Protected Process Light will be Protected – MemoryRanger Fills the ...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Protected Process Light will be Protected ‐
MemoryRanger Fills the Gap Again
Igor Korkin
Independent Researcher
2021

WHOAMI
 PhD, speaker at the ADFSL, BlackHat, HITB, IEEE SPW
 OS Security Researcher:
 Rootkits, Anti-rootkits and EDRs
...

 Protected Process Light (PPL) — Algorithm and Attacks
3
AGENDA

4
Users secrets are stored in process memory
AGENDA

5
Protected Process Light
(enabled)
PPL is enabled for the process to protect its memory
AGENDA

6
Protected Process Light
(enabled)
Attackers are trying to steal the secrets, but PPL blocks their access
AGENDA

7
Protected Process Light
(enabled)
Attackers are trying to steal the secrets, but PPL blocks their access
• Access to the...

8
Protected Process Light
(enabled)
Protected Process Light
(disabled)
Attackers can disable PPL
AGENDA

9
Protected Process Light
(enabled)
Protected Process Light
(disabled)
User s secret
(stolen)
Attackers can steal users da...

Malware is not protected
Attackers want to protect their malware processes
AGENDA

But PPL is enabled only for processes with a special signature
Malware is not protected
AGENDA

Malware apps can illegally enable PPL to protect themselves
Malware is protected by PPL
Malware is not protected
AGENDA

Protected Process Light
(enabled)
Protected Process Light
(disabled)
User s secret
(stolen)
Malware is protected by PPL
Ma...

Protected Process Light
(enabled)
Protected Process Light
(disabled)
User s secret
(stolen)
Malware is protected by PPL
Ma...

Protected Process Light
(enabled)
Protected Process Light
(disabled)
User s secret
(stolen)
Malware is protected by PPL
Ma...

Protected Process Light
(enabled)
Protected Process Light
(disabled)
User s secret
(stolen)
Malware is protected by PPL
Ma...

17
Microsoft Windows OSes

18
Episode 1
Does Windows provide any feature
to Protect Process Memory?

19
1. Security Reference Monitor (SRM)
2. Protected Process Light (PPL)
3. AppContainer Isolation
4. Windows Resource Prot...

20
WINDOWS FEATURES TO PROTECT PROCESS MEMORY: SRM
1. Security Reference Monitor (SRM)
2. Protected Process Light (PPL)
3....

OpenProcess ( )
App with
sensitive data
A m alware app calls
OpenProcess()
21
A malware App calls OpenProcess() to Access ...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Access Token
Privilege
SRM pe...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Security
Descriptor
Access To...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Security
Descriptor
Access To...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Security
Descriptor
Access To...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Security
Descriptor
Access To...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
Security
Descriptor
Access To...

28
Episode 2
Protected Process Light?
What’s that?

1. Security Reference Monitor (SRM)
2. Protected Process Light (PPL)
3. AppContainer Isolation
4. Windows Resource Protect...

NT/ Process Manager
Security Reference
Monitor (SRM)
OpenProcess ( )
App with
sensitive data
30
PPL restricts non-PPL apps...

NT/ Process Manager
Security Reference
Monitor (SRM)
Protected Process Light (PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security Reference
Monitor (SRM)
Protected Process Light (PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security Reference
Monitor (SRM)
Protected Process Light (PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security Reference
Monitor (SRM)
Protected Process Light (PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security Reference
Monitor (SRM)
Protected Process Light (PPL)
OpenProcess ( )
App with
sensitive data...

36
Episode 3
How does PPL work?

PPL: a new Protection field in EPROCESS
App
User mode
Kernel mode
App
App
EPROCESS
37

App
User mode
Kernel mode
App
App
EPROCESS
Process ID
Process Name
Process Privilege
PPL: a new Protection field in EPR...

PS_PROTECTION
PS_PROTECTION
Protection
PS_PROTECTION
Protection
App
User mode
Kernel mode
App
App
EPROCESS
Process ID
Pr...

PS_PROTECTION
PS_PROTECTION
Protection
PS_PROTECTION
Protection
App
User mode
Kernel mode
App
App
EPROCESS
Process ID
Pr...

PS_PROTECTION
PS_PROTECTION
Protection
PS_PROTECTION
Protection
App
User mode
Kernel mode
App
App
EPROCESS
Process ID
Pr...

PS_PROTECTION
PS_PROTECTION
Protection
PS_PROTECTION
Protection
App
User mode
Kernel mode
App
App
EPROCESS
Process ID
Pr...

