DOCSLIB.ORG

Kernel Patch Protection, Более Известная Широкой Публике Под Названием ЛЕЗЕМ В НЕДРА Patchguard, Предназначена Для Защиты ОС ТАИНСТВЕННОЙ Windows

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Kernel Patch Protection, Более Известная Широкой Публике Под Названием ЛЕЗЕМ В НЕДРА Patchguard, Предназначена Для Защиты ОС ТАИНСТВЕННОЙ Windows MALWARE Александр Эккерт ([email protected]) Технология Kernel Patch Protection, более известная широкой публике под названием ЛЕЗЕМ В НЕДРА PatchGuard, предназначена для защиты ОС ТАИНСТВЕННОЙ Windows. Создание и реализацию этой техно- логии можно смело приписывать к несомнен- ТЕХНОЛОГИИ MS — ным заслугам Microsoft в области обеспече- ния защиты ОС от руткитов. Но если набрать KERNEL PATCH в Гугле «PatchGuard», то всемогущий поис- PROTECTION ковик выдаст нам мало чего вразумительного. Не знает Гугл ничего об этой таинственной технологии Microsoft. Яндекс тоже, кстати, в поиске по PatchGuard находится в пролете, ЧТО ИМЕЕМ? аки фанера над Парижем. Но не будем судить Суть технологии PatchGuard проста — система защищает адрес- ное пространство ядра от попыток модификации, тем самым не строго. Вины поисковиков в этом нет: практи- допуская попыток захвата жизненно важных системных позиций. чески вся информация об особенностях этой Защите подлежат объекты, наиболее критические с точки зрения безопасности системы, — это SSDT, GDT, IDT, специфические ре- технологии — результат трудов независимых гистры процессора MSR (через которые проходят так называемые исследователей-кодокопателей. Сегодня мы syscalls), а также само ядро — ntos.exe, библиотека абстракции от оборудования hal.dll и драйвер сетевых операций ndis.sys. не только в деталях рассмотрим, что такое После успешного старта PatchGuard в случайные промежутки PatchGuard и с чем ее едят, но и поговорим времени проверяет целостность виртуальных адресов ядерного пространства и, если обнаруживает подозрительные модифи- о способах ее обхода — тематика журнала того кации, тут же поднимает тревогу с вызовом полиции, скорой, требует ;). пожарных и МЧС в придачу. А если серьезно, то эта технология 092 ХАКЕР 10 /165/ 2012 Малварщики против PatchGuard просто сваливает систему в BSOD с кодом CRITICAL_STRUCTURE_ CORRUPTION (bugcheck 0x109). PatchGuard присутствует лишь в системах Windows Vista+, крутящихся на 64-битных системах. Старушке Windows XP все System check routine прелести PatchGuard не грозят. Кстати, сами майкрософтовские товарищи категорически не приветствуют патчи kernel-space сторонними драйверами, в том числе использованием ядерных стеков, не созданных непосредственно самим ядром (bit.ly/ Exception handler KeSetTimerEx REiEtR). Вместе с тем надо отметить, что PatchGuard защища- ет лишь ядро от патчей драйверов, но не защитит патчи одних драйверов другими. Надо признать, что данная ситуация ставит в тупик разработ- DPC dispatcher чиков систем защит ОС Windows, ведь современные требования к разработке таких защит просто вынуждают контролировать пользователя на уровне ядра, например при помощи перехвата по- тенциально опасных функций в SSDT. При этом сами же разработ- чики ОС Windows вряд ли предоставят возможности для взаи- Access violation DPC routine модействия с PatchGuard (bit.ly/OT5WmN) — зачем давать в руки врагов ключи от квартиры, где деньги лежат? Однако выкручиваться из этой ситуации как-то надо, и сегодня мы попробуем рассмотреть все или почти все имеющиеся способы Important system code ужиться с PatchGuard на одной системе. PATCHGUARD — ВЗГЛЯД ИЗНУТРИ Инициализация PatchGuard до ее полного включения — очень Примерная логика действий PatchGuard замороченная операция. Ее натуральный старт происходит вы- зовом функции nt!KiInitializePatchGuard, однако, прежде чем дело дойдет до ее вызова, должна произойти масса малопонятных nt!KiDivide6432+0x570: и совсем непонятных вещей. Если приглядеться повниматель- sub rsp,0x2d8 нее, то старт PatchGuard происходит где-то на самом