Using the CGC's Fully Automated Vulnerability Detection Tools in Security Eva...Seungjoo Kim
"Using the CGC's Fully Automated Vulnerability Detection Tools in Security Evaluation and Its Effectiveness - Are Tools Good for Hackers Good for Security Evaluators? -" @ CODE BLUE 2016, Tokyo, Japan (October 20, 2016)
You didnt see it’s coming? "Dawn of hardened Windows Kernel" Peter Hlavaty
Past few years our team was focusing on different operating systems including Microsoft windows kernel. Honestly our first pwn at Windows kernel was not that challenging. Number of available targets with friendly environment for straightforward pwn, from user up to reliable kernel code execution.
However, step by step, security policies continue to evolve, and it becomes more troublesome to choose ideal attack surface from various sandboxes. In addition, what steps to follow for digging security holes is highly dependent upon the chosen target. In general, a few common strategies are available for researchers to choose: e.g choose “unknown” one which hasn’t been researched before; Select well fuzzed or well audited one, or research on kernel module internals to find “hidden” attack surfaces which are not explicitly interconnected. In the first part of the talk we introduce our methodology of selecting, alongside with cost of tricks around to choose seemingly banned targets, illustrated by notable examples.
After getting hands on potential bug available from targeted sandbox, it is time for Microsoft windows taking hardening efforts to put attacker into corner. Strong mitigations are being introduced more frequently than ever, with promising direction which cuts lots of attack surface off, and a several exploitation techniques being killed. We will show difficulties of developing universal exploitation techniques, and demonstrate needed technical level depending on code quality of target. We will examine how different it becomes with era of Redstone and following versions even with those techniques and good vulnerability in hand. How it changed attacker landscape and how it will (and will not) kill those techniques and applications. However will it really change the game or not?
Using the CGC's Fully Automated Vulnerability Detection Tools in Security Eva...Seungjoo Kim
"Using the CGC's Fully Automated Vulnerability Detection Tools in Security Evaluation and Its Effectiveness - Are Tools Good for Hackers Good for Security Evaluators? -" @ CODE BLUE 2016, Tokyo, Japan (October 20, 2016)
You didnt see it’s coming? "Dawn of hardened Windows Kernel" Peter Hlavaty
Past few years our team was focusing on different operating systems including Microsoft windows kernel. Honestly our first pwn at Windows kernel was not that challenging. Number of available targets with friendly environment for straightforward pwn, from user up to reliable kernel code execution.
However, step by step, security policies continue to evolve, and it becomes more troublesome to choose ideal attack surface from various sandboxes. In addition, what steps to follow for digging security holes is highly dependent upon the chosen target. In general, a few common strategies are available for researchers to choose: e.g choose “unknown” one which hasn’t been researched before; Select well fuzzed or well audited one, or research on kernel module internals to find “hidden” attack surfaces which are not explicitly interconnected. In the first part of the talk we introduce our methodology of selecting, alongside with cost of tricks around to choose seemingly banned targets, illustrated by notable examples.
After getting hands on potential bug available from targeted sandbox, it is time for Microsoft windows taking hardening efforts to put attacker into corner. Strong mitigations are being introduced more frequently than ever, with promising direction which cuts lots of attack surface off, and a several exploitation techniques being killed. We will show difficulties of developing universal exploitation techniques, and demonstrate needed technical level depending on code quality of target. We will examine how different it becomes with era of Redstone and following versions even with those techniques and good vulnerability in hand. How it changed attacker landscape and how it will (and will not) kill those techniques and applications. However will it really change the game or not?
[2013 CodeEngn Conference 08] manGoo - Windows 8 ExploitGangSeok Lee
2013 CodeEngn Conference 08
Exploit으로 인한 보안 위협은 어제 오늘만의 문제가 아니다. 그에 따라서, Windows Version이 Update 되면서 다양한 Memory Protection 기능으로 Exploiting 으로 인한 공격을 방어하게 되었다. Exploiting Technique에 대한 History를 살펴 보며, Windows 8에서 Memory 관리 하는 방법 및 Memory Protection 방법에 대해서 살펴 볼 것이다. 이러한 변화로 인해 Exploiting 공격에 있어 어떤 방법으로 접근해야 될 지 알아보도록 하자.
http://codeengn.com/conference/08
[2013 CodeEngn Conference 08] manGoo - Windows 8 ExploitGangSeok Lee
2013 CodeEngn Conference 08
Exploit으로 인한 보안 위협은 어제 오늘만의 문제가 아니다. 그에 따라서, Windows Version이 Update 되면서 다양한 Memory Protection 기능으로 Exploiting 으로 인한 공격을 방어하게 되었다. Exploiting Technique에 대한 History를 살펴 보며, Windows 8에서 Memory 관리 하는 방법 및 Memory Protection 방법에 대해서 살펴 볼 것이다. 이러한 변화로 인해 Exploiting 공격에 있어 어떤 방법으로 접근해야 될 지 알아보도록 하자.
http://codeengn.com/conference/08