Hypervisor-Based Active Data Protection for Integrity and Confident...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Hypervisor-Based Active Data
Protection for Integrity and Confidentiality of
Dynamically Allocated Memory in Windows Kerne...

Hypervisor-Based Active Data
Protection for Integrity and Confidentiality of
Dynamically Allocated Memory in Windows Kerne...

Dynamically Allocated Memory in Windows Kernel
The function ExAllocatePoolWithTag(NumberOfBytes) ―
allocates memory block ...

Dynamically Allocated Memory in Windows Kernel
The function ExAllocatePoolWithTag(NumberOfBytes) ―
allocates memory block ...

Consequences of Allocated Data Attacks
Windows OS Internals
(Processes and drivers
structures)
 Hidden footprints
 Escal...

Consequences of Allocated Data Attacks
Windows OS Internals
(Processes and drivers
structures)
 Hidden footprints
 Escal...

Consequences of Allocated Data Attacks
Windows OS Internals
(Processes and drivers
structures)
 Hidden footprints
 Escal...

Windows-based CNC can be attacked like a PC
https://www.fanucamerica.com/docs/default-source/cnc-files/brochures/fanuc_30i...

Windows-based CNC can be attacked like a PC
https://www.fanucamerica.com/docs/default-source/cnc-files/brochures/fanuc_30i...

Hypervisor-Based Active Data
Protection for Integrity and Confidentiality of
Dynamically Allocated Memory in Windows Kerne...

Protection for Integrity and Confidentiality of
Dynamically Allocated Memory in Windows Kernel
Kernel-mode
Driver
Allocate...

Analysis of Allocated Data Protection Projects
Title, year
OS data
Integrity
Third-Party Drivers Data
OS
Integrity Confide...

Analysis of Allocated Data Protection Projects
Title, year
OS data
Integrity
Third-Party Drivers Data
OS
Integrity Confide...

Integrity of Windows Internals
List of EPROCESS
structures
user mode
kernel mode

Integrity of Windows Internals
List of EPROCESS
structures
user mode
kernel mode

Integrity of Windows Internals
List of EPROCESS
structures
user mode
kernel mode
cmd has USERS
privileges

Integrity of Windows Internals
Fields of EPROCESS Hackers Goals Reaction of Security Service
ActiveProcessLinks Hide a pro...

YouTube videos are no longer supported on SlideShare

View original on YouTube

Part 1/3 - Hiding a Process
Demo A

YouTube videos are no longer supported on SlideShare

View original on YouTube

Integrity of Windows Internals
Fields of EPROCESS Hackers Goals Reaction of Security Service
ActiveProcessLinks Hide a pro...

Part 2/3 - Escalating Process Privileges
Demo B

YouTube videos are no longer supported on SlideShare

View original on YouTube

✘
Integrity of Windows Internals
Fields of EPROCESS Hackers Goals Reaction of Security Service
ActiveProcessLinks Hide a p...

Integrity of Windows Internals
Fields of EPROCESS Hackers Goals Reaction of Security Service
ActiveProcessLinks Hide a pro...

Part 3/3 - AllMemPro Prevents
Escalation of Process Privileges
Demo C

YouTube videos are no longer supported on SlideShare

View original on YouTube

Integrity of Windows Internals
Fields of EPROCESS Hackers Goals Reaction of Security Service
ActiveProcessLinks Hide a pro...

YouTube videos are no longer supported on SlideShare

View original on YouTube

Protection of Industrial Control Systems
user mode
kernel mode
Driver
mem_allocator
Temperature
Nuclear Reactor
is OK

user mode
kernel mode
Driver
mem_attackermem_allocator
Driver
Temperature
Nuclear Reactor
is in danger
Protection of Indus...

Part 1/2 - Unauthorized Modification of
Dynamically Allocated Memory
Demo D

user mode
kernel mode
Fake Data
AllMemPro protects the temperature
by redirecting illegal access to the fake data
Nuclear ...

Part 2/2 - AllMemPro Prevents Illegal
Access to the Allocated Memory
Demo E

Hypervisor-Based Active Data
Protection for Integrity and Confidentiality of
Dynamically Allocated Memory in Windows Kerne...

Architecture of AllMemPro - Allocated Memory Protection
Controller Switcher
Dispatcher
Memory Access Rule
 drvAddr
 drvS...

Architecture of AllMemPro - Allocated Memory Protection
Tracks:
 loading drivers
 memory allocation
Controller
Intercept...

Architecture of AllMemPro - Allocated Memory Protection
Tracks:
 loading drivers
 memory allocation
Controller
Intercept...

Architecture of AllMemPro - Allocated Memory Protection
Tracks:
 loading drivers
 memory allocation
Controller
Intercept...

Architecture of AllMemPro - Allocated Memory Protection
Tracks:
 loading drivers
 memory allocation
Controller
Intercept...

The Switcher Controls Memory Access via EPT
EPT Paging Structure
Memory
Access Rule
EPT: memory access is blocked
EPT: mem...

The Switcher Controls Memory Access via EPT
EPT Paging Structure
Memory
Access Rule
EPT: memory access is blocked
EPT: mem...

The Switcher Controls Memory Access via EPT
EPT Paging Structure
Memory
Access Rule
EPT: memory access is blocked
EPT: mem...

AllMemPro benchmarks: memory access time
Driver Protected Memory
Reads/Writes
70±2
100.000±4.000
500.000±10.000
0
1
2
3
4
...

AllMemPro Summary
• restricts the OS kernel
• protects each byte of the allocated memory
• is hypervisor-based and does no...

Thank you!
Igor Korkin igor.korkin@gmail.com
All the details are here igorkorkin.blogspot.com

Hypervisor-Based Active Data Protection for Integrity and Confidentiality of Dynamically Allocated Memory in Windows Kernel