Secure Operating Systems

1. Secure Operating Systems Lesson B: Let’s go break something

2. Where are we? • We’ve looked at hardware and software, but I have failed to really show you how to break things… which does rather make the beauty of Multics harder to see • So… let’s look at some examples of OSes breaking

3. Linux: Overview • Based on Chen et al.’s “Linux kernel vulnerabilities: State-of-the-art defenses and open problems” • They looking at a year (approx) of Linux Kernel vulnerabilities and found the following…

4. Vulns • Source: Chen et al.

5. Vulns (cntd) • Source: Chen et al.

6. What about countermeasures? • Software fault isolation • Code Integrity (such as SecVisor) • User-level drivers • Memory tagging (detect misuse of untrusted inputs) • Uninitialized memory tracking

7. Semantic Vulnerabilities • Simply not protecting something that needs to be protected • Does it happen? Yes! (See CVE-2010-1641 and many manymore) • Much harder to detect automatically • This is a hard problem!

8. Another problem: Shatter • From: “Exploiting design flaws in the Win32 API for privilege escalation. Or... Shatter Attacks – How to break Windows” • Shatter is a classic example of how things can go wrong

9. The Setup • Shatter is a local privilege escalation attack • VirusScan runs as LocalAdministrator • I run as an unprivileged user • Can I get VirusScan to execute code on my behalf?

10. How it works • First, we get a handle to the higher privileged Window – Windows provides the APIs for this • We now have access to the controls on that window programmatically • Set up the max length for our shell code, and paste it in using Windows Messages

11. WM_TIMER • Send the window a WM_TIMER message with the location of the code we want to execute (oops) • Bingo! • Let’s discuss for a minute…

12. Complicated: IA64 sysret • Okay, this one is REALLY quite complicated… let’s take a look • Following: “A Stitch In Time Saves Nine: A Case Of Multiple OS Vulnerability” • Eek!

13. AMD • From Wojtczuk:

14. Intel • From Wojtczuk:

15. Think about it… • From Wojtczuk:

16. Exploitation • DoS is easy, but code injection is a bit harder but not impossible • What’s worse, it’s hard to fix • The basic idea is how the exception gets kicked off

17. Things to Do • Read: “Linux kernel vulnerabilities: State-of-the-art defenses and open problems”

18. Questions & Comments • What do you want to know?