Subverting Vista Kernel For Fun

Subverting Vista TM Kernel For Fun And Profit Joanna Rutkowska Advanced Malware Labs SyScan’06 July 21 st , 2006, Singapore & Black Hat Briefings 2006 August 3 rd , 2006, Las Vegas

About this presentation ,[object Object],[object Object]

Content ,[object Object],[object Object],[object Object],[object Object]

Part I – getting into the kernel

Signed Drivers in Vista x64 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

How to bypass? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Challenges ,[object Object],[object Object],[object Object],[object Object]

How to force drivers to be paged? ,[object Object],[object Object],[object Object],[object Object]

What could be paged? ,[object Object],[object Object]

Finding a target ,[object Object],[object Object],[object Object],[object Object]

Locating paged code inside pagefile ,[object Object],[object Object],[object Object],[object Object]

How to make sure our shellcode gets executed? ,[object Object],[object Object],[object Object]

Putting it all together ,[object Object],[object Object],[object Object]

DEMO ,[object Object],[object Object],[object Object]

Creating useful shellcodes ,[object Object],[object Object]

Possible solutions (1/3) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Possible solutions (2/3) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Possible solutions (3/3) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Bottom line ,[object Object],[object Object],[object Object],[object Object]

Invisibility by Obscurity ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Imagine a malware… ,[object Object],[object Object],[object Object],[object Object]

Blue Pill Idea ,[object Object],[object Object],[object Object]

AMD64 & SVM ,[object Object],[object Object],[object Object],[object Object]

SVM ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The heart of SVM: VMRUN instruction

BP installs itself ON THE FLY! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

SubVirt Rootkit ,[object Object],[object Object]

SubVirt vs. Blue Pill ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Matrix inside another Matrix ,[object Object],[object Object],[object Object],[object Object]

Detection via timing analysis ,[object Object],[object Object],[object Object],[object Object],[object Object]

Cheating timing analysis ,[object Object],[object Object],[object Object],[object Object]

Time profiling in practice ,[object Object],[object Object],[object Object],[object Object]

Blue Pill based malware ,[object Object],[object Object],[object Object],[object Object]

Delusion Backdoor ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Delusion Demo (Blue Pill powered)

Blue Pill detection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Generic BP detection ,[object Object],[object Object],[object Object]

Blue Pill detection ,[object Object],[object Object],[object Object]

Pacifica vs. Vanderpool ,[object Object],[object Object],[object Object],[object Object]

Blue Pill Prevention ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Hardware Red Pill? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Future work ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Bottom line ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

References ,[object Object],[object Object]

Credits ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Thank you! [email_address] check out http://coseinc.com/ for information about available trainings!

Subverting Vista Kernel For Fun

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (7)

Similar to Subverting Vista Kernel For Fun

Similar to Subverting Vista Kernel For Fun (20)

Recently uploaded

Recently uploaded (20)

Subverting Vista Kernel For Fun