раннем cmp dword ptr [nt!InitSafeBootMode] этапе загрузки операционной системы — со стартом основной jne nt!KiDivide6432+0x580 «загрузочной функции» — nt!KeInitSystem. И если поковыряться ... в дизасме этой функции, то можно увидеть все суровые извра- nt!KiDivide6432+0x580: щения разработчиков Microsoft. Нет, серьезно, я понимаю, что mov al,0x1 перед ними стоит задача защитить систему и замаскировать про- add rsp,0x2d8 цесс инициализации PatchGuard, но не обязательно это делать ret настолько изощренно! Итак, смотрим. Старт PatchGuard происходит вызовом функ- Детальный разбор полета функции KiInitializePatchGuard по- ции nt!KiDivide6432, которая делает важное дело — мастерски требует не один десяток страниц журнала, поэтому остановимся делит два числа. Далее начинается магия — идет вызов функции на основных моментах. nt!KiTestDividend, которая просто тестирует полученный результат Главное, что надо знать, когда работаешь с PatchGuard, — с (внимание!) прошитым в коде (!) значением: PatchGuard высчитывает контрольные суммы защищаемых объектов вызовом функции PgCreateBlockChecksumSubContext nt!KeInitSystem+0x158: и хранит их в особой структуре PATCHGUARD_CONTEXT. Для «об- mov rcx,[nt!KiTestDividend] работки» каждого защищаемого объекта используются функ- mov edx,0xcb5fa3 ции PgCreateImageSubContext (для системных образов и SSDT), call nt!KiDivide6432 PgCreateGdtSubContext и PgCreateIdtSubContex (для GDT/IDT), cmp eax, [ _hardcoded value_ ] PgCreateMsrSubContext (для защиты MSR) и PgCreateDebugRoutine jne nt!KeInitSystem + 0x170 SubContext (для отладочных процедур). ... Память под контекст выделяется в условиях очень высокой ано- nt!KeInitSystem + 0x170: нимности, так, чтобы обломать любителей пошариться по чужим mov ecx,0x5d виртуальным адресам. Маскировка контекста проводится вызовом call nt!KeBugCheck //выход по ошибке UNSUPPORTED PROCESSOR PgEncryptContext, которая не слишком продвинуто ксорит пере- даваемый ей PATCHGUARD_CONTEXT и возвращает вызывающему Кто-то может спросить: почему именно хардкод при инициа- XOR-ключ. лизации? Не слишком умно, правда? Но это лишь на первый взгляд. Данный хардкод, как выясняется, нужен лишь для того, «А МЫ ПОЙДЕМ НА СЕВЕР...» чтобы выявить, не находится ли система под дебагом. Как имен- Обойти PatchGuard сложно, но можно. Вообще, строго говоря, но это происходит — оставлю тебе в качестве домашнего за- хорошим парням обход PatchGuard не нужен. Microsoft пре- дания ;). красно понимала, что вводом этой системы в строй отнимает Выполнение функции KiInitializePatchGuard несет в себе часть хлеба у разработчиков антивирусных защит и проактивных много рутины — она мониторит инициализацию контекстов систем. Для решения этой задачи Microsoft ввела ряд новых, SSDT, таблиц GDT/IDT, ключевых регистров процессора MSR, неизвестных доселе Native API и коллбэков, позволяющих от- а также некоторых критических дебаг-функций. Первое, что слеживать телодвижения ОС. Например, чтобы отслеживать делает KiInitializePatchGuard, — это проверяет, не загружается ли изменения в реестре, в руки системных кодеров была передана система в безопасном режиме. В этом случае, то есть при загрузке функция nt!ZwNotifyChangeKey или коллбэк CmRegisterCallbackEx, в SafeMode, PatchGuard инициализирован не будет: которые были призваны информировать обо всех изменениях ХАКЕР 10 /165/ 2012 093 MALWARE WWW INFO На великом Информации в Сети и могучем инфы о PatchGuard очень в Сети о PatchGuard мало. Оно и по- почти нет. Для нятно — Microsoft общего развития совсем не заинтере- можно почитать сована в раскрытии статью К. Касперски особенностей этой «Взлом Patch- технологии. Guard» — is.gd/ xPB2tl. Из англицких WARNING статей можно почитать FAQ про Вся информация PatchGuard — is.gd/ предоставлена xDkpMJ. исключительно в ознакомительных целях. Ни редакция, Коллстек вызовов ни автор не несут при старте системы: ответственности хорошо видна за любой возможный инициализация вред, причиненный PatchGuard