EMB423 Creating A Trusted Environment For Windows CE 5.0

1. EMB423Creating A Trusted Environment For Windows CE 5.0 Nat Frampton President Real Time Development nat@realtimeonline.com

3. OEM/IHV Supplied BSP(ARM, SH4, MIPS) OEM Hardware and Standard Drivers Standard PC Hardware and Drivers Hardware/Drivers Windows XP DDK Device Building Tools Windows Embedded Studio Platform Builder Data Lightweight Relational EDB SQL Server 2005 Express Edition SQL Server 2005 Mobile Edition SQL Server 2005 Win32 Native Managed Server Side Programming Model MFC 8.0, ATL 8.0 .NET Compact Framework .NET Framework ASP.NET Mobile Controls ASP.NET Windows Media Multimedia DirectX Location Services MapPoint Development Tools Visual Studio 2005 Internet Security and Acceleration Server Communications& Messaging Exchange Server Live Communications Server Speech Server Device Update Agent ManagementTools Software Update Services Image Update Systems Management Server Microsoft Operations Manager

4. Overview • Inside Loader Authentication • Implementation Example • Implementation Scenerios • Conclusions

5. Locking Down App Execution Trusted Model • Application execution control via Trusted Model • OEM option to assign trust levels to processes • Protections • Prevents unauthorized modules from being loaded • Restricts access to certain system APIs • Prevent registry WRITE access to certain root and sub-keys: • HKEY_LOCAL_MACHINE\Comm, Drivers, Hardware, Init, Services, SYSTEM, WDMDrivers • Prevents WRITE access to files with SYSTEM attribute • READ access granted, by default. Can be changed via [HKLM\System\ObjectStore]\“AllowSystemAccess”

6. Locking Down App Execution When do I implement the Trusted Model? • 1-tier (all code runs as Trusted) • Prevent unknown code from executing on device • Trust all code running on device (to same extent) • 2-tier (code can run as Trusted or Untrusted) • End users can run any code on device • Protect from malicious code, such as worms, viruses, trojan attacks, etc. • Restrict capabilities of certain processes

7. Locking Dow… Execution Trusted Model Load Library Load Trusted Model? L T o Y Y R a d N N F Pass OEM Verification Assign Trust Level Fail Fail Load

8. Locking Down App Execution Trusted Model • Implement Trusted Environment with two functions • OEMCertifyModuleInit • Loader notifies OAL (OEM Adaptation Layer) code when launching new module • OEMCertifyModule • Loader passes module to OAL code for verification • Returns one of three trust levels: • OEM_CERTIFY_TRUST, • OEM_CERTIFY_RUN, • OEM_CERTIFY_FALSE • Samples available • loadauth.lib – Sample implementation of OEMCertifyModule and OEMCertifyModuleInit • signfile.exe – Desktop application that signs CE binaries

9. OEM Certification

10. DLL And EXE Trust Levels

11. Loader Location • Appears in… • \WINCE500\Private\WINCEOS\COREOS\NK\KERNEL\Loader.c • Function VerifyBinary • Define the following in OEMInit… • pOEMLoadInit = OEMCertifyModuleInit • pOEMLoadModule = OEMCertifyModule

12. Implementation Example

13. Lockdown Architecture Win32 Allowable Files Database Kernel KernelIOControl Load Library OAL Allowable Files List OEMCertify….

14. File Changes \WINCE500… • \PLATFORM\COMMON\SRC\X86\COMMON\STARTUP\OEMINIT.C • Actual OEMCertification Modules • \PUBLIC\COMMON\OAK\INC\PkFuncs.h • Define IOCTL Codes into the KernelIOControl • \PLATFORM\COMMON\SRC\X86\INC\ioctl_tab.h • Associate our IOCTL Call handler with IOCTLs • \PLATFORM\COMMON\SRC\X86\INC\x86ioctl.h • Declare our interface to our IOCTL Call Handler

15. Implementation Scenarios • OEM is free to choose trust level • Digital Certificates represent highest trust level • Digital Certificates require extra footprint • OEM can implement dynamic trust • Allows for the device to change personality • OEM can implement Name/Checksum

16. Conclusions • Windows CE 5.0 Provides a robust Security Architecture • Loader Certification provides a mechanism to • Create a Trusted Environment • Dynamically define the devices personality • Follow Best Practices at multiple levels for best defense • “Trusted Security is best achieved by having a thorough understanding of the Windows CE 5.0’s Security Architecture and Trust Model!”

17. While At MEDC 2005… Fill out an evaluation for this session Randomly selected instant WIN prizes! Visit the Microsoft Product Pavilion in the Exhibit Hall Shorelines B Use real technology in a lab Instructor led Reef E/F & Breakers L Self-paced Reef B/C

18. After The Conference… Build Install Build Join Full-featured trial versions of Windows CE and/or Windows XP Embedded Cool stuff & tell us about it: msdn.microsoft.com/embedded/community Windows Embedded Partner Program:www.mswep.com Develop Install Enter Join Windows Mobile 5.0 Eval Kit including Visual Studio 2005 Beta 2 Mobile2Market Contest and win up to $25000: mobile2marketcontest.com Microsoft Solutions Partner Program:partner.microsoft.com

19. Tools & Resources Build Develop Websites msdn.microsoft.com/embedded msdn.microsoft.com/mobility Newsgroups microsoft.public.pocketpc.developer smartphone.developer dotnet.framework.compactframework microsoft.public.windowsxp.embedded windowsce.platbuilder windowsce.embedded.vc Blogs blogs.msdn.com/windowsmobilevsdteamnetcfteam blogs.msdn.com/mikehall Tools Windows CE 5.0 Eval KitWindows XP Embedded Eval Kit Windows Mobile 5.0 Eval Kit