EXAMPLES OF PROTECTION LEVEL
43
NisSrv ‒ Microsoft Network Realtime Inspection Service.
LSASS ‒ Local Security Authority S...

EXAMPLES OF PROTECTION LEVEL
44
NisSrv ‒ Microsoft Network Realtime Inspection Service.
LSASS ‒ Local Security Authority S...

EXAMPLES OF PROTECTION LEVEL
45
NisSrv ‒ Microsoft Network Realtime Inspection Service.
LSASS ‒ Local Security Authority S...

46
Episode 4
How does Windows create
protected processes?

PPL: CreateProcess
“System” “MemCompression” “Registry”
“lsass.exe”
“NisSrv.exe”
“MsMpEng.exe”
“services.exe”
47

PPL: CreateProcess
48
Which OS functions are involved during
creating of Protected Processes?
? ? ? ?
“System” “MemCompres...

ntdll
nt
PPL: CreateProcess
CmpInitializeRegistryProcess
PspInitPhase0
NtCreateUserProcess
SmFirstTimeInit
49
“System” “Me...

ntdll
nt
PPL: CreateProcess
CmpInitializeRegistryProcess
PspInitPhase0
NtCreateUserProcess
PspAllocateProcess
PspCreatePro...

ntdll
nt
PPL: CreateProcess
CmpInitializeRegistryProcess
PspInitPhase0
NtCreateUserProcess
PspAllocateProcess
PspCreatePro...

PPL: PspAllocateProcess sets Protection.Level for the process
Protection = 0x0 Protection = 0x72
PspAllocateProcess:
mov r...

PPL: PspAllocateProcess sets Protection.Level for the process
PspAllocateProcess:
mov rdx, [nt!PsProcessType]
call nt!ObCr...

PPL: PspAllocateProcess sets Protection.Level for the process
PspAllocateProcess:
mov rdx, [nt!PsProcessType]
call nt!ObCr...

PPL: PspAllocateProcess sets Protection.Level for the process
PspAllocateProcess:
mov rdx, [nt!PsProcessType]
call nt!ObCr...

56
Episode 5
How to get access to the
protected process memory?

PPL: OpenProcess
Some App
57
OpenProcess
“lsass.exe”
“NisSrv.exe”
“MsMpEng.exe”

PPL: OpenProcess
Some App
58
OpenProcess
Which OS functions are involved in
openning of protected processes?
?
“lsass.exe”...

nt
ntdll
PPL: OpenProcess
Some App
59
handle = OpenProcess(pid)
NtOpenProcess
NtOpenProcess
ZwOpenProcess
“lsass.exe”
“Nis...

nt
ntdll
PPL: OpenProcess
Some App
60
handle = OpenProcess(pid)
RtlTestProtectedAccess
PspCheckForInvalidAccessByProtectio...

nt
ntdll
PPL: OpenProcess  RtlTestProtectedAccess
Some App
61
handle = OpenProcess(pid)
RtlTestProtectedAccess
PspCheckFo...

$bool RtlTestProtectedAccess(PS_PROTECTION CallerProt, PS_PROTECTION TargetProt) { if (TargetProt.Type == 0) return true; i...$

$bool RtlTestProtectedAccess(PS_PROTECTION CallerProt, PS_PROTECTION TargetProt) { if (TargetProt.Type == 0) return true; i...$

$bool RtlTestProtectedAccess(PS_PROTECTION CallerProt, PS_PROTECTION TargetProt) { if (TargetProt.Type == 0) return true; i...$

$bool RtlTestProtectedAccess(PS_PROTECTION CallerProt, PS_PROTECTION TargetProt) { if (TargetProt.Type == 0) return true; i...$

$bool RtlTestProtectedAccess(PS_PROTECTION CallerProt, PS_PROTECTION TargetProt) { if (TargetProt.Type == 0) return true; i...$

67
RtlProtectedAccess Array
Index Signer DominateMask
0 none 0
1 Authenticode 2
2 CodeGen 4
3 Antimalware 0x108
4 Lsa 0x11...

68
RtlProtectedAccess Array
Index Signer DominateMask Bit Explanation
0 none 0 n/ a
1 Authenticode 2 10
2 CodeGen 4 100
3 ...

Index Signer DominateMask Bit Explanation
0 none 0 n/ a
1 Authenticode 2 10
2 CodeGen 4 100
3 Antimalware 0x108 1 0000 100...