материалами данной статьи. в реестре без перехвата в SSDT таких функций, как ZwCreateKey/ Вместе с тем надо признать — обход PatchGuard в виде под- ZwEnumerateKey. мены PDE/PTE-адресов есть малоисследованная область kernel- Таким же, например, образом, была разрешена проблема фай- кодинга, которая незаслуженно забыта разработчиками малвари. ловых фильтров, когда для контроля за файловой системой были Впрочем, может, сами разработчики поизмельчали? ;) введены в эксплуатацию мини-фильтры, для чего был реализован Другой широко распространенный в узких кругах способ рас- целый выводок Flt*-функций. Таким образом, Microsoft достигала пила PatchGuard — это перехват функций таймерного механизма, вроде бы своей цели... Но не тут-то было. регулирующих периодический запуск PatchGuard. И действи- Согласись, что здравый смысл в происходящем есть. тельно, для периодической проверки PatchGuard использует Но как оказалось на практике, не так-то просто уместить все за- стандартную kernel-API nt!KeInitializeDpc. После инициализации дачи для обеспечения безопасности ОС в рамки одних коллбэков. DPC следует вызов таймера nt!KeSetTimer, который ставит пла- Обеспечение полноценной безопасности системы — настоль- нируемую DPC в очередь. Суть обхода PatchGuard в этом случае ко трудоемкая и труднореализуемая задача, что предлагаемый в том, что нужно перечислить имеющиеся таймеры, найти нужный Microsoft инструментарий оказался явно недостаточен. А уж нам и отменить его. Несмотря на кажущуюся легкость, сделать что говорить о плохих парнях, которым Microsoft с введением это проблематично: чтобы найти необходимый таймер, нужно PatchGuard хоть и сильно осложнила жизнь, но отнюдь не отбила знать, что искать. желание заниматься своей грязной работенкой? Другой распространенный способ, наверное, не так очевиден на первый взгляд, но вполне имеет право на существование. «ОГЛАСИТЕ ВЕСЬ СПИСОК, ПОЖАЛУЙСТА...» Это — перехват функции nt!KeBugCheckEx. Если уж совсем при- Первое и самое популярное решение для обхода PatchGuard, ко- митивно — то при попытке
Load more

Recommended publications
  • Hypervisor-Based Active Data Protection for Integrity And
    The 13th Annual ADFSL Conference on Digital Forensics, Security and Law, 2018 HYPERVISOR-BASED ACTIVE DATA PROTECTION FOR INTEGRITY AND CONFIDENTIALITY OF DYNAMICALLY ALLOCATED MEMORY IN WINDOWS KERNEL Igor Korkin, PhD Security Researcher Moscow, Russia [email protected] ABSTRACT One of the main issues in the OS security is providing trusted code execution in an untrusted environment. During executing, kernel-mode drivers dynamically allocate memory to store and process their data: Windows core kernel structures, users’ private information, and sensitive data of third-party drivers. All this data can be tampered with by kernel-mode malware. Attacks on Windows-based computers can cause not just hiding a malware driver, process privilege escalation, and stealing private data but also failures of industrial CNC machines. Windows built-in security and existing approaches do not provide the integrity and confidentiality of the allocated memory of third-party drivers. The proposed hypervisor-based system (AllMemPro) protects allocated data from being modified or stolen. AllMemPro prevents access to even 1 byte of allocated data, adapts for newly allocated memory in real time, and protects the driver without its source code. AllMemPro works well on newest Windows 10 1709 x64. Keywords: hypervisor-based protection, Windows kernel, Intel, CNC security, rootkits, dynamic data protection. 1. INTRODUCTION The vulnerable VirtualBox driver (VBoxDrv.sys) Currently, protection of data in computer memory has been exploited by Turla rootkit and allows to is becoming essential. Growing integration of write arbitrary values to any kernel memory (Singh, ubiquitous Windows-based computers into 2015; Kirda, 2015). industrial automation makes this security issue critically important.
