BATTLE OF SKM AND IUM

Recommendations

Info

WHO AMI I? • Chief Architect at CrowdStrike, a security startup • Previously worked at Apple on iOS Core Platform Team • Co-author of Windows Internals 5 th and 6 th Editions • Reverse engineering NT since 2000 – main kernel developer of ReactOS • Instructor of worldwide Windows Internals classes • Conference speaking: • Blackhat 2015, 2013, 2008 • Recon 2015-2010, 2006 • SyScan 2015-2012 • NoSuchCon 2014-2013, Breakpoint 2012 • For more info, see www.alex-ionescu.com
PRESENTATION OVERVIEW • Microsoft is investing heavily into Virtualization Based Security (VBS) in Windows 10 / Server 2016 • Device Guard • Credential Guard • vTPM and Guarded Fabric / Shielded VM • Scarce documentation and a few blog posts are starting to appear on these features • And there was a talk about Credential Guard yesterday! • This presentation is not about these features – Microsoft will do their own marketing of them • All of these features, however, leverage the same internal changes to the Microsoft Hypervisor (Hyper- V) and the NT kernel – a set of changes called Virtual Secure Mode (VSM) • We will “go deep” in the architecture of these changes, and their impact on the platform for security • Microsoft official “Going Deep” session on Channel 9 with Dave Probert and Logan Gabriel is live as of 9 hours ago
Page 1: BATTLE OF SKM AND IUM HOW WINDOWS 1
Page 5 and 6: VBS FEATURES IN WINDOWS 10 / SERVER
Page 7 and 8: ENABLING VBS
Page 9 and 10: HOW DOES IT ALL WORK? • Hyperviso
Page 11 and 12: SEPARATION OF ROLES • Instead of
Page 13 and 14: PLATFORM REQUIREMENTS • The Boot
Page 15 and 16: HARD CODE GUARANTEES • When hard
Page 17 and 18: VIRTUAL SECURE MODE (VSM) BOOTSTRAP
Page 19 and 20: SKM LAUNCH • To initialize VTL 1,
Page 21 and 22: BCD VSM POLICY OPTIONS • The poli
Page 23 and 24: SKM INTERNALS
Page 25 and 26: SKM STRUCTURES • SKM has a PCR at
Page 27 and 28: SKM CAPABILITIES • The SkCapabili
Page 29 and 30: SECURE MODE CALLS • Secure Mode C
Page 31 and 32: SPECIALIZED SECURE MORE SERVICE CAL
Page 33 and 34: NORMAL MODE SERVICE CALLS • SK ne
Page 35 and 36: IUM INTERNALS
Page 37 and 38: SECURE SYSTEM CALLS • SKM exposes
Page 39 and 40: SECURE BASE API • Trustlets shoul
Page 41 and 42: NOTABLY MISSING… • Trustlets ca
Page 43 and 44: NORMAL MODE SYSTEM CALL PROXYING Th
Page 45 and 46: LAUNCHING A TRUSTLET • Process At
Page 47 and 48: EXAMPLE IUM-COMPLIANT SIGNED BINARY
Page 49 and 50: TRUSTLET INSTANCE GUID • Trustlet
Page 51 and 52: LSA TRUSTLET • One of the two inb
Page 53 and 54:
LOADING A TRUSTLET • Ldr, or the
Page 55 and 56:
TRUSTLET TO NORMAL WORLD COMMUNICAT
Page 57 and 58:
CAN WE BUILD OUR OWN TRUSTLETS? •
Page 59 and 60:
CONCLUSION RISKS AND THOUGHTS
Page 61 and 62:
SECURE KERNEL COMPLEXITY / ATTACK S
Page 63 and 64:
VSM WITHOUT SECUREBOOT • What’s
Page 65:
YOU HAVE QUESTIONS? I HOPEFULLY HAV
show all

BATTLE OF SKM AND IUM

Create successful ePaper yourself

Delete template?

Save as template?