Index Signer DominateMask Bit Explanation
0 none 0 n/ a
1 Authenticode 2 10
2 CodeGen 4 100
3 Antimalware 0x108 1 0000 100...

Index Signer DominateMask Bit Explanation
0 none 0 n/ a
1 Authenticode 2 10
2 CodeGen 4 100
3 Antimalware 0x108 1 0000 100...

72
Episode 6
Two Windows security features
SRM and PPL are playing together
and losing

NT/ Process Manager
Security
Reference
Monitor
(SRM)
Protected
Process
Light
(PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security
Reference
Monitor
(SRM)
Protected
Process
Light
(PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security
Reference
Monitor
(SRM)
Protected
Process
Light
(PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security
Reference
Monitor
(SRM)
Protected
Process
Light
(PPL)
OpenProcess ( )
App with
sensitive data...

NT/ Process Manager
Security
Reference
Monitor
(SRM)
Protected
Process
Light
(PPL)
OpenProcess ( )
App with
sensitive data...

78
Episode 7
Attacks on PPL?

App with
sensitive data
PPL Process
Security Descriptor
Protection=0
EPROCESS
Protection=0x41
EPROCESS
Access Token
OpenPr...

App with
sensitive data
PPL Process
Security Descriptor
Protection=0
EPROCESS
Protection=0x41
EPROCESS
Access Token
Kernel...

App with
sensitive data
PPL Process
Security Descriptor
Protection=0
EPROCESS
Protection=0x41
EPROCESS
Access Token
Reset ...

App with
sensitive data
Non-PPL
Security Descriptor
Protection=0
EPROCESS
Protection=0
EPROCESS
Access Token
Reset value t...

PPL Process
Security Descriptor
Protection=0
EPROCESS
Protection=0x41
EPROCESS
Access Token
Set value to enable PPL
for th...

PPL Process
Security Descriptor
Protection=0x51
EPROCESS
Protection=0x41
EPROCESS
Access Token
Set value to enable PPL
for...

App with
sensitive data
Non-PPL
Security Descriptor
Protection=0x51
EPROCESS
Protection=0
EPROCESS
Access Token
Set value ...

LSASS
Windows
Defender
Malware
Non-PPL Process PPL Process
PPL Process
EPROCESS
Protection=0
EPROCESS
Protection=0x31
EPRO...

LSASS
Windows
Defender
Malware
Non-PPL Process PPL Process
PPL Process
EPROCESS
Protection=0
EPROCESS
Protection=0x31
EPRO...

LSASS
Windows
Defender
Malware
Non-PPL Process PPL Process
PPL Process
EPROCESS
Protection=0
EPROCESS
Protection=0x31
EPRO...

LSASS
Windows
Defender
Malware
Non-PPL Process PPL Process
PPL Process
EPROCESS
Protection=0
EPROCESS
Protection=0x31
EPRO...

90
Episode 8
Mimikatz can disable PPL!

91
Mimikatz can gather credentials from Windows
LSASS App
Password`s
hashes
Mimikatz
App

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

Mimikatz disables PPL to dump NTLM hashes
The online version is here –
https://www.youtube.com/embed/66g4PgtuD7c?vq=hd1440...

Attempt 1: Without Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
Mimikatz
App
User mod...

100
Episode 9
MemoryRanger can block Mimikatz

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection
Disable PPL
WRITE
The Current situation
101
KERNEL DRIVERS SHARE T...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection
Disable PPL
WRITE
The Current situation
102
How to restrict access...

MemoryRanger

Without MemoryRanger
all drivers share the same
kernel memory space MemoryRanger isolates drivers by
running them in separ...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection
Disable PPL
WRITE
The Current situation
MemoryRanger Prevents Disa...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection
Disable PPL
WRITE
The Current situation
MemoryRanger s Hypervisor
...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection
EPROCESS
for LSASS
OS
kernel
Protection
Default enclave for OS
and...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection Mimikatz
D...

Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection Mimikatz
Driver
EPROCESS
for LSASS
OS
kernel
Protection Mimikatz
D...

MemoryRanger Blocks Mimikatz and prevents disabling PPL
The online version is here –
https://www.youtube.com/embed/66g4Pgt...

out Disabling PPL Attempt 2: With Disabling PPL for LSASS
LSASS App
Password`s
hashes
LSASS App
Password`s
hashes
EPROCESS...