    [Show full text]
  • Kernel Integrity Analysis
    Project CS2 AAVR Kernel Integrity Analysis Major Qualifying Project Submitted to the Faculty of Worcester Polytechnic Institute in partial fulfillment of the requirements for the Degree in Bachelor of Science in Computer Science By Caleb Stepanian [email protected] Submitted On: October 27, 2015 Project Advisor: Professor Craig Shue [email protected] This report represents work of WPI undergraduate students submitted to the faculty as evidence of a degree requirement. WPI routinely publishes these reports on its web site without editorial or peer review. For more information about the projects program at WPI, see http: // www. wpi. edu/ Academics/ Projects . Abstract Rootkits are dangerous and hard to detect. A rootkit is malware specifically de- signed to be stealthy and maintain control of a computer without alerting users or administrators. Existing detection mechanisms are insufficient to reliably detect rootkits, due to fundamental problems with the way they do detection. To gain control of an operating system kernel, a rootkit edits certain parts of the kernel data structures to route execution to its code or to hide files that it has placed on the file system. Each of the existing detector tools only monitors a subset of those data structures. This MQP has two major contributions. The first contribution is a Red Team analysis of WinKIM, a rootkit detection tool. The analysis shows my attempts to find flaws in WinKIM's ability to detect rootkits. WinKIM monitors a particular set of Windows data structures; I attempt to show that this set is insufficient to detect all possible rootkits. The second is the enumeration of data structures in the Windows kernel which can possibly be targeted by a rootkit.
    [Show full text]
  • Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms
    Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms Ralf Hund Thorsten Holz Felix C. Freiling Laboratory for Dependable Distributed Systems University of Mannheim, Germany [email protected], fholz,[email protected] Abstract In recent years, several mechanism to protect the in- tegrity of the kernel were introduced [6, 9, 15, 19, 22], Protecting the kernel of an operating system against at- as we now explain. The main idea behind all of these tacks, especially injection of malicious code, is an impor- approaches is that the memory of the kernel should be tant factor for implementing secure operating systems. protected against unauthorized injection of code, such as Several kernel integrity protection mechanism were pro- rootkits. Note that we focus in this work on kernel in- posed recently that all have a particular shortcoming: tegrity protection mechanisms and not on control-flow They cannot protect against attacks in which the attacker integrity [1, 7, 14, 18] or data-flow integrity [5] mech- re-uses existing code within the kernel to perform mali- anisms, which are orthogonal to the techniques we de- cious computations. In this paper, we present the design scribe in the following. and implementation of a system that fully automates the process of constructing instruction sequences that can be 1.1 Kernel Integrity Protection Mecha- used by an attacker for malicious computations. We eval- uate the system on different commodity operating sys- nisms tems and show the portability and universality of our Kernel Module Signing. Kernel module signing is a approach. Finally, we describe the implementation of a simple approach to achieve kernel code integrity.
