BH_US_12_Tsai_Pan_Exploiting_Windows8_WP

Table of Contents
Abstract ........................................................................................................................................... 1
1. Introduce the Security Design of Metro Style Apps ............................................................... 4
1.1 Configuration and Limitation ........................................................................................... 4
1.2 WinRT Environment and APIs .......................................................................................... 6
1.3 AppContainer Sandbox..................................................................................................... 7
1.4 App Confidence ................................................................................................................ 8
2. Sandbox Bypassing Analysis .................................................................................................... 8
2.1 Previous Work on Sandbox Bypassing ............................................................................. 8
2.2 The Target ........................................................................................................................ 9
2.3 Attack Vectors .................................................................................................................. 9
2.4 DLLs and Writing Shellcode ............................................................................................ 10
3. Debug of ALPC communication ............................................................................................ 11
3.1 Message Flow ................................................................................................................. 11
3.2 ALPC Syscal ..................................................................................................................... 12
3.3 HOOK and Monitoring ALPC communication ................................................................ 12
3.4 Fuzzing of ALPC communication .................................................................................... 14
4. Attack COM server ................................................................................................................ 15
4.1 COM on Windows 8 ....................................................................................................... 15
4.2 Purpose of COM Testing................................................................................................. 15
Test stability of COM server .................................................................................................. 15
Test functionality of COM server .......................................................................................... 15
4.3 The Target – RuntimeBroker and Other COM server .................................................... 16
4.4 Find Interface and Functions .......................................................................................... 19
4.5 Start the Testing ............................................................................................................. 19
4.6 Use Desktop App to Test ................................................................................................ 20
4.7 Attack Trend ................................................................................................................. 21
5. Attack WinRT API .................................................................................................................. 21
5.1 WinRT APIs Test.............................................................................................................. 21
2