But what if malware can
escalate its own PPL?
Episode 10
112

Protection.Level = 0x41

114
Code-Signing Certificate Determines the Protection Level
Malware doesn’t bother about it!
Malware does not have this k...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
Malware App
Malware can ...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
Malware App
Malware can ...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
Antimalware
Ligh...

Malware escalates its PPL to dump Protected Processes
The online version is here –
https://www.youtube.com/embed/IELn8mcMZ...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
Antimalware
Ligh...

121
Episode 11
MemoryRanger can block malware

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
Antimalware
Ligh...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
Antimalware
Ligh...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
...

MemoryRanger prevents escalation of PPL
The online version is here –
https://www.youtube.com/embed/GEc-GOWtm8M?vq=hd1440 1...

NirSrv
PPL Process
LSASS
PPL Process
SgrmBroker
PPL Process
Non PPL Process
User mode
Kernel mode
EPROCESS
Prote ction=31
...

128
Episode 12
Architecture and Customization of
MemoryRanger

OS
MEMORY RANGER ARCHITECTURE
129

OS
A new driver
is loaded
MEMORY RANGER ARCHITECTURE
130

OS
A new driver
is loaded
A new process
is create d
MEMORY RANGER ARCHITECTURE
131

OS
A new driver
is loaded
Kernel API
function is called
A new process
is create d
MEMORY RANGER ARCHITECTURE
132

OS
Access to the protected
data triggers EPT violation
A new driver
is loaded
Kernel API
function is called
A new process
...

OS
Access to the protected
data triggers EPT violation
A new driver
is loaded
Kernel API
function is called
Memory
Ranger
...

OS
Access to the protected
data triggers EPT violation
MR s Driver notifies ab out
new OS events: loading
processes and dr...

OS
Access to the protected
data triggers EPT violation
MR s Driver notifies ab out
new OS events: loading
processes and dr...

OS
Access to the protected
data triggers EPT violation
MR s Driver notifies ab out
new OS events: loading
processes and dr...

OS
Access to the protected
data triggers EPT violation
MR s Driver notifies ab out
new OS events: loading
processes and dr...

OS
Memory Access Policy (MAP)
Access to the protected
data triggers EPT violation
MR s Driver notifies ab out
new OS event...

140
(2019) MemoryRanger Prevents
Hijacking FILE_OBJECT
Structures in Windows Kernel
https://igorkorkin.blogspot.co
m/2019/...

 MR’s Driver:
 locates an address of Protection field of LSAAS EPROCESS
 traps loading of Mimikatz
 MR’s Hypervisor
 ...

 MR’s Driver:
 locates an address of Protection field for OS processes and newly created apps
 traps loading of Mimikat...

 MR’s Driver:
 locates an address of Protection field for OS processes and newly created apps
 traps loading of kernel ...

 MR’s Driver:
 locates an address of Protection field for OS processes and newly created apps
 traps loading of kernel ...

 MR’s Driver:
 locates an address of Protection field for OS processes and newly created apps
 traps loading of kernel ...

 MR’s Driver:
 locates an address of Protection field for OS processes and newly created apps
 traps loading of kernel ...

1. Windows Security Model does not restrict apps running with debug privilege.
2. Protected Process Light (PPL) protects m...

Thank you!
Igor Korkin igor.korkin@gmail.com
All the details are here igorkorkin.blogspot.com

EXTRA SLIDES
149

Thank you!
Igor Korkin igor.korkin@gmail.com
All the details are here igorkorkin.blogspot.com

Thank you!
Igor Korkin igor.korkin@gmail.com
All the details are here igorkorkin.blogspot.com

152
Microsoft Windows OSes

153
(2019) MemoryRanger Prevents Hijacking FILE_OBJECT
Structures in Windows Kernel
https://igorkorkin.blogspot.com/2019/0...

 Virtual Secure Mode (VSM)1
 VSM provides a particular case of enclave-based protection with only two memory partitions
...

MemoryRanger vs.Windows Virtualization-based security (VBS)
Features VSM and KDP:
 Virtual Secure Mode (VSM)
 Kernel Dat...

 The same issue as VmWare Workstation
 The same solution*: Disable Hyper-V, turn off Virtualization-Based Security
156
M...

1. Protected Process Light (PPL) blocks illegal access to OS and AV processes.
2. Attackers can tamper with Protected Proc...

AllMemPro
MEMORY RANGER HISTORY CONTINUE
HyperPlatform
MemoryMonRWX
HyperPlatform
MemoryRanger
MemoryMonRWX
HyperPlatform
...

Top clipped slide