    [Show full text]
  • Integrity Checking of Function Pointers in Kernel Pools Via Virtual Machine Introspection
    Integrity Checking of Function Pointers in Kernel Pools via Virtual Machine Introspection Irfan Ahmed, Golden G. Richard III, Aleksandar Zoranic, Vassil Roussev Department of Computer Science, University of New Orleans Lakefront Campus, New Orleans, LA 70148, United States [email protected], [email protected], [email protected], [email protected] Abstract. With the introduction of kernel integrity checking mecha- nisms in modern operating systems, such as PatchGuard on Windows OS, malware developers can no longer easily install stealthy hooks in kernel code and well-known data structures. Instead, they must target other areas of the kernel, such as the heap, which stores a large number of function pointers that are potentially prone to malicious exploits. These areas of kernel memory are currently not monitored by kernel integrity checkers. We present a novel approach to monitoring the integrity of Windows ker- nel pools, based entirely on virtual machine introspection, called Hook- Locator. Unlike prior efforts to maintain kernel integrity, our implemen- tation runs entirely outside the monitored system, which makes it inher- ently more difficult to detect and subvert. Our system also scales easily to protect multiple virtualized targets. Unlike other kernel integrity check- ing mechanisms, HookLocator does not require the source code of the operating system, complex reverse engineering efforts, or the debugging map files. Our empirical analysis of kernel heap behavior shows that in- tegrity monitoring needs to focus only on a small fraction of it to be effective; this allows our prototype to provide effective real-time moni- toring of the protected system. Keywords: virtual machine introspection; malware; operating systems.
    [Show full text]
  • Microsoft Security Intelligence Report
    Microsoft Security Intelligence Report Volume 11 An in-depth perspective on software vulnerabilities and exploits, malicious code threats, and potentially unwanted software in the first half of 2011 Microsoft Security Intelligence Report This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. This document is provided “as-is.” Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. Copyright © 2011 Microsoft Corporation. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. ii Authors Joe Faulhaber John Lambert Dave Probert Hemanth Srinivasan Microsoft Malware Protection Microsoft Security Microsoft Security Microsoft Malware Protection Center Engineering Center Engineering Center Center David Felstead Marc Lauricella Tim Rains Holly Stewart Bing Microsoft Trustworthy Microsoft Trustworthy Microsoft Malware Protection Computing Computing Center Paul Henry Wadeware LLC Aaron Margosis Mark E. Russinovich Matt Thomlinson Microsoft Public Sector Microsoft Technical Fellow Microsoft Security Response Jeff Jones Services Center Microsoft Trustworthy Weijuan Shi Computing Michelle Meyer Windows Business Group Jeff Williams Microsoft Trustworthy Microsoft Malware Protection Ellen Cram Kowalczyk Computing Adam Shostack Center Microsoft Trustworthy Microsoft Trustworthy
    [Show full text]
  • Microsoft Windows Common Criteria Evaluation Security Target
    Microsoft Common Criteria Security Target Microsoft Windows Common Criteria Evaluation Microsoft Windows 10 (Creators Update) Security Target Document Information Version Number 0.06 Updated On June 14, 2018 Microsoft © 2017 Page 1 of 102 Microsoft Common Criteria Security Target This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein. The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious.
    [Show full text]
  • POSTER: Hooklocator: Function Pointer Integrity Check- Ing in Kernel Pools Via Virtual Machine Introspection
    POSTER: HookLocator: Function Pointer Integrity Check- ing in Kernel Pools via Virtual Machine Introspection Irfan Ahmed, Aleksandar Zoranic Computer Science Department University of New Orleans, LA USA iahmed, [email protected] ABSTRACT simply modifying function pointers corresponding to a keyboard With the introduction of kernel integrity checking mechanisms in driver in a kernel pool. Moreover, there are thousands of func- modern operating systems, such as PatchGuard on Windows tion pointers in the Windows kernel pools, which provides an OS, malware developers can no longer easily install stealthy attractive opportunity for an attacker to install stealthy hooks hooks in kernel code and well-known data structures. Instead, [2]. they must target other areas of the kernel, such as the heap, Current solutions such as SBCFI [3], Gibraltar [4], SFPD [5], which stores a large number of function pointers that are poten- and HookSafe [6] check the integrity of function pointers by tially prone to malicious exploits. These areas of kernel memory generating hook detection policy and extracting information are currently not monitored by kernel integrity checkers. about function pointers by performing static analysis of the ker- nel source code. Unfortunately, these solutions are dependent on Our novel approach to monitoring the integrity of Windows the availability of kernel source code and thus not appropriate kernel pools called HookLocator is based entirely on virtual for closed source OS’s such as MS Windows. machine introspection and is the only system of its kind to allow both 32 and 64-bit versions of the Windows kernel to be moni- More recently, Yin et al.
