BATTLE OF SKM AND IUM

Recommendations

Info

VSM / HYPERVISOR LAUNCH • VSM is a built-in feature of the Hyper-V 5.0+ hypervisor (Windows 10 / Server 2016) • Enabling Hyper-V with the “hypervisorlaunchtype” BCD variable will enable VSM • But nothing executes at VTL 1 (yet) • When the hypervisor is configured to launch, OslArchHypervisorSetup will eventually call HvlpLaunchHvLoader • This launches HVLOADER.EFI, which is the boot loader for Hyper-V itself • Later, in the second phase of the bootloader, OslArchHypervisorSetup runs again, and starts the hypervisor • With the Hypervisor fully active and initialized, the rest of the boot loader’s execution is itself running under the root partition • Note: this is a change from Windows 7, where the hypervisor was initialized much later through a boot driver
<strong>SKM</strong> LAUNCH • To initialize VTL 1, and provide <strong>IUM</strong> capabilities, the Secure Kernel must be loaded • This will be configured by the various VBS configuration options that the Administrator / Group Policy enables • But can also be manually configured by using the “vsmlaunchtype” BCD variable • Loading the Secure Kernel is done by the OslVsmSetup routine inside of the boot loader (WINLOAD.EFI) • This will create the VSM Loader Block, which contains all the key data structures for the Secure Kernel to initialize • Boot loader will provide an initial set of boot stack pages, shared system buffers, map the API set schema, map code integrity data, pass policy information, and more • Boot loader is also responsible for generating, provisioning, measuring and sealing the IDK (Identification Key) and the LKEY (Local Key) which are used to provide strong cryptographic guarantees by Credential Guard and vTPM • Boot loader will then load the Secure Kernel itself (SECUREKERNEL.EXE), as well as its dependencies • Namely SKCI.DLL and CNG.SYS
Page 1 and 2: BATTLE OF SKM AND IUM HOW WINDOWS 1
Page 3 and 4: PRESENTATION OVERVIEW • Microsoft
Page 5 and 6: VBS FEATURES IN WINDOWS 10 / SERVER
Page 7 and 8: ENABLING VBS
Page 9 and 10: HOW DOES IT ALL WORK? • Hyperviso
Page 11 and 12: SEPARATION OF ROLES • Instead of
Page 13 and 14: PLATFORM REQUIREMENTS • The Boot
Page 15 and 16: HARD CODE GUARANTEES • When hard
Page 17: VIRTUAL SECURE MODE (VSM) BOOTSTRAP
Page 21 and 22: BCD VSM POLICY OPTIONS • The poli
Page 23 and 24: SKM INTERNALS
Page 25 and 26: SKM STRUCTURES • SKM has a PCR at
Page 27 and 28: SKM CAPABILITIES • The SkCapabili
Page 29 and 30: SECURE MODE CALLS • Secure Mode C
Page 31 and 32: SPECIALIZED SECURE MORE SERVICE CAL
Page 33 and 34: NORMAL MODE SERVICE CALLS • SK ne
Page 35 and 36: IUM INTERNALS
Page 37 and 38: SECURE SYSTEM CALLS • SKM exposes
Page 39 and 40: SECURE BASE API • Trustlets shoul
Page 41 and 42: NOTABLY MISSING… • Trustlets ca
Page 43 and 44: NORMAL MODE SYSTEM CALL PROXYING Th
Page 45 and 46: LAUNCHING A TRUSTLET • Process At
Page 47 and 48: EXAMPLE IUM-COMPLIANT SIGNED BINARY
Page 49 and 50: TRUSTLET INSTANCE GUID • Trustlet
Page 51 and 52: LSA TRUSTLET • One of the two inb
Page 53 and 54: LOADING A TRUSTLET • Ldr, or the
Page 55 and 56: TRUSTLET TO NORMAL WORLD COMMUNICAT
Page 57 and 58: CAN WE BUILD OUR OWN TRUSTLETS? •
Page 59 and 60: CONCLUSION RISKS AND THOUGHTS
Page 61 and 62: SECURE KERNEL COMPLEXITY / ATTACK S
Page 63 and 64: VSM WITHOUT SECUREBOOT • What’s
Page 65: YOU HAVE QUESTIONS? I HOPEFULLY HAV

BATTLE OF SKM AND IUM

Create successful ePaper yourself

Delete template?

Save as template?