Bootkit Threats: In Depth Reverse Engineering & Defense. Eugene Rodionov Aleksandr Matrosov
|
|
|
- Dinah Flowers
- 7 years ago
- Views:
Transcription
1 Bootkit Threats: In Depth Reverse Engineering & Defense Eugene Rodionov Aleksandr Matrosov
2 Outline of The Presentation Bootkit technology Why? How? Bootkit design principles Architecture Analysis instrumentation Rovnix bootkit in-depth analysis Infected VBR analysis Infection strategy Bootkit remediation techniques
3 Bootkit technology
4 Bootkit evolution over time o Bootkit PoC evolution: eeye Bootroot (2005) Vbootkit (2007) Vbootkit v2 (2009) Stoned Bootkit (2009) Evilcore x64 (2011) o Bootkit Threats evolution: Win32/Mebroot (2007) Win32/Mebratix (2008) Win32/Mebroot v2 (2009) Win64/Olmarik (2010/11) Win64/Olmasco (2011) Win64/Rovnix (2011/2012)
5 Why? Why there is a return to bootkit technology nowadays Microsoft kernel-mode code signing policy loading unsigned kernel-mode driver High level of stealth there are no malicious files in the file system High degree of survival difficult to detect and remove Ability to disable security software the malware is launched before security software
6 How? Bootkits in the wild: Infecting: MBR (Master Boot Record) VBR (Volume Boot Record) Proof of Concept Bootkits: Infecting UEFI
7 Bootkit design principles
8 Boot process Description of OS boot process: protected mode without paging BIOS initialization MBR VBR bootmgr winload.exe Kernel initialization real mode bootmgr interface protected mode with paging BIOS interface
9 Bootkit Architecture Locating & loading loader code Starter Loader Locating & loading driver Hooking system routines, maintaining hidden storage and injecting payload Driver Payload Performing malicious activities
10 Injecting Payload Process1 Process2 Process3 ProcessN Injection approach APC routines Patching entry point of the executable user-mode kernel-mode Payload1 Payload2 Payload3 PayloadN Kernelmode driver Bootkit hidden storage Payload1 Payload2 Payload3 PayloadN
11 Hidden Storage Architecture Applications Malware payload user-mode address space kernel-mode address space OS File system driver Malicious kernel-mode driver File system interface Physical storage interface OS storage device driver stack Hard drive Hidden FS area
12 Bootkit Analysis Instrumentation
13 Debugging bootkit with Bochs./configure --enable-debugger
14 Debugging bootkit with Bochs IDA Pro debugger Bochs internal debugger interface Bochs Core CPU memory devices Operation System
15 LIVE DEMO
16 Rovnix Reverse Engineering
17
18
19
20
21 Interesting Carberp sample (October 2011)
22 Interesting Carberp sample (October 2011)
23 Rovnix Kit Hidden File Systems Comparison functionality Rovnix.A Carberp with bootkit Rovnix.B VBR modification polymorphic VBR Malware driver storage Driver encryption algorithm custom (ROR + XOR) custom (ROR + XOR) custom (ROR + XOR) Hidden file system FAT16 modification File system encryption algorithm RC6 modification FAT16 modification RC6 modification
24 Rovnix Architecture Dropper Infected VBR Kernel-mode driver x86 Payload x86 Kernel-mode driver x64 Payload x64
25 Installation Into the System Check administrative privileges Check OS version Locate free space on the hard drive to store kernel-mode driver & hidden FS image Store the driver & hidden FS image in the located area. Overwrite bootstrap code of the active partition with malicious one
26 Callgraph of Bootkit Installation Routine
27 VBR Code Information VBR is responsible for loading OS boot components (bootmgr, BCD, etc.). VBR Bootstrap code (IPL) Partition data 1 sector NTFS bootstrap code (15 sectors) NTFS Boot Sector (Volume Boot Record) JMP OEM ID BIOS Parameter Block (BPB) Extended BPB (EBPB) Boot Code Signature [3 b] [8 b] [25 b] [48 b] [426 b] [2 b]
28 Rovnix Polymorphic VBR Polymorphic decryptor Encrypted malicious VBR Polymorphic decryptor Basic block 1 Basic block 2 Basic block 3 Compressed original VBR... Basic block N...
29 Rovnix Polymorphic VBR Polymorphic decryptor Encrypted malicious VBR Polymorphic decryptor Basic block 1 Basic block 2 Basic block 3 Compressed original VBR... Basic block N...
30 Decrypted VBR code Hook BIOS int 13h handler intercept hard drive I/O requests patch bootmgr system module Hook BIOS int 15h handler intercept memory map requests protect its memory location Decompress & Restore Original VBR continue normal boot process
31 Hooking BIOS int 15h Handler Used by operating system to query system address map. System memory Abused by malicious VBR to protect its memory region from allocation by OS Protected memory Malicious VBR Interrupt vectors Int 15h handler address Int 13h handler address
32 Surviving Execution Mode Switching To be able to survive processor execution mode switching the malware: detects execution mode switching operation in bootmgr patches bootmgr right before switching into protected mode copies itself over the last half of IDT (which isn t used by OS)
33 Surviving Execution Mode Switching To be able to survive processor execution mode switching the malware: detects execution mode switching operation in bootmgr patches bootmgr right before switching into protected mode copies itself over the last half of IDT (which isn t used by OS)
34 Surviving Execution Mode Switching To be able to survive processor execution mode switching the malware: detects execution mode switching operation in bootmgr patches bootmgr right before switching into protected mode copies itself over the last half of IDT (which isn t used by OS)
35 Surviving Execution Mode Switching To be able to survive processor execution mode switching the malware: detects execution mode switching operation in bootmgr patches bootmgr right before switching into protected mode copies itself over the last half of IDT (which isn t used by OS)
36 Loading Kernel-mode Driver To be able to load unsigned kernel-mode driver Rovnix: Waits until kernel-mode memory manager is properly initialized: Sets up hardware breakpoint Allocates memory buffer in kernel-mode address space to store the driver: Calls BlAllocateAlignedDescriptor system routine to allocate memory buffer Inserts corresponding structure in BootDriverList of KeLoaderBlock. The driver receives control during boot start drivers initialization
37 LIVE DEMO
38 Hidden Storage Layout Rovnix bootkit employs modification of FAT16 for hidden partition Hidden partition & kernel-mode driver are written either: before first partition on the disk if there is more than 2000 (1 Mb) free sectors In the end of the hard drive otherwise MBR VBR Bootstrap Code File System Data Before Infecting Compressed Data After Infecting MBR VBR Malicious Code Bootstrap Code File System Data Hidden Partition Malicious Unsigned Driver NTFS bootstrap code (15 sectors)
39 Hidden Storage Layout Rovnix bootkit employs modification of FAT16 for hidden partition Hidden partition & kernel-mode driver are written either: before first partition on the disk if there is more than 2000 (1 Mb) free sectors In the end of the hard drive otherwise MBR VBR Bootstrap Code File System Data Before Infecting Compressed Data After Infecting MBR VBR Malicious Code Bootstrap Code File System Data Hidden Partition Malicious Unsigned Driver NTFS bootstrap code (15 sectors)
40 Self-defense Mechanisms To be able to protect VBR & Hidden file system Rovnix bootkit hooks IRP_MJ_INTERNAL_DEVICE_CONTROL handler: \Device\ Harddisk0\DR0 DriverObject Storage miniport driver object Attached to... Attached to MajorFunction IRP_MJ_INTERNAL_DEVICE_CONTROL Lowest device object
41 Self-defense Mechanisms To be able to protect VBR & Hidden file system Rovnix bootkit hooks IRP_MJ_INTERNAL_DEVICE_CONTROL handler: \Device\ Harddisk0\DR0 DriverObject Storage miniport driver object Attached to... Attached to MajorFunction IRP_MJ_INTERNAL_DEVICE_CONTROL Lowest device object
42 Hidden File System Reader
43 Hidden File System Reader
44 LIVE DEMO
45 Bootkit countermeasures
46 Problem Description Untrusted platform problem: protected mode without paging BIOS initialization MBR VBR bootmgr winload.exe Kernel initialization real mode bootmgr interface protected mode with paging BIOS interface Point of Attack OS kernel Non boot-start kernel-mode drivers Pre boot firmware Bootmgr OS loader OS kernel dependencies Boot-start drivers
47 Bootkits & GPT Disks There is no MBR & VBR code which is executed in GPT disks Bootkits in-the-wild aren t applicable to GPT disks Protective MBR Primary GUID partition Table Primary GUID partitions Backup GUID partition Table Primary GUID Partition Table Header GUID Partition entry 1 GUID Partition entry 1 GUID Partition entry 1 GUID Partition entry 1... GUID Partition entry 1 GUID Partition Table Entry Partition type GUID Unique partition GUID First LBA Last LBA Attributes flags Partition name
48 Bootkits & GPT Disks UEFI Firmware UEFI Boot Manager Windows Boot Manager (bootmgr.efi) Windows OS Loader (winload.efi) OS Kernel (ntoskrnl.exe)
49 Windows 8 Security Features Security enhancements introduced in Windows 8: Secure boot technology Employing UEFI secure boot in conjunction with TPM Early anti-malware launch module Allows antimalware software start before any other thirdparty components
50 Secure Boot Secure boot prevents running an unknown OS loader: UEFI will verify OS loader The key for verification is stored inside TPM Trust anchor TPM OS kernel Non boot-start kernel-mode drivers UEFI Bootmgr OS loader OS kernel dependencies Boot-start drivers
51 Early antimalware launch module Antimalware component receives control before any other third-party software at boot time. Windows OS loader Kernel initialization Early antimalware module Third-party drivers
52 Conclusion Bootkit technology allows malware to load unsigned kernel-mode driver and achieve high degree of stealth in the system The main target of bootkit infection are MBR & VBR Rovnix is a first known bootkit infecting VBR The most interesting features of the latest modification of Rovnix bootkit are: Polymorphic infected VBR Hidden Storage There are additional security features introduced in Windows 8 OS: Early antimalware launch module Secure Boot
53 References Rovnix Reloaded: new step of evolution TDL4 reloaded: Purple Haze all in my brain Bootkit Threat Evolution in The Evolution of TDL: Conquering x64 Modern bootkit trends: bypassing kernel-mode signing policy King of Spam: Festi botnet analysis
54 Moscow, Russia November
55
56 Thank you for your attention! Aleksandr Eugene
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK Email rodionov@eset.com; alexander.matrosov@ intel.com; david.harley.ic@eset.com
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009 Agenda Part 1: Introduction (~5 ) Infection
Hi and welcome to the Microsoft Virtual Academy and
Hi and welcome to the Microsoft Virtual Academy and 2012 Microsoft Corporation 1 the start of the Windows 8 Security Insights training. My name is Milad Aslaner I m part of the Premier Field Engineering
A Hypervisor IPS based on Hardware assisted Virtualization Technology
A Hypervisor IPS based on Hardware assisted Virtualization Technology 1. Introduction Junichi Murakami (murakami@fourteenforty.jp) Fourteenforty Research Institute, Inc. Recently malware has become more
Session ID: Session Classification:
Session ID: Session Classification: Protecting Data with Encryption Access Control Protect Sensitive Data Protect and Manage Threats Groundbreaking Malware Resistance Protects the client, data, and corporate
ERNW Newsletter 42 / December 2013
ERNW Newsletter 42 / December 2013 Dangers of Disabled Pre-Boot Authentication in Corporate Environments: Attacking Check Point s Full Disk Encryption with Activated WIL Version: 1.1 Date: 12/16/2013 Author(s):
The PC Boot Process - Windows XP.
The PC Boot Process - Windows XP. Power supply switched on. The power supply performs a selftest. When all voltages and current levels are acceptable, the supply indicates that the power is stable and
McAfee Deep Safe. Security beyond the OS. Kai-Ping Seidenschnur Senior Security Engineer. October 16, 2012
McAfee Deep Safe Security beyond the OS Kai-Ping Seidenschnur Senior Security Engineer October 16, 2012 Intel/McAfee Initiatives: epo Deep Command and Deep Defender McAfee epo Deep Command Security Management
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Security Policy for FIPS 140 2 Validation
BitLocker Windows OS Loader Security Policy for FIPS 140 2 Validation BitLocker Windows OS Loader (winload) in Microsoft Windows 8.1 Enterprise Windows Server 2012 R2 Windows Storage Server 2012 R2 Surface
UEFI Implications for Windows Server
presented by UEFI Implications for Windows Server Taipei UEFI Plugfest March 18-22, 2013 Presented by Arie van der Hoeven (Microsoft Corporation) Updated 2011-06-01 Taipei UEFI Plugfest March 2013 www.uefi.org
VBootKit 2.0 - Attacking Windows 7 via Boot Sectors
VBootKit 2.0 - Attacking Windows 7 via Boot Sectors HITB-Dubai 2009 2009-4-23 Nitin Kumar Security Researcher nitin@nvlabs.in Vipin Kumar Security Researcher vipin@nvlabs.in What we do? Analysing malware
Trustworthy Computing
Stefan Thom Senior Software Development Engineer and Security Architect for IEB, Microsoft Rob Spiger, Senior Security Strategist Trustworthy Computing Agenda Windows 8 TPM Scenarios Hardware Choices with
Windows Server 2008 R2 Boot Manager Security Policy For FIPS 140-2 Validation
Boot Manager Security Policy Windows Server 2008 R2 Boot Manager Security Policy For FIPS 140-2 Validation v 1.3 6/8/11 1 INTRODUCTION... 1 1.1 Cryptographic Boundary for BOOTMGR... 1 2 SECURITY POLICY...
Frontiers in Cyber Security: Beyond the OS
2013 DHS S&T/DoD ASD (R&E) CYBER SECURITY SBIR WORKSHOP Frontiers in Cyber Security: Beyond the OS Clear Hat Consulting, Inc. Sherri Sparks 7/23/13 Company Profile CHC was founded in 2007 by S. Sparks
MBR and EFI Disk Partition Systems
MBR and EFI Disk Partition Systems Brought to you by www.rmroberts.com Computer technology is constantly evolving. The hard disk drive partition system has become quite complicated in recent years because
Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs
Code Injection From the Hypervisor: Removing the need for in-guest agents Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs SADE: SteAlthy Deployment and Execution Introduction
Introducing Ring -3 Rootkits
Introducing Ring -3 Rootkits Alexander Tereshkin and Rafal Wojtczuk Black Hat USA, July 29 2009 Las Vegas, NV 1 Introducing Ring -3 2 Getting there 3 Writing useful Ring -3 rootkits A Quest to Ring -3
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking Today s bank customers can perform most of their financial activities online. According to a global survey
Hardware Backdooring is practical. Jonathan Brossard (Toucan System) Florentin Demetrescu (Cassidian)
Hardware Backdooring is practical Jonathan Brossard (Toucan System) Florentin Demetrescu (Cassidian) DISCLAIMER We are not «terrorists». We won't release our PoC backdoor. The x86 architecture is plagued
Patterns for Secure Boot and Secure Storage in Computer Systems
Patterns for Secure Boot and Secure Storage in Computer Systems Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy Horst Görtz Institute for IT Security, Ruhr-University Bochum, Germany {hans.loehr,ahmad.sadeghi,marcel.winandy}@trust.rub.de
Hardware Enabled Zero Day Protection
Hardware Enabled Zero Day Protection Cyber Security Division 2012 Principal Investigators Meeting October 11, 2012 Paul A. Rivera President/CEO Def-Logix, Inc. Email: privera@def-logix.com Phone: 210-478-1369
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Proactive Rootkit Protection Comparison Test
Proactive Rootkit Protection Comparison Test A test commissioned by McAfee and performed by AV-TEST GmbH Date of the report: February 2 th, 213 Executive Summary In January 213, AV-TEST performed a comparative
Windows Kernel Internals for Security Researchers
Windows Kernel Internals for Security Researchers Overview This course takes a deep dive into the internals of the Windows kernel from a security perspective. Attendees learn about behind the scenes working
Implementation and Implications of a Stealth Hard-Drive Backdoor
March 3rd 2014 OSSIR/JSSI 2014 Paper first presented at ACSAC 2013 Awarded Best Student Paper Award Implementation and Implications of a Stealth Hard-Drive Backdoor Jonas Zaddach Davide Balzarotti Aure
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement. MJ0011 th_decoder@126.com
Using a Patched Vulnerability to Bypass Windows 8 x64 Driver Signature Enforcement MJ0011 th_decoder@126.com Agenda Background A Patched Vulnerability: CVE-2010-4398 Bypass DSE on Windows7 x64 Windows8
How To Stop A Malicious Process From Running On A Hypervisor
Hypervisor-Based Systems for Malware Detection and Prevention Yoshihiro Oyama ( 大 山 恵 弘 ) The University of Electro-Communications ( 電 気 通 信 大 学 ), Tokyo, Japan This Talk I introduce two hypervisor-based
Hypervisor-Based, Hardware-Assisted System Monitoring
Horst Görtz Institute for IT-Security, Chair for System Security VMRay GmbH Hypervisor-Based, Hardware-Assisted System Monitoring VB2013 October 2-4, 2013 Berlin Carsten Willems, Ralf Hund, Thorsten Holz
Process Description and Control. 2004-2008 william stallings, maurizio pizzonia - sistemi operativi
Process Description and Control 1 Process A program in execution (running) on a computer The entity that can be assigned to and executed on a processor A unit of activity characterized by a at least one
BitLocker Drive Encryption Hardware Enhanced Data Protection. Shon Eizenhoefer, Program Manager Microsoft Corporation
BitLocker Drive Encryption Hardware Enhanced Data Protection Shon Eizenhoefer, Program Manager Microsoft Corporation Agenda Security Background BitLocker Drive Encryption TPM Overview Building a BitLocker
Virtual Machine Security
Virtual Machine Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ 1 Operating System Quandary Q: What is the primary goal
UEFI on Dell BizClient Platforms
UEFI on Dell BizClient Platforms Authors: Anand Joshi Kurt Gillespie This document is for informational purposes only and may contain typographical errors and technical inaccuracies. The content is provided
Windows 8 Security. Security Response. November, 2011
November, 2011 Introduction You have almost certainly heard by now about the exciting changes from Microsoft planned for Windows 8. If you have followed the press or, better yet, played with the Windows
Guardian: Hypervisor as Security Foothold for Personal Computers
Guardian: Hypervisor as Security Foothold for Personal Computers Yueqiang Cheng, Xuhua Ding Singapore Management University (SMU) The International Conference on Trust & Trustworthy Computing (TRUST),
ZENworks 11 Support Pack 4 Full Disk Encryption Agent Reference. May 2016
ZENworks 11 Support Pack 4 Full Disk Encryption Agent Reference May 2016 Legal Notice For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government
Mount & Boot Center. Contents
Contents 1. About the.................................................................................. 2 2. How to start.....................................................................................................
LASTLINE WHITEPAPER. In-Depth Analysis of Malware
LASTLINE WHITEPAPER In-Depth Analysis of Malware Abstract Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse).
Inside Windows Rootkits
Chris Ries Security Research Engineer VigilantMinds Inc. 4736 Penn Avenue Pittsburgh, PA 15224 info@vigilantminds.com Introduction Although they have been around for quite some time, rootkits have become
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin Lab 2: - prepare
PC Boot Considerations for Devices >8GB
X3T10 95-321 Rev 1 PC Boot Considerations for Devices >8GB Overview This is a draft of a document proposed in the System Issues Study Group meeting held on 7/12/95 in Colorado Springs. It is intended to
A+ Practical Applications Solution Key
A+ Practical Applications Solution Key Module 1 Assignment: Introducing Microsoft Windows - answer the following questions: 1. What attributes are available in the NTFS file system that are not available
HP Z220, Z420, Z620, and Z820 Workstations Microsoft Windows XP Installation Reference Guide
HP Z220, Z420, Z620, and Z820 Workstations Microsoft Windows XP Installation Reference Guide Important information on installing the Windows XP Operating System on HP Z220, Z420, Z620 and Z820 Workstations.
Chapter 5: Fundamental Operating Systems
Chapter 5: Fundamental Operating Systems IT Essentials: PC Hardware and Software v4.1 Chapter5 2007-2010 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Chapter 5 Objectives 5.1 Explain the purpose
A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows
: Managing, Maintaining, and Troubleshooting, 5e Chapter 3 Installing Windows Objectives How to plan a Windows installation How to install Windows Vista How to install Windows XP How to install Windows
Example of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices
350 PIERS Proceedings, Cambridge, USA, July 5 8, 2010 Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices Dung Vu Pham 1, Malka N. Halgamuge 2, Ali Syed 1, and Priyan
Application research and analysis based on Bitlocker-Data protection & Secure Start-up of Windows 7
Available online www.jocpr.com Journal of Chemical and Pharmaceutical Research, 2014, 6(7):491-497 Research Article ISSN : 0975-7384 CODEN(USA) : JCPRC5 Application research and analysis based on Bitlocker-Data
ZeroAccess. James Wyke. SophosLabs UK
ZeroAccess James Wyke SophosLabs UK Abstract ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the most widespread threats in the current malware ecosystem. ZeroAccess ability
Self Protection Techniques in Malware
DSIE 10 5 th Doctoral lsymposium on Informatics Engineering i January 28 29, 2010 Porto, Portugal Self Protection Techniques in Malware Tiago Santos Overview Introduction Malware Types Why Self Protection?
GPT hard Disk Drives. For HP Desktops. Abstract. Why GPT? April 2011. Table of Contents:
GPT hard Disk Drives For HP Desktops April 2011 Table of Contents: Abstract... 1 Why GPT?... 1 GPT vs MBR... 2 Bootable vs Data Drives and UEFI BIOS... 4 OS Support... 6 Storage Driver Support... 6 Imaging
University of Rochester Sophos SafeGuard Encryption for Windows Support Guide
Sophos SafeGuard Encryption for Windows Support Guide University Information Technology Security & Policy September 15, 2015 Version Date Modification 1.0 September 15, 2015 Initial guide 1.1 1.2 1.3 1.4
USB Bare Metal Restore: Getting Started
USB Bare Metal Restore: Getting Started Prerequisites Requirements for the target hardware: Must be able to boot from USB Must be on the same network as the Datto device Must be 64 bit hardware Any OSs
An Implementation Of Multiprocessor Linux
An Implementation Of Multiprocessor Linux This document describes the implementation of a simple SMP Linux kernel extension and how to use this to develop SMP Linux kernels for architectures other than
UNCLASSIFIED Version 1.0 May 2012
Secure By Default: Platforms Computing platforms contain vulnerabilities that can be exploited for malicious purposes. Often exploitation does not require a high degree of expertise, as tools and advice
Introduction to BitLocker FVE
Introduction to BitLocker FVE (Understanding the Steps Required to enable BitLocker) Exploration of Windows 7 Advanced Forensic Topics Day 3 What is BitLocker? BitLocker Drive Encryption is a full disk
SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES
SECURE IMPLEMENTATIONS OF CONTENT PROTECTION (DRM) SCHEMES ON CONSUMER ELECTRONIC DEVICES Contents Introduction... 3 DRM Threat Model... 3 DRM Flow... 4 DRM Assets... 5 Threat Model... 5 Protection of
Dual-boot Windows 10 alongside Windows 8
Most of the people are very much interested to install the newly launched Operating System Windows 10 on their devices. But, it is not recommended to directly use Windows 10 as the primary OS because it
HP Compaq dc7800p Business PC with Intel vpro Processor Technology and Virtual Appliances
HP Compaq dc7800p Business PC with Intel vpro Processor Technology and Virtual Appliances Introduction............................................................ 2 What is Virtualization?....................................................2
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Lecture Overview. INF3510 Information Security Spring 2015. Lecture 4 Computer Security. Meaningless transport defences when endpoints are insecure
Lecture Overview INF3510 Information Security Spring 2015 Fundamental computer security concepts CPU and OS kernel security mechanisms Virtualization Memory Protection Trusted computing and TPM Lecture
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
File Disinfection Framework (FDF) Striking back at polymorphic viruses
File Disinfection Framework (FDF) Striking back at polymorphic viruses 1 CONTENTS Introduction 3 File Disinfection Framework (FDF) 4 Disinfection solution development today 5 Goals 6 Target audience 6
Attacking Hypervisors via Firmware and Hardware
Attacking Hypervisors via Firmware and Hardware Alex Matrosov (@matrosov), Mikhail Gorobets, Oleksandr Bazhaniuk (@ABazhaniuk), Andrew Furtak, Yuriy Bulygin (@c7zero) Advanced Threat Research Agenda Hypervisor
Windows8 Internals, Sixth Edition, Part 1
Microsoft Windows8 Internals, Sixth Edition, Part 1 Mark Russinovich David A. Solomon Alex lonescu Windows Internals, Sixth Edition, Part i Introduction xvii Chapter 1 Concepts and Tools 1 Windows Operating
www.securityxploded.com
Disclaimer The Content, Demonstration, Source Code and Programs presented here is "AS IS" without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the
Windows Server Virtualization & The Windows Hypervisor
Windows Server Virtualization & The Windows Hypervisor Brandon Baker Lead Security Engineer Windows Kernel Team Microsoft Corporation Agenda - Windows Server Virtualization (WSV) Why a hypervisor? Quick
OS Security. Malware (Part 2) & Intrusion Detection and Prevention. Radboud University Nijmegen, The Netherlands. Winter 2015/2016
OS Security Malware (Part 2) & Intrusion Detection and Prevention Radboud University Nijmegen, The Netherlands Winter 2015/2016 A short recap Different categories of malware: Virus (self-reproducing, needs
How to Secure Infrastructure Clouds with Trusted Computing Technologies
How to Secure Infrastructure Clouds with Trusted Computing Technologies Nicolae Paladi Swedish Institute of Computer Science 2 Contents 1. Infrastructure-as-a-Service 2. Security challenges of IaaS 3.
