Under the hood of modern HIPS-es and Windows access control mechanisms

8,517 views

Published on

The slides of our talk at 17-th Defcon Russia Group meeting.

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
8,517
On SlideShare
0
From Embeds
0
Number of Embeds
6,510
Actions
Shares
0
Downloads
10
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Under the hood of modern HIPS-es and Windows access control mechanisms

  1. 1. Under the hood of modern HIPS-es and Windows access control mechanisms 02/11/2014 Defcon Russia (DCG #7812)
  2. 2. Who we are /* Vasily Bukasov – Security researcher, ReCrypt LLC CTO and co-founder Dmitry Schelkunov – PhD, Security researcher, ReCrypt LLC CEO and co-founder */ Defcon Russia (DCG #7812) 2
  3. 3. Agenda /* • HIPS – Host-Based Intrusion Prevention System • HIPS implementation approaches for Windows: – Virtualization – Hooks-based (old school) – Based on Windows access control mechanisms (new trend) – Mix of the previous two (pizza ) */ Defcon Russia (DCG #7812) 3
  4. 4. Part I. Introduction to the Windows access control mechanisms Defcon Russia (DCG #7812) 4
  5. 5. Security identifier /* • SID (security identifier) is an unique identifier within a single machine, which identifies a subject • Logon SID is a SID which is created by Winlogon for each interactive logon session (S-15-5-0-xxxxx) */ Defcon Russia (DCG #7812) 5
  6. 6. Integrity Level /* • Untrusted – 0x0000 • Low – 0x1000 • Medium – 0x2000 • High – 0x3000 • System – 0x4000 */ Defcon Russia (DCG #7812) 6
  7. 7. Access token /* • Identifies the security context of a process or thread • Contents or references to information: session ID, integrity level, account, groups, privileges associated with the process or thread, etc */ Defcon Russia (DCG #7812) 7
  8. 8. Access token /* • Restricted token – Some privileges can be removed – SIDs in the token can be marked as deny-only – SIDs in the token can be marked as restricted •Filtered admin token (Restricted token variation) – Integrity level is set to medium – Administrator-like SIDs are marked as deny-only – Most of privileges are stripped – Is used by UAC */ Defcon Russia (DCG #7812) 8
  9. 9. Security descriptor /* • Security information associated with an object, which specifies who can perform what actions on the object • Includes two access control lists (ACLs): discretionary (DACL) and system (SACL) */ Defcon Russia (DCG #7812) 9
  10. 10. Access checks /* • Mandatory access control (uses integrity levels) • Discretionary access control (uses DACL-es) */ Defcon Russia (DCG #7812) 10
  11. 11. Mandatory policies /* • No-Write-Up (on all objects) – used to restrict write access coming from a lower integrity level process to the object • No-Read-Up (on process objects) – used to restrict read access coming from a lower integrity level process to the object • No-Execute-Up (on binaries implementing COM classes) – used to restrict execute access coming from a lower integrity level process to the object */ Defcon Russia (DCG #7812) 11
  12. 12. Mandatory access control /* With the default integrity policies, processes can open any object—with the exception of process, thread and token objects—for read access as long as the object’s DACL grants them read access */ Defcon Russia (DCG #7812) 12
  13. 13. Discretionary access control /* • For each object there is a list of entries. Each entry specifies access rights allowed or denied for a subject • Order of the entries does matter */ Defcon Russia (DCG #7812) 13
  14. 14. Impersonation /* • Roughly, impersonation is a mechanism which provides a possibility to execute a code with a security context of a target process • Two interesting impersonation properties – Integrity level of the current thread must be more or equal to the target process's one – A target process’s token must be read-accessible from the current thread */ Defcon Russia (DCG #7812) 14
  15. 15. Part II. Existing sandboxing techniques Defcon Russia (DCG #7812) 15
  16. 16. HIPS implementation approaches /* • Virtualization • Hooks-based (old school) • Based on Windows access control mechanisms (new trend) • Mix of the previous two (pizza ) */ Defcon Russia (DCG #7812) 16
  17. 17. Windows access control mechanisms /* • Restricted token – Disabled SIDs – Restricted SIDs – Integrity level • Another user • Job restrictions • Separate desktop */ Defcon Russia (DCG #7812) 17
  18. 18. AppContainer /* • Lowbox token • Low integrity level • Capabilities • Separate local NamedObjects directory */ Defcon Russia (DCG #7812) 18
