Subverting Windows 2003 SP1 Kernel Integrity Prote.pptVIP

Subverting Windows 2003 SP1 Kernel Integrity Protection RECON 2006 - Alex Ionescu alexi@ Roadmap Introduction NT Basics Design Objects Security Deprecated Methods New Methods Typical (usually legitimate) Atypical/specialized (usually illegitimate – rootkits) Subverting the protection Getting access to Ring 0 memory What to do with it – “payload” Protecting against the exploit Introduction Simply put, Ring 0 access from Ring 3. Previous methods don’t work anymore. So = uses a newly discovered bug in the Windows NT kernel, but actual bug has been there since NT 4 or earlier. Requires administrator access, not a security flaw. Introduction Goals: Notifying attendees about loss of functionality in Windows 2003 SP1 Developers: Use newly created APIs and debugger services. Security researchers: Ability to know which rootkits/malware will stop working. Presenting the new exploit Developers: Specialized needs might not be fulfilled by the new APIs. Security researchers: Watch out for malware using this method and block it. Introduction Usage: Accessing physical memory for direct hardware access, firmware updates, BIOS/Video RAM analysis. Read/write system variables (kernel) from user-mode: provide system information applications. Running code at ring 0 access. Introduction “But you can load a driver!” User-mode malware that’s actually doing kernel-mode operations is much more insidious and hard to defend against: no actual driver is in the system. Loading a driver is usually detected and blocked by most IDS software. Can’t load a driver on 64-bit Vista: driver signing. It’s a lot harder to write driver code then user mode code. CPU Basics X86 supports 4 ring levels, also called CPL (Code Privilege Level) or RPL (Ring Privilege Level): Ring 0, 1, 2, 3. 3 is least privileged, 0-2 are most privileged. 3 blocks some operands which could crash the system or damage hardware. This is what most OSes implement as ‘user mode’. 0-2 have mostly the same execution-level access, but mem