Recent advancements in OS security from Microsoft such as PatchGuard, Driver Signature Enforcement, and SecureBoot have helped curtail once-widespread commodity kernel mode malware such as TDL4 and ZeroAccess. However, advanced attackers have found ways of evading these protections and continue to leverage kernel mode malware to stay one step ahead of the defenders. We will examine the techniques from malware such as DoublePulsar, SlingShot, and Turla that help attackers evade endpoint defenses. We will also reveal a novel method to execute a fully kernel mode implant without hitting disk or being detected by security products. The method builds on publicly available tools which makes it easily within grasp of novice adversaries.
While attacker techniques have evolved to evade endpoint protections, the current state of the art in kernel malware detection has also advanced to hinder these new kernel mode threats. We will discuss these new defensive techniques to counter kernel mode threats, including real-time detection techniques that leverage hypervisors along with an innovative hardware assisted approach that utilizes performance monitoring units. In addition, we will discuss on-demand techniques that leverage page table entry remapping to hunt for kernel malware at scale. To give defenders a leg up, we will release a tool that is effective at thwarting advanced kernel mode threats. Kernel mode threats will only continue to grow in prominence and impact. This talk will provide both the latest attacker techniques in this area, and a new tool to curtail these attacks, proving real-world strategies for immediate implementation.
Speakers
Gabriel Landau
Gabriel Landau is a Principal Software Engineer at Endgame. His past work includes commercial product & DRM evaluation, malware reverse engineering, and offensive security research. His current interests include low-level malware analysis, with a focus on detection and prevention.
Joe Desimone
Joe Desimone is a Senior Malware Researcher at Endgame. He has over five years of experience in the information security industry. In his career, Joe has focused on tracking and countering nation state threats, reverse engineering malware, and developing novel techniques and tools to empower network defenders. Joe holds a BS and MS in Computer Security from RIT
Detailed Presentation:
(Source: Black Hat USA 2018, Las Vegas)
Comments