44CON London 2015 - Windows 10: 2 Steps Forward, 1 Step Back

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Windows 10
2 Steps Forward,
1 Step Back
James Forshaw @tiraniddo
44con 2015
1

James Forshaw @tiraniddo
Obligatory Background Slide
2
● Researcher in Google’s Project Zero team
● Specialize in Windows
...

James Forshaw @tiraniddo
What I’m Going to Talk About
● Some research on Windows 10 from the early preview builds
● Why Wi...

James Forshaw @tiraniddo
Windows 10
4

James Forshaw @tiraniddo
Windows Local Attack Surface
5

James Forshaw @tiraniddo
Local System Vulnerabilities are Dead!
6
#opfreecalc

James Forshaw @tiraniddo
System Services and Drivers
7
Windows 7 SP1 Windows 8.1 Windows 10
Services 150 169 196
Drivers 2...

James Forshaw @tiraniddo
Service Privilege Levels
8
Windows 7 SP1 Windows 8.1 Windows 10
Local System 53.69% 56.89% 61.14%...

James Forshaw @tiraniddo
SVCHOST Running as User?
9
Malware?
Nope!

James Forshaw @tiraniddo
Service Start Mode
10
Windows 7 Windows 8.1 Windows 10
Auto 30.07% 26.19% 24.10%
Disabled 5.23% 3...

James Forshaw @tiraniddo
Accessible Device Objects
11
7 8 10
Windows 7 Windows 8.1 Windows 10
Read/Write 64 54 52
Read-Onl...

James Forshaw @tiraniddo
Isolated User Mode
12

James Forshaw @tiraniddo
Isolated LSASS
13
Image from http://deploymentresearch.com/Research/Post/490/Enabling-Virtual-Sec...

James Forshaw @tiraniddo
But Sadly
● Not available in consumer builds only Enterprise
● Can’t use your own code to isolate...

James Forshaw @tiraniddo
Edge Browser
15

James Forshaw @tiraniddo
Microsoft Edge Security
16
ActiveX is
gone(ish)
AppContainer Sandbox Always On

James Forshaw @tiraniddo
Microsoft Edge and Flash
17
Nope!

James Forshaw @tiraniddo
Has No One Learnt from the Past?
18

James Forshaw @tiraniddo
Guess Trident Wasn’t a Suitable Base?
19

James Forshaw @tiraniddo
User Account Control
20

James Forshaw @tiraniddo
They’ve Fixed Some Bugs I’ve Reported
21
https://code.google.com/p/google-security-research/issue...

James Forshaw @tiraniddo
UAC Auto Elevation Directory Check
22
c:windows c:windowstracingapp.exe app.exe
ALLOWED BANNED

James Forshaw @tiraniddo
Folder Permissions
23
c:windows c:windowstracingapp.exe app.exe
ALLOWED BANNED

James Forshaw @tiraniddo
AiCheckSecureApplicationDirectory Bypass
24
● Need to be able to write a file with a secure path
...

James Forshaw @tiraniddo
NTFS Alternate Data Streams FTW!
25
c:windows tracing:malicious.exe
ALLOWED
● Only need FILE_WRIT...

James Forshaw @tiraniddo
Didn’t Fix All my UAC Bypasses Though
26
https://code.google.com/p/google-security-research/issue...

James Forshaw @tiraniddo
DEMO
Elevated Token Capture
27

James Forshaw @tiraniddo 28
Well MS Almost Did
If Token Level
< Impersonate
If Process has
Impersonate
Privilege
ALLOWED
R...

James Forshaw @tiraniddo
Elevated Token Impersonation
● Blocks impersonating an elevated token unless process token is
als...

James Forshaw @tiraniddo
In The End Still the “Wrong” Default IMO!
30

James Forshaw @tiraniddo
If You Change Task Manager Needs a Prompt
31

James Forshaw @tiraniddo
Windows Symbolic Links
32
Windows NT 3.1 - July 27 1993
Object Manager Symbolic Links
Registry Ke...

James Forshaw @tiraniddo
Mitigated in Sandboxes
33
NTFS Mount Points
Registry Key Symbolic
Links
Object Manager
Symbolic L...

James Forshaw @tiraniddo
Mitigations Backported
34

James Forshaw @tiraniddo
DEMO
NTFS Mount Point Mitigation Bypass
35

James Forshaw @tiraniddo
Win32k Hardening
36

James Forshaw @tiraniddo
Fonts Are Bad
37

James Forshaw @tiraniddo
Making it Less Bad
User Mode Font Driver
38
Disable Custom Font Policy
(undocumented)
PROCESS_MIT...

James Forshaw @tiraniddo
User Mode Font Driver
Only SYSTEM can open process?Running as user in AppContainer
39

James Forshaw @tiraniddo
Process Token Default DACL
After September Patch
40
Before September Patch

James Forshaw @tiraniddo
Thread DACLs Allow User Access
41

James Forshaw @tiraniddo
Extra, UMFD Only Win32k Escape Calls
42
NtGdiEscape Command UMFD Escape Call
13 UmfdEscEngGetFile...

James Forshaw @tiraniddo
UmfdEscEngCreateFile in Win32kFull.sys
// Name is only SystemRootSystem32FAC.ATM
HANDLE EngCreate...

James Forshaw @tiraniddo
UmfdEscEngCreateFile in Win32kFull.sys
// Name is only SystemRootSystem32FAC.ATM
HANDLE EngCreate...

James Forshaw @tiraniddo
Process Silos
● New process container mechanism
● Possibly related to docker support
● Works in a...

James Forshaw @tiraniddo
Opening Device Object
46
DeviceHarddisk1SomeName
DeviceHarddisk1 SomeName
Device Path
Native NT P...

James Forshaw @tiraniddo
Replace the Root Object Directory
47
// Create anonymous directory object
InitializeObjectAttribu...

James Forshaw @tiraniddo
Fixed in RTM
● Silo functionality rolled into Job objects
● Changed object directory now behind a...

James Forshaw @tiraniddo
Public Service Announcement
Doing too much security
research on Beta software
can make you sad
49

James Forshaw @tiraniddo
(Dis)Honourable Mentions
Control Flow Guard (CFG)
Privacy Options
Cumulative Updates
Microsoft Cr...

James Forshaw @tiraniddo
Conclusions
51
2 steps forward, 1 step back. Still plenty of things to attack!

James Forshaw @tiraniddo
DEMO
Local System Elevation
52

James Forshaw @tiraniddo
Good Old Issue 222
53
https://code.google.com/p/google-security-research/issues/detail?id=222

James Forshaw @tiraniddo
Questions?
54

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

1 of 54 Ad

1 of 54 Ad