Divide et Impera: MemoryRanger Runs Drivers in Isolated Kernel Spaces

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

DIVIDE ET IMPERA:
MEMORY RANGER RUNS DRIVERS IN
ISOLATED KERNEL SPACES
Igor Korkin, Ph.D

WHOAMI
 MEPhI Alumni, PhD in Cyber Security, published 23 papers
 Area of interest is Windows Kernel security:
 Memory ...

AGENDA
 Attacking the kernel-mode memory
 Existing protection:Windows built-in security and research projects
 MemoryRa...

ATTACKS ON KERNEL MODE MEMORY
allocate
read / write
Windows
OS kernel
Kernel-mode
drivers
Allocated
Memory Data
Allocated
...

ATTACKS ON KERNEL MODE MEMORY
allocate
read / write
Malware
Windows
OS kernel
Kernel-mode
drivers
privilege escalation
rev...

TWO HOUSES WITH PRIVATE ART COLLECTIONS
Stars by
Wassily Kandinsky
Girl with Balloon
by Banksy
Hi all! I am a hacker-attac...

Allocator
OS Kernel
Structures
OS
Kernel
Code
Allocator cmd
Driver
Driver
Driver
Allocated
Data
Allocated
Data
Attacker
DE...

YouTube videos are no longer supported on SlideShare

View original on YouTube

DEMO: THE ATTACK
The online version is here –
https://www.youtube.com/embed/HNxc-tjy3QA?vq=hd1080

TWO HOUSES WITH PRIVATE ART COLLECTIONS
Stars by
Wassily Kandinsky
Girl with Balloon
by Banksy
Yo Ho Ho!
The both collecti...

THE ATTACK HAS NOT BEEN PREVENTED
Allocator
OS Kernel
Structures
OS
Kernel
Code
Allocator cmd
Driver
Driver
Driver
Allocat...

BACKGROUND ANALYSIS
Memory
protection
projects
Malware attacks on
Code of OS &
third-party drivers
OS data:
internal struc...

IDEA OF DRIVERS EXECUTION ISOLATION
Driver A
The same kernel
memory space
Data A
Driver B Data B
Now all drivers share
the...

IDEA OF DRIVERS EXECUTION ISOLATION
Driver A
The same kernel
memory space
Let s execute these two drivers into
separate me...

PROCESSING MEMORY ACCESS: EPT FEATURE
Host Physical Address H
Guest OS
Hypervisor
VT-x without EPT
= G
Guest Physical Addr...

PROCESSING MEMORY ACCESS: EPT FEATURE
Host Physical Address H
Guest OS
Hypervisor
EPT Paging structures
VT-x without EPT
=...

INSIDE EPT PAGING STRUCTURES. EPT PFN
Host Memory
Protected Page
EPT Paging structures
EPT Page Table Entries
Memory
Acces...

INSIDE EPT PAGING STRUCTURES. EPT PFN
Host Memory
Protected Page
EPT Paging structures
EPT Page Table Entries
Memory
Acces...

Host Memory
Page
INSIDE EPT PAGING STRUCTURES. EPT BITS
Hypervisor traps all
these access attempts
Memory Access Bits:
• e...

INSIDE EPT PAGING STRUCTURES
EPT structures #1 EPT structures #2 EPT structures #3
EPT Pointer
Other fields
VMCS for hyper...

APPLYING EPT FOR DRIVERS ISOLATION
Current Situation
OS Kernel
Code
exe=true
rw=true
OS Kernel
Structures
exe=true
rw=true...

APPLYING EPT FOR DRIVERS ISOLATION
Current Situation
OS Kernel
Code
exe=true
rw=true
Driver A
exe=true
rw=true
OS Kernel
S...

APPLYING EPT FOR DRIVERS ISOLATION
Current Situation
OS Kernel
Code
exe=true
rw=true
Driver A
exe=true
rw=true
OS Kernel
S...

