LOL (Layers On Layers) – Bypassing Endpoint Security for Fun and Profit (slides)

MrBrian · Sep 20, 2014

From http://haxpo.nl/hitb2014ams-wojtczuk-kashyap/:

PRESENTATION ABSTRACT:

Over the past many years, there’ve been a plethora of security solutions available for Windows-based end points; many users and administrators have difficulty in assessing their strengths and weaknesses. Interestingly, many of these solutions are basically helpless against kernelmode malicious code. Each kernel patch/0day creates a hole for organizations that goes unnoticed by most.

In this talk, we will take the recent public exploit for EPATHOBJ Windows kernel vulnerability and show that with some tweaks, we can use it to bypass application sandboxes, AV, HIPS, rootkit detectors, EMET and SMEP – even if these solutions are stacked one upon other. We simply keep on tweaking the exploit until we bypass _every security software_ that you would expect on a corporate user machine. This highlights the fact that “defense in depth” based on simultaneous deployment of multiple solutions sharing the same weakness is not satisfactory; we postulate the need for defensive methods that are immune to kernelmode exploits, and discuss the possible implementations.

The issue is far from theoretical – the modern malware (e.g. TDL4) is already using this particular EPATHOBJ exploit to gain privileges. Also, the Windows kernel vulnerabilities are frequent, and this is not going to change anytime soon – we have to live with them and be able to defend against them.
Click to expand...

siljaline · Sep 21, 2014

I thought you'd meant, (LWY - Lawyers without Yachts) ...

lotuseclat79 · Sep 23, 2014

Rafal Wojtczuk used to work at Invisible Things Lab with/for security guru Joanna Rutkowska ref: http://invisiblethingslab.com/itl/Resources.html.

Rasheed187 · Sep 24, 2014

Very interesting, so what they are basically saying is: It's currently hard to protect against kernel exploits, unless you use a microvisor (VMM) like Bromium. However, interesting to note that user-mode HIPS and hypervisor based HIPS can at least offer some form of protection. BTW, the use of those "kiddie pics" was a bit silly and unprofessional IMO.

http://www.wired.com/2012/06/crosby-bromium-microvisor/all/

Log in or Sign up

LOL (Layers On Layers) – Bypassing Endpoint Security for Fun and Profit (slides)

MrBrian Registered Member

siljaline Registered Member

lotuseclat79 Registered Member

Rasheed187 Registered Member

Log in or Sign up

LOL (Layers On Layers) – Bypassing Endpoint Security for Fun and Profit (slides)

MrBrian Registered Member

siljaline Registered Member

lotuseclat79 Registered Member

Rasheed187 Registered Member

Useful Searches