Computer Science – Cryptography and Security
Scientific paper
2011-05-10
Computer Science
Cryptography and Security
10 pages, 4 tables
Scientific paper
Recent Microsoft security bulletins show that kernel vulnerabilities are becoming more and more important security threats. Despite the pretty extensive security mitigations many of the kernel vulnerabilities are still exploitable. Successful kernel exploitation typically grants the attacker maximum privilege level and results in total machine compromise. To protect against kernel exploitation, we have developed a tool which statically rewrites the Microsoft Windows kernel as well as other kernel level modules. Such rewritten binary files allow us to monitor control flow transfers during operating system execution. At this point we are able to detect whether selected control transfer flow is valid or should be considered as an attack attempt. Our solution is especially directed towards preventing remote kernel exploitation attempts. Additionally, many of the local privilege escalation attacks are also blocked (also due to additional mitigation techniques we have implemented). Our tool was tested with Microsoft Windows XP, Windows Vista and Windows 7 (under both virtual and physical machines) on IA-32 compatible processors. Our apparatus is also completely standalone and does not require any third party software.
No associations
LandOfFree
Securing The Kernel via Static Binary Rewriting and Program Shepherding does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.
If you have personal experience with Securing The Kernel via Static Binary Rewriting and Program Shepherding, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Securing The Kernel via Static Binary Rewriting and Program Shepherding will most certainly appreciate the feedback.
Profile ID: LFWR-SCP-O-278681