Malicious Programs. CEN 448 Security and Internet Protocols Chapter 19 Malicious Software
CEN 448 Security and Internet Protocols Chapter 19 Malicious Software Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken
Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? Currently a security researcher at Synopsys, working on application security tools and Coverity s static analysis
Fastboot Techniques for x86 Architectures. Marcus Bortel Field Application Engineer QNX Software Systems
Fastboot Techniques for x86 Architectures Marcus Bortel Field Application Engineer QNX Software Systems Agenda Introduction BIOS and BIOS boot time Fastboot versus BIOS? Fastboot time Customizing the boot
Spyware Analysis. jan.monsch@csnc.ch. Security Event - April 28, 2004 Page 1
Spyware Analysis jan.monsch@csnc.ch Security Event - April 28, 2004 Page 1 Content Definition & types of spyware Statistics Hooks Static vs. dynamic software analysis Test environment for spyware Analysis
Creating a More Secure Device with Windows Embedded Compact 7. Douglas Boling Boling Consulting Inc.
Creating a More Secure Device with Windows Embedded Compact 7 Douglas Boling Boling Consulting Inc. About Douglas Boling Independent consultant specializing in Windows Mobile and Windows Embedded Compact
A+ Guide to Managing and Maintaining Your PC, 7e. Chapter 16 Fixing Windows Problems
A+ Guide to Managing and Maintaining Your PC, 7e Chapter 16 Fixing Windows Problems Objectives Learn what to do when a hardware device, application, or Windows component gives a problem Learn what to do
Chapter 5 Cloud Resource Virtualization
Chapter 5 Cloud Resource Virtualization Contents Virtualization. Layering and virtualization. Virtual machine monitor. Virtual machine. Performance and security isolation. Architectural support for virtualization.
Supply Chain (In-) Security
Supply Chain (In-) Security Graeme Neilson & Enno Rey Contact us: graeme@aurasoftwaresecurity.co.nz, erey@ernw.de Graeme & Enno Graeme Neilson Security Consultant & Researcher Networking, Reverse engineering,
Trends in Zero-Day Kernel Exploits and Protection 2015
Trends in Zero-Day Kernel Exploits and Protection 2015 Overview of Key Protection Technologies and Their Limitations in Dealing With Zero-Day Kernel Attacks Executive Summary Legacy security solutions
Storage Class Memory Support in the Windows Operating System Neal Christiansen Principal Development Lead Microsoft nealch@microsoft.
Storage Class Memory Support in the Windows Operating System Neal Christiansen Principal Development Lead Microsoft nealch@microsoft.com What is Storage Class Memory? Paradigm Shift: A non-volatile storage
Introduction. Current personal firewalls are focused on combating usermode malware. Overview. What about protection against rootkits?
