whips1.0 internals

Sapienza University of RomeComputer Science Department

Bruno Vavalà - Whips 1.0 Beta 1

Sicurezza dei Dati e delle Reti 2008/2009Prof. Luigi V. Mancini

Student

Bruno Vavalà([email protected])

Supervisor

Roberto Battistoni([email protected])

Our GoalsWe want to:

Introduce and recall some important system security concepts

Explain a little deeper how the Windows architecture works, what are the security issues and how they can be (almost) solved, even in a not so documented environment, showing 2very powerful techniques

Highlight: the difference between our solution and Winpooch; the improvements we made with respect to the precedentversion of WHIPS

Show how we made WHIPS: the concept, the development, itsalgorithms and data structures

Discuss about the future of Windows and WHIPS


Reference Monitor

Always-invoked

Non-bypassable

Tamper-resistant

Verifiable


Windows Architecture


System Calls

Win32 and Syscall Api

SSDT Protection

Syscall Invocation

KiSystemService

SystemService

Dispatch/ParameterTable

Nt vs. Zw

Ntdll.dll and Ntoskrnl.exe


Trap and Interrupt Masking


Restrictions on code running at DispatchLevel

The first 3 IRQL are software interrupts, the others are hardware interrupts

System Memory Pools

They are all system spacevirtual addresses

System Page Table Entries

Non-paged pool

No page fault

Paged pool

Page fault possible

Memory Manager Fault Handler


System Call Interposition

Syscall hooking(Russinovich et al.)

SSDT update


Detours

Binary Interception SSDT untouched

Trampoline Function Assembly modifications Instruction saving Unconditional jump


Winpooch

Watchdog for Windows

Real-time virus protection

Detours

Hard-coded (Nt)syscallspointers (Windows versiondependent)

Stub saving


WHIPS Concept

ReferenceMonitor

Windows Module

Syscall hooking


Hard-Coded Syscall FREEDOM Previous version

Winpooch

Portability

The disassembler role

Pedasm

“C:\windows\system32\SCIndexes.sci”

Security Issues

Always-opened handles


WHIPS Overview

Windows Driver Developed in C with the Windows

Driver Kit (available for free at www.microsoft.com)

Boot-time loading

Windows Service Developed under the Microsoft .NET

2.0 framework in C# Driver Loading “The man in the middle”

Agent Application Developed under the Microsoft .NET

2.0 framework in C# Communication


whips.sourceforge.net

WHIPS Overview


WHIPS Driver

Windows Driver Model

Kernel-mode activity Registering predefined routines

Installation Boot-time loading

Windows Registry entry

Driver Entry routine

Device creation “\\DosDevices\\WHIPS”

Major Function Setting Create, Close, DeviceControl


I/O Flow Control


I/O Request Packet

Kernel-mode WDM data structure

Communication buffer (by pointer)

DeviceIoControl

IOCTLs

IRP Completion

Asynchronous Procedure Call (APC)

CancelRoutine (noone must be lost)


Syscall Hooking Pointer initialization

Service control message Syscall Index Set data

structures

SSDT Protection Memory mapping (MDL)

Control Register 0 (writeprotection) disabling

SSDT update with Interlockedoperation (multiprocessorsafe)


#define HOOK_SYSCALL(_Function, _Hook, _Orig ) \_Orig = (PVOID) InterlockedExchange( (PLONG)

&MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)

Syscall Wrappers How many

parameters has a syscall ?

One-to-Onecorrespondence

HookPacketstructure

ReferenceMonitorcall


Whips Reference Monitor

Driver state

Log/Allow/Protectionmode

Process image pathretrieving

Logging

HookPacketSerialization

Drv2App Irp completion

ACD Checker


Windows Processes

Executive Process Block structure

Query processinformations

Retrieving processexecutable image path


ACD


Non-pagedmemory usage

ACD Setting

Serialization

CheckHook String

comparisonwith dynamic-programming

FHFU policy

ActionType Implicit_Log

Implicit_Deny

WHIPS Service

Installation

(MS.NET)InstallUtil.exe

Windows Registry entry

Automatic starting

LocalSystem account

ServiceBase Class


Using System.ServiceProcess;

Public class WHIPSService : ServiceBase {

public WHIPSService() {

this.ServiceName = “WhipsService”;

this.CanStop = true;

}

public static void main() {

ServiceBase.Run(new WHIPSService());

}

}

Service Initialization

EventLogger

Driver (un)installation and loading

Communication Manager

Driver initialization

Syscall index set

Exclusive access

Acd set

Shared-read access


Device Opening

The device is a file

IO Manager call

Object Manager call

Device objectsecurity attributes


Service Proxy

Like a reference monitor

Game management

App2Drv/Drv2App IRPs

Overlapped(Asynchronous IO)

Pipe Manager

Communication events


Logger and ACD Controller Win System32 home

directory

ACD Reader/Writer

ACD file (shared-readmode)

LawPacket structure

Fixed fields

Hook Logger

Buffered Write

“Log.txt”


WHIPS Agent Ready-to-run application (pretty ugly interface)

Are you able to design it better?!?!... Do it

Driver Controls Pipe

ACD window Filter Rule insertion/deletion

Monitor Log window Manual/Automatic (timeout

based) refresh

Index field in the Insert Filterwindow


What’s next ?


Distributed WHIPS Global ACD maintenance

Auto Update

Less overhead for “Windows typical users”

Interface: with or without it ?

Better and faster protection

Architectural complexityincreased

(Do you want the barrel to befull and the wife to be drunk?!)


What’s better to do now ? Increasing:

Stability

Reliability (still not so high)

Performance

Security issues

Secure boot

Non-paged memory amount

Authentication betweencomponents

Integrity and availability of usedfiles

Secure channel communication


References Battistoni, Gabrielli, Mancini - An Host Intrusion Prenvention System for Windows Operating Systems,

ESORICS 2004

Bernaschi, Gabrielli, Mancini - REMUS: a Security-Enhanced Operating System, ACM Feb. 2002

Russinovich, Solomon - Microsoft Windows Internals 4th Edition: Microsoft Windows Server, Windows XP and Windows 2000, Microsoft Press, 2004

(NOT YET RELEASED) Russinovich, Solomon - Microsoft Windows Internals 5th Ed.: Microsoft Windows Vista

Nebbet - Windows NT/2000: Native API reference, Macmillan Technical Publishing

Hoglund, Butler - Rootkits: Subverting the Windows Kernel, Addison Wesley Professional, 2005

Oney – Programming The Windows Driver Model, 2nd Edition (2003)

Microsoft Developer Network - msdn.microsoft.com

Windows Driver Development - www.osronline.com

Battistoni / Licameli / Di Biagio Laurea Thesis and other stuff at www.robertobattistoni.it


I WantYOU


If you like WHIPS, you are…

WELCOME

…just ask to Prof. Mancini or Roberto Battistoni

The end

Enjoy WHIPS

For further information visit

whips.sourceforge.net

For any other thing, bugs above all, send an email at

[email protected]

or

[email protected]


whips1.0 internals

Technology

whips bruno vaval whips

hook bruno vaval whips

mancini bruno vaval

denybruno vaval whips

accessbruno vaval whips

precedentversion of

whips overview windows

whips service installation