    [Show full text]
  • Windows SMEP Bypass U=S
    Windows SMEP Bypass U=S Nicolas A. Economou Enrique E. Nissim PAGE Schedule - Reviewing Modern Kernel Protections - Introducing SMEP - Windows SMEP bypass techniques – Part 1 - Windows Paging Mechanism - Windows SMEP bypass techniques – Part 2 - DEMO - Conclusions PAGE 2 Reviewing Modern Protections - DEP/NX: is a security feature included in modern operating systems. It marks areas of memory as either "executable" or "nonexecutable". - NonPagedPoolNX: new type of pool introduced in Windows 8 - KASLR: Address-space layout randomization (ASLR) is a well- known technique to make exploits harder by placing various objects at random, rather than fixed, memory addresses. - NULL Dereference Protection: cannot alloc the null page. PAGE 3 Reviewing Modern Protections - Integrity Levels: call restrictions for applications running in low integrity level – since Windows 8.1. - KMCS: Kernel-mode software must be digitally signed to be loaded on x64-based versions of Windows Vista and later versions of the Windows family of operating systems. - KPP: Kernel Patch Protection (informally known as PatchGuard): is a feature of x64 editions of Windows that prevents patching common structures of the kernel.(Hooking IDT, SSDT, GDT, LDT is out of the table). PAGE 4 Reviewing Modern Protections - SMAP: allows pages to be protected from supervisor-mode data accesses. If SMAP = 1, software operating in supervisor mode cannot access data at linear addresses that are accessible in user mode. - SMEP: Supervisor Mode Execution Prevention allows pages to be protected
    [Show full text]
  • Rootkit Detection from Outside the Matrix
    J Comput Virol (2007) 3:113–123 DOI 10.1007/s11416-007-0045-1 EICAR 2007 BEST ACADEMIC PAPERS Rootkit detection from outside the Matrix Sébastien Josse Received: 12 January 2007 / Revised: 3 March 2007 / Accepted: 17 March 2007 / Published online: 15 May 2007 © Springer-Verlag France 2007 Abstract The main purpose of this article is to present a the presence of the virus. As far as stealth virus detection secure engine which is specifically designed for a security is concerned, they prove that the general problem of stealth analyst when studying rootkits and all kinds of programs virus detection is 3 complete. Therefore, we can see that which interact at a deep level with the operating system, the underlying complexity problem is too high to expect to including Anti-Virus, Personal Firewall and HIPS programs. find a generic algorithm that matches this type of Malware. State-of-the-Art algorithms for rootkit detection are pre- A rootkit can be defined as a program which implements sented in this paper. Forensic techniques to monitor the sys- a set of stealth techniques [7]. Therefore, we can understand tem’s critical components and advanced heuristics are also a rootkit as a technology. A rootkit is also commonly associ- used. This survey is based on a proof-of-concept human ated with a specific class of program, kernel modules, which analysis framework which puts forward a reliable system execute at the most privileged security level of the CPU. for automatically gaining information about a rootkit and There are many locations where a program can install it- its interaction with the OS executive, but focuses on human self and hide within a standard operating system like Win- decision as a detection process without the same limitations dows NT, Mac OS or Linux.