  19. 19. Part III. Common pitfalls and vulnerabilities Defcon Russia (DCG #7812) 19
  20. 20. Logon SID and broken Run As /* If we use Run As to start a process under another user, it will be started with Logon SID of the current one */ Defcon Russia (DCG #7812) 20
  21. 21. Logon SID and broken Run As /* 1. Run Process Explorer 2. Run notepad.exe 3. Double click on notepad.exe in the Process Explorer window 4. Go to Security tab and click Permissions button */ Defcon Russia (DCG #7812) 21
  22. 22. Logon SID and broken Run As Defcon Russia (DCG #7812) 22
  23. 23. Logon SID and broken Run As /* • Process permissions for Logon SID are: Query limited information, Query information, Read memory, Terminate, Synchronize and Read permissions • Token permissions for Logon SID are: Assign as primary token, Duplicate, Impersonate, Query, Query source, and Read permissions • Thread permissions for Logon SID are: Query limited information, Query information, Get context, Synchronize and Read permissions */ Defcon Russia (DCG #7812) 23
  24. 24. Logon SID and broken Run As /* So, if a process was started under another user using Run As, then a thread of this process in most of cases can: • get another user’s process token (target process) • impersonate target’s security context • get all access rights of the target process */ Defcon Russia (DCG #7812) 24
  25. 25. Crossroads or how to make Run As secure /* 1. CreateProcessWithLogonW. We can’t modify default user token. Insecure 2. CreateProcessAsUser. Creates a process with the same Logon SID. Insecure 3. CreateProcessWithTokenW. That seems to be the only solution. But … creates a process in the current session only (MSDN lies ) */ Defcon Russia (DCG #7812) 25
  26. 26. Desktop is a security boundary /* • A lot of applications work incorrectly if DESKTOP_HOOKCONTROL access right is not set because runtime libraries use windows hooks quite often • If DESKTOP_HOOKCONTROL access right is set, then an application even if it was started under another user can set window hooks on the other application's windows and possibly execute arbitrary code in the context of other application */ Defcon Russia (DCG #7812) 26
  27. 27. Up to XP /* * Is the app hooking another user without access? * If so return an error. Note that this check is done * for global hooks every time the hook is called. */ if ((!RtlEqualLuid(&ptiThread->ppi->luidSession, &ptiCurrent->ppi->luidSession)) && !(ptiThread->TIF_flags & TIF_ALLOWOTHERACCOUNTHOOK)) { RIPERR0(ERROR_ACCESS_DENIED, RIP_WARNING, "Access denied to other user in zzzSetWindowsHookEx"); return NULL; } Defcon Russia (DCG #7812) 27
  28. 28. Vista and above Defcon Russia (DCG #7812) 28
  29. 29. Other pitfalls /* • protection from neighbours • screenshots • keylogging • network access • clipboard access • webcam access • microphone access */ Defcon Russia (DCG #7812) 29
  30. 30. Part IV. Escape from sandbox Defcon Russia (DCG #7812) 30
  31. 31. Competition of HIPS-es /* • This research was done some time ago • 8 participants • 1 recent but public injection technique */ Defcon Russia (DCG #7812) 31
  32. 32. Competition of HIPS-es /* • 3 participants resisted well – The first one is x86 version only (hooks-based) – The second one (hooks-based) is discontinued – The third one was quite raw */ Defcon Russia (DCG #7812) 32
  33. 33. Competition of HIPS-es /* • 2 resisted in the default configuration (but gave up after ring3 unhooking ) • 1 just virtualizes hard drive and doesn’t prevent drivers loading. But it’s marketed as antimalware product • 1 started a process with an admin token instead of filtered admin token (it seems like these guys have their own understanding of security ) */ Defcon Russia (DCG #7812) 33
  34. 34. References /* Microsoft.Press.Windows.Internals.Part.1.6th.Edition http://vallejo.cc/48 http://dev.chromium.org/developers/design-documents/sandbox http://news.saferbytes.it/analisi/2013/07/securing-microsoft-windows-8-appcontainers/ https://ssl.exelab.ru/f/index.php?action=vthread&forum=1&topic=18837&page=0 http://www.osronline.com/showthread.cfm?link=232226 http://rsdn.ru/forum/winapi/3865326.flat https://bromiumlabs.files.wordpress.com/2013/07/application_sandboxes_a_pen_tester_s_perspective2.pdf */ Defcon Russia (DCG #7812) 34
  35. 35. Contacts /* fixer@re-crypt.com Vasily Bukasov schelkunov@re-crypt.com Dmitry Schelkunov */ Defcon Russia (DCG #7812) 35

×