel subsystems: I/O manager, Object tion 2 provides the details of the control flow Manager, Security Reference Monitor, NTFS and corresponding internal data structures driver, and finally, the control goes to the involved during file operations in kernel mode. low-level drivers, such as Disk Filter Driver Two examples of hijacking attacks on files will and Disk Class Driver. These are in charge of be given. Section 3 presents the details of access to the physical disk. The key features access control issues in the Windows OS ker- revealed by Korkin (2019) are that Security nel and shows how attackers can hijack the Reference Monitor checks access rights to the corresponding structure in order to escalate file for ZwCreateFile routine, while routines the process privileges. Section 4 contains the ZwReadFile, ZwWriteFile are uncontrolled details of adapting MemoryRanger to prevent by the Security Reference Monitor.