« first day (3808 days earlier)      last day (1370 days later) » 
01:00 - 19:0019:00 - 00:00

forest
forest
19:31
Hey @MechMK1
@JsupportsPalestine That FreeBSD thing seems to be about emulating the BIOS for a hypervisor, not to protect the kernel but to allow bhyve to run more operating systems?
Anonymous
@forest AH, I didn't check it in its entirety.
Anonymous
I saw similarities in the content of the PDF, figured he was implementing it himself.
forest
forest
He might have been (I just skimmed it), but it's unrelated to virtualization security.
Anonymous
Ah right, gotcