SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Secure Operating Systems

xerxes avatar
xerxes
18 diapositives · 321 Views · Jul 19, 2014

In this lesson, we delve into various vulnerabilities in operating systems, with a focus on Linux and Windows. We share insights from Chen et al.'s research on Linux kernel vulnerabilities and discuss countermeasures like software fault isolation and memory tagging. We also explore the Shatter attack that demonstrates local privilege escalation in Windows systems. Critical examples highlight the challenges of detecting and fixing these vulnerabilities while emphasizing the need for better defenses. Engage with questions and comments to deepen your understanding.

Secure Operating Systems - slide 1
01 / 18Secure Operating Systems
1 / 17

Télécharger la présentation

Secure Operating Systems
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Secure Operating Systems Lesson B: Let’s go break something

  2. Where are we? • We’ve looked at hardware and software, but I have failed to really show you how to break things… which does rather make the beauty of Multics harder to see • So… let’s look at some examples of OSes breaking

  3. Linux: Overview • Based on Chen et al.’s “Linux kernel vulnerabilities: State-of-the-art defenses and open problems” • They looking at a year (approx) of Linux Kernel vulnerabilities and found the following…

  4. Vulns • Source: Chen et al.

  5. Vulns (cntd) • Source: Chen et al.

  6. What about countermeasures? • Software fault isolation • Code Integrity (such as SecVisor) • User-level drivers • Memory tagging (detect misuse of untrusted inputs) • Uninitialized memory tracking

  7. Semantic Vulnerabilities • Simply not protecting something that needs to be protected • Does it happen? Yes! (See CVE-2010-1641 and many manymore) • Much harder to detect automatically • This is a hard problem!

  8. Another problem: Shatter • From: “Exploiting design flaws in the Win32 API for privilege escalation. Or... Shatter Attacks – How to break Windows” • Shatter is a classic example of how things can go wrong

  9. The Setup • Shatter is a local privilege escalation attack • VirusScan runs as LocalAdministrator • I run as an unprivileged user • Can I get VirusScan to execute code on my behalf?

  10. How it works • First, we get a handle to the higher privileged Window – Windows provides the APIs for this • We now have access to the controls on that window programmatically • Set up the max length for our shell code, and paste it in using Windows Messages

  11. WM_TIMER • Send the window a WM_TIMER message with the location of the code we want to execute (oops) • Bingo! • Let’s discuss for a minute…

  12. Complicated: IA64 sysret • Okay, this one is REALLY quite complicated… let’s take a look • Following: “A Stitch In Time Saves Nine: A Case Of Multiple OS Vulnerability” • Eek!

  13. AMD • From Wojtczuk:

  14. Intel • From Wojtczuk:

  15. Think about it… • From Wojtczuk:

  16. Exploitation • DoS is easy, but code injection is a bit harder but not impossible • What’s worse, it’s hard to fix • The basic idea is how the exception gets kicked off

  17. Things to Do • Read: “Linux kernel vulnerabilities: State-of-the-art defenses and open problems”

  18. Questions & Comments • What do you want to know?