    [Show full text]
  • Understanding and Defeating Windows 8.1 Kernel Patch Protection
    Understanding and Defeating Windows 8.1 Kernel Patch Protection: It’s all about gong fu! (part 2) Andrea Allievi Talos Security Research and Intelligence Group - Cisco Systems Inc. [email protected] November 20th, 2014 - NoSuchCon Who am I • Security researcher, focused on Malware Research • Work for Cisco Systems in the TALOS Security Research and Intelligence Group • Microsoft OSs Internals enthusiast / Kernel system level developer • Previously worked for PrevX, Webroot and Saferbytes • Original designer of the first UEFI Bootkit in 2012, and other research projects/analysis © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 Agenda 0. Some definitions 1. Introduction to Patchguard and Driver Signing Enforcement 2. Kernel Patch Protection Implementation 3. Attacking Patchguard 4. Demo time 5. Going ahead in Patchguard Exploitation © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Introduction © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Definitions • Patchguard or Kernel Patch Protection is a Microsoft technology developed to prevent any kind of modification to the Windows Kernel • Driver Signing Enforcement, aka DSE, prevents any non-digitally signed code from being loaded and executed in the Windows Kernel • A Deferred Procedure Call, aka DPC, is an operating system mechanism which allows high-priority tasks to defer required but lower-priority tasks for later execution • An Asynchronous Procedure Call, aka APC, is a function that executes asynchronously in the context of a particular thread. © 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 My work • Snake campaign – Uroburos rootkit: an advanced rootkit capable of infecting several version of Windows, including Windows 7 64 bit • Rootkit not able to infect Windows 8 / 8.1 because of security mitigations, enhanced DSE and Patchguard implementation • Reversed the entire rootkit; this made me wonder how to to defeat DSE and Patchguard in Windows 8.1.
    [Show full text]
  • Contents [Edit] Total Cost of Ownership
    Comparisons between the Microsoft Windows and Linux computer operating systems are a long-running discussion topic within the personal computer industry.[citation needed] Throughout the entire period of the Windows 9x systems through the introduction of Windows 7, Windows has retained an extremely large retail sales majority among operating systems for personal desktop use, while Linux has sustained its status as the most prominent Free Software and Open Source operating system. Both operating systems are present on servers, embedded systems, mobile internet devices as well as supercomputers. Linux and Microsoft Windows differ in philosophy, cost, versatility and stability, with each seeking to improve in their perceived weaker areas. Comparisons of the two operating systems tend to reflect their origins, historic user bases and distribution models. Typical perceived weaknesses regularly cited have often included poor consumer familiarity with Linux, and Microsoft Windows' susceptibility to viruses and malware.[1][2] Contents [hide] 1 Total cost of ownership o 1.1 Real world experience 2 Market share 3 User interface 4 Installation and Live environments 5 Accessibility and usability 6 Stability 7 Performance 8 Support 9 Platform for third party applications o 9.1 Gaming 10 Software development 11 Security o 11.1 Threats and vulnerabilities o 11.2 Security features and architecture 12 Localization 13 See also 14 References 15 External links [edit] Total cost of ownership See also: Studies related to Microsoft In 2004, Microsoft
    [Show full text]
  • Security and Safety Features New to Windows Vista - Wikipedia, the Free Encyclopedia
    Security and safety features new to Windows Vista - Wikipedia, the free encyclopedia Security and safety features new to Windows Vista From Wikipedia, the free encyclopedia There are a number of security and safety features new to Windows Vista, most of which are not available in This article is part any prior Microsoft Windows operating system release. of a series on Beginning in early 2002 with Microsoft's announcement of their Trustworthy Computing initiative, a great deal of Windows Vista work has gone into making Windows Vista a more secure operating system than its predecessors. Internally, Microsoft adopted a "Security Development Lifecycle"[1] with the underlying ethos of, "Secure by design, secure New features by default, secure in deployment". New code for Windows Vista was developed with the SDL methodology, and Overview all existing code was reviewed and refactored to improve security. Technical and core system Security and safety Some specific areas where Windows Vista introduces new security and safety mechanisms include User Account Networking technologies Control, parental controls, Network Access Protection, a built-in anti-malware tool, and new digital content I/O technologies protection mechanisms. Management and administration Removed features Other articles Editions Contents Development history Criticism 1 User Account Control Mojave Experiment 2 Bitlocker Drive Encryption 3 Windows Firewall 4 Windows Defender 5 Windows Parental controls 6 Encrypting File System 7 Preventing exploits 8 Data Execution Prevention 9 Digital Rights Management 10 Application isolation 11 Windows Service Hardening 12 Authentication and logon 13 Cryptography 14 Network Access Protection 15 Other TCP/IP stack security features 16 x86-64 -specific features 17 Other features and changes 18 See also 19 References 20 External links User Account Control User Account Control is a new infrastructure that requires user consent before allowing any action that requires administrative privileges.
    [Show full text]