Detect Kernel-Mode Rootkits via Real Time Logging & Controlling Mem...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Detect Kernel-Mode Rootkits via
Real Time Logging & Controlling Memory Access
2017 CDFSL
The slides are here – www.bit.ly/...

We Protect the Computer Memory
Igor Korkin, PhD Satoshi Tanda
Independent Researcher CrowdStrike, Inc
Moscow, Russia Vanco...

• Satoshi Tanda
• He has 7 years of experience in
reverse engineering & Windows
internals
• He spoke at the BlueHat v16,
R...

Memory accesses look like driving without rules
4
It is needed to control the memory accesses

Agenda
• Malware avoids detection: trends & experts’ views
• Intercepting memory access attempts: methods & projects
• The...

6
“... malware, or more specifically, a kernel rootkit, can often
tamper with kernel memory data, putting the trustworthin...

77
1. McAfee. (2016, September). Threats Report. McAfee Labs. Retrieved from http://www.mcafee.com/us/resources/reports/rp...

88
1. McAfee. (2016, September). Threats Report. McAfee Labs. Retrieved from http://www.mcafee.com/us/resources/reports/rp...

9
№ Pre-emptive Actions Malware actions Results & Comments
1
2
3
Defeat and Protect PatchGuard
9
Exploit is disabling Patc...

YouTube videos are no longer supported on SlideShare

View original on YouTube

10
№ Pre-emptive Actions Malware actions Results & Comments
1
OS has crashed
(PatchGuard has generated
0x109 BSOD)
2
OS ha...

11
What malware attacks do we want to monitor & prevent?
11
Control memory accesses:
• Reading
• Writing
• Executing

1) All types of memory accesses: read, write, execute
2) Triples for each access:
12
Destination Address
Memory Intercepto...

1) All types of memory accesses: read, write, execute
2) Triples for each access:
3) Access only from Source range  Desti...

14
What can we use as a basis for the memory interceptor?
14
Windows security model
protects only the
user-mode memory
Mem...

15
Intercepting memory access: methods & projects
15

16
Intercepting memory access: methods & projects
Project title, year
Read/
Write/
Execute
SPIDER, 2013 +/+/–
SecVisor, 20...

17
New Advanced Technology:
Intel VT-x with Extended Page Tables (EPT)
• EPT Overview
• EPT paging structures
• Applying E...

18
Hardware
Host Memory
Processing memory access: VT-x vs. VT-x with EPT
18
Guest OS
Hypervisor
Paging structures
Access t...

19
Hardware
Host Memory
Processing memory access: VT-x vs. VT-x with EPT
19
Guest OS
Hypervisor
Paging structures
Access t...

Intercept access:
Read Write Execute
20
EPT Paging structures
EPT Page Table
Access Bits | PFN
Access Bits | PFN
EPT Page ...

Intercept access:
Read Write Execute
21
EPT Paging structures
EPT Page Table
Access Bits | PFN
Access Bits | PFN
EPT Page ...

22
• from Source range to Destination range
• and skip all the rest?
How to apply EPT to monitor access only
22
We propose...

23
Step 1. Trapping execution on Source range
23
Guest OS memory
An access from the
source range  destination range
An ac...

24
Step 1. Trapping execution on Source range
24
These are memory accesses from the source range
Source range Destination ...

25
Step 1. Trapping execution on Source range
25
MemoryAccesses
Skip
EPT Normal View Structure
These are memory accesses f...

26
Step 2. Process VM-Exit to separate access to the Destination
range
26
Source range Destination range Others
Guest OS m...

27
Step 2. Process VM-Exit to separate access to the Destination
range
27
MemoryAccesses
EPT Monitor View Structure
Hyperv...

28
Step 3. Process VM-Exit, because of access on Destination range
28
Source range Destination range Others
Source Address...

29
Step 3. Process VM-Exit, because of access on Destination range
29
MemoryAccesses
EPT Monitor View Structure (Modified)...

30
Step 4 (Restore setting). Process VM-Exit, because of MTF
30
MemoryAccesses
EPT Monitor View Structure (Restored)
Sourc...

Step 5. Process VM-Exit, because of execution on Destination range
EPT Normal View Structure
Hypervisor traps these code e...

32
Five steps together
32
EPT Normal View
Structure
EPT Monitor View with
• Replaced EPT.DST.PFN
• EPT.DST.read=true,
EPT....

33
MemoryMonRWX architecture
33The source code is here - http://bit.ly/MemoryMonRWX

34
MemoryMonRWX architecture
34The source code is here - http://bit.ly/MemoryMonRWX

35
MemoryMonRWX architecture
35The source code is here - http://bit.ly/MemoryMonRWX

36
MemoryMonRWX architecture
36The source code is here - http://bit.ly/MemoryMonRWX

37
MemoryMonRWX architecture
37The source code is here - http://bit.ly/MemoryMonRWX

38
MemoryMonRWX architecture
38The source code is here - http://bit.ly/MemoryMonRWX

39
MemoryMonRWX architecture
39The source code is here - http://bit.ly/MemoryMonRWX

40
MemoryMonRWX is small and fast
40
Comparison of hypervisors
(ines of code)
MemoryMonRWX overhead
5% 5% 2%
18%
7%
0%
25%...

41
Conclusions
• MemoryMonRWX logs & controls all memory accesses in a real time
• It is a hypervisor, which supports newe...

Acquire Physical Memory & Detect Hidden Software by Raspberry Pi
42
CaptureGUARD Physical Memory Acquisition Hardware
$7,7...

Acquire Physical Memory & Detect Hidden Software by Raspberry Pi
43
CaptureGUARD Physical Memory Acquisition Hardware
$7,7...

Consequences of attacks on implants:
1. Pacemakers by St. Jude Medical Inc.(2016)
 manipulation of beat rates
 battery d...

• Veronika Domova
• Software developer, Sweden
• IoT and Industrial Cyber Security
45
Protection of Wireless Implantable M...

46
Thank you!
Igor Korkin igor.korkin@gmail.com
Satoshi Tanda tanda.sat@gmail.com
The slides, source code and all details ...

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

View on SlideShare

1 of 47 Ad

1 of 47 Ad