Introduction Current personal firewalls are focused on combating usermode malware What about protection against rootkits? Overview i386 Windows NT+ network subsystem overview What malware authors usually
Microsoft Windows Internals, Fourth Edition: Microsoft Windows Server 2003, Windows XR and Windows 2000
Microsoft* Microsoft Windows Internals, Fourth Edition: Microsoft Windows Server 2003, Windows XR and Windows 2000 Mark E. Russinovich David A. Solomon Historical Perspective Foreword Acknowledgments Introduction
Ovation Security Center Data Sheet
Features Scans for vulnerabilities Discovers assets Deploys security patches transparently Allows only white-listed applications to run in workstations Provides virus protection for Ovation Windows workstations
Network Incident Report
To submit copies of this form via facsimile, please FAX to 202-406-9233. Network Incident Report United States Secret Service Financial Crimes Division Electronic Crimes Branch Telephone: 202-406-5850
LSN 10 Linux Overview
LSN 10 Linux Overview ECT362 Operating Systems Department of Engineering Technology LSN 10 Linux Overview Linux Contemporary open source implementation of UNIX available for free on the Internet Introduced
Penetration Testing Windows Vista TM BitLocker TM
Penetration Testing BitLocker TM Drive Encryption Douglas MacIver Penetration Engineer System Integrity Group, Corporation Hack In The Box 2006/09/21 2006 Corporation. All rights reserved. Trustworthy
Windows Internals, Fifth Edition
Windows Internals, Fifth Edition Mark E. Russinovich David A. Solomon with Alex lonescu Foreword xix Acknowledgments " xxi Introduction xxiii 1 Concepts and Tools 1 Windows Operating System Versions 1
BM482E Introduction to Computer Security
BM482E Introduction to Computer Security Lecture 7 Database and Operating System Security Mehmet Demirci 1 Summary of Lecture 6 User Authentication Passwords Password storage Password selection Token-based
Attacking Host Intrusion Prevention Systems. Eugene Tsyrklevich eugene@securityarchitects.com
Attacking Host Intrusion Prevention Systems Eugene Tsyrklevich eugene@securityarchitects.com Agenda Introduction to HIPS Buffer Overflow Protection Operating System Protection Conclusions Demonstration
Windows 8: Redmond s Safest Operating System Ever?
Windows 8: Redmond s Safest Operating System Ever? By Chet Wisniewski, Senior Security Advisor, Sophos, 2012 With its Windows 8 operating system Microsoft has introduced sweeping changes to the desktop
[CEH]: Ethical Hacking and Countermeasures
![[CEH]: Ethical Hacking and Countermeasures](/thumbs/25/6744290.jpg "[CEH]: Ethical Hacking and Countermeasures")
[CEH]: Ethical Hacking and Countermeasures Length Audience(s) Delivery Method : 5 days : This course will significantly benefit security officers, auditors, security professionals, site administrators,
Sandbox Roulette: Are you ready for the gamble?
Sandbox Roulette: Are you ready for the gamble? Rafal Wojtczuk rafal@bromium.com Rahul Kashyap rahul@bromium.com What is a sandbox? In computer security terminology, a sandbox is an environment designed
Installing and Upgrading to Windows XP
Installing and Upgrading to Windows XP Although Windows XP was released many years ago, you will still see it in the field and might need to install it as well, or upgrade older Windows computers to XP.
Technical Brief Distributed Trusted Computing
Technical Brief Distributed Trusted Computing Josh Wood Look inside to learn about Distributed Trusted Computing in Tectonic Enterprise, an industry-first set of technologies that cryptographically verify,
CPS221 Lecture: Operating System Structure; Virtual Machines
Objectives CPS221 Lecture: Operating System Structure; Virtual Machines 1. To discuss various ways of structuring the operating system proper 2. To discuss virtual machines Materials: 1. Projectable of
Windows Phone 8 Security Overview
Windows Phone 8 Security Overview This white paper is part of a series of technical papers designed to help IT professionals evaluate Windows Phone 8 and understand how it can play a role in their organizations.
DELL. Unified Server Configurator: IT and Systems Management Overview. A Dell Technical White Paper
DELL A Dell Technical White Paper Unified Server Configurator: IT and Systems Management Overview By Shelli Allgood, Anand Narayanan, Hai Phung, Pritesh Prabhu and Ganesh Viswanathan THIS WHITE PAPER IS
Full Disk Encryption Agent Reference
www.novell.com/documentation Full Disk Encryption Agent Reference ZENworks 11 Support Pack 3 May 2014 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or
Fine-grained covert debugging using hypervisors and analysis via visualization
Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Fine-grained covert debugging using hypervisors and analysis via visualization Daniel A. Quist Lorie M. Liebrock Offensive
CORPORATE AV / EPP COMPARATIVE ANALYSIS
CORPORATE AV / EPP COMPARATIVE ANALYSIS Exploit Evasion Defenses 2013 Randy Abrams, Dipti Ghimire, Joshua Smith Tested Vendors AVG, ESET, F- Secure, Kaspersky, McAfee, Microsoft, Norman, Panda, Sophos,
A Tale of One Software Bypass of Windows 8 Secure Boot. Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk
A Tale of One Software Bypass of Windows 8 Secure Boot Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk and Bootkits Windows 8 Secure Boot Attacking Secure Boot Recommendations Agenda and Bootkits OS Kernel