APPLYING EPT FOR DRIVERS ISOLATION
Current Situation
OS Kernel
Code
exe=true
rw=true
Driver A
exe=true
rw=true
OS Kernel
S...

APPLYING EPT FOR DRIVERS ISOLATION
Current Situation
OS Kernel
Code
exe=true
rw=true
Driver A
exe=true
rw=true
OS Kernel
S...

That will
be a great
treasure!
Ha-ha!
Stars by
Wassily Kandinsky
Girl with Balloon
by Banksy
No.5 by
Jackson Pollock
THREE...

THREE HOUSES WITH PRIVATE ART COLLECTIONS
Stars by
Wassily Kandinsky
Oh no!
I can
steal
nothing!
Girl with Balloon
by Bank...

YouTube videos are no longer supported on SlideShare

View original on YouTube

Allocator
OS Kernel
Structures
OS
Kernel
Code
Allocator Allocator cmd
Driver
Driver
Driver
Driver
Allocated
Data
Allocated...

DEMO: THE ATTACK PREVENTION
The online version is here –
https://www.youtube.com/embed/vrm9cgn5DsU?vq=hd1080

DEMO: THE ATTACK PREVENTION
Allocator
OS Kernel
Structures
OS
Kernel
Code
MemoryRanger
Hypervisor
Allocator Allocator cmd
...

MEMORY RANGER: PRINCIPLE OF LEAST PRIVILEGE
Kernel-
mode
drivers
Drivers Code
✔
✔
✔
✔
OS kernel ✔ ✔ ✔ ✔

MEMORY RANGER: PRINCIPLE OF LEAST PRIVILEGE
Kernel-
mode
drivers
Drivers Code Allocated Memory Data
EPROCESS
structures
✔ ...

MEMORY RANGER: PRINCIPLE OF LEAST PRIVILEGE
Kernel-
mode
drivers
Drivers Code Allocated Memory Data
EPROCESS
structures
✔ ...

MemoryMonRWX* DdiMon* Memory Access Policy
EPT violations:
read, write, exec
Process is
created
Memory is
allocated
* by S...

MemoryMonRWX* DdiMon* Memory Access Policy
EPT violations:
read, write, exec
Process is
created
Memory is
allocated
* by S...

MemoryMonRWX* DdiMon* Memory Access Policy
EPT violations:
read, write, exec
Process is
created
Memory is
allocated
* by S...

MemoryMonRWX* DdiMon* Memory Access Policy
EPT violations:
read, write, exec
Process is
created
Memory is
allocated
* by S...

MemoryMonRWX* DdiMon* Memory Access Policy
EPT violations:
read, write, exec
Process is
created
Memory is
allocated
* by S...

$switch (exit_reason){ case (execute_violation): change_ept(); break; case (read_violation|| write_violation): if (access_l...$

$switch (exit_reason){ case (execute_violation): change_ept(); break; case (read_violation|| write_violation): if (access_l...$

$switch (exit_reason){ case (execute_violation): change_ept(); break; case (read_violation|| write_violation): if (access_l...$

$switch (exit_reason){ case (execute_violation): change_ept(); break; case (read_violation|| write_violation): if (access_l...$

1. Callback - creating a list of protected objects
 Add objects’ addresses & sizes to the list
 Restrict memory access f...

1. Callback - creating a list of protected objects
 Add objects’ addresses & sizes to the list
 Restrict memory access f...

Driver Allocated Memory
Reads/Writes
70±2
100.000±4.000
500.000±10.000
170.000±7.000
0
1
2
3
4
5
Enabled Cache Disabled Ca...

 Kernel-mode memory is out of control
 MemoryRanger isolates drivers execution by
using a specific EPT structure for eac...

Dīvide et Imperā*
from Latin divide and rule
* Cartledge, P. (2013). Sparta and Lakonia: A regional history 1300-362 BC. R...

Thank you!
Igor Korkin igor.korkin@gmail.com
All the details & my CV are here igorkorkin.blogspot.com