Windows内核劫持不是一个选项MemoryRanger再次出手相救_Windows Kernel Hijacking Is
版权申诉
82 浏览量
2022-01-19
13:25:21
上传
评论
收藏 424KB PDF 举报
WINDOWS KERNEL HIJACKING IS NOT AN OPTION:
MEMORYRANGER COMES TO THE RESCUE AGAIN
Igor Korkin, PhD
Independent Researcher
Moscow, Russian Federation
igor.korkin@gmail.com
ABSTRACT
The security of a computer system depends on OS kernel protection. It is
crucial to reveal and inspect new attacks on kernel data, as these are used by
hackers. The purpose of this paper is to continue research into attacks on
dynamically allocated data in the Windows OS kernel and demonstrate the
capacity of MemoryRanger to prevent these attacks. This paper discusses three
new hijacking attacks on kernel data, which are based on bypassing OS security
mechanisms. The first two hijacking attacks result in illegal access to files open in
exclusive access. The third attack escalates process privileges, without applying
token swapping. Although Windows security experts have issued new protection
features, access attempts to the dynamically allocated data in the kernel are not
fully controlled. MemoryRanger hypervisor is designed to fill this security gap.
The updated MemoryRanger prevents these new attacks as well as supporting the
Windows 10 1903 x64.
Keywords: hypervisor-based protection, Windows kernel, hijacking attacks
on memory, memory isolation, Kernel Data Protection.
1. INTRODUCTION
The security of users’ data and
applications depends on the security of
the OS kernel code and data. Modern
operating systems include millions of
lines of code, which makes it
impossible to reveal and remediate all
vulnerabilities. Attackers can exploit
the OS vulnerabilities to perform
malicious actions. Windows OS kernel
remains one of the most desired targets
for hackers.
Another big challenge of OS
kernel protection is the third-party
kernel-mode drivers, which execute at
the same high privilege level as the OS
kernel, and they also include a variety
of vulnerabilities. Researchers
consider that “kernel modules (drivers)
introduce additional attack surface, as
they have full access to the kernel’s
address space” (Yitbarek and Austin,
2019).
At the recent DEF CON hacking
conference researchers from
Eclypsium released a list of more than
40 drivers from Microsoft-certified
hardware vendors, which are prone to
privilege escalation attacks (Jesse and
Shkatov, 2019).
剩余28页未读，继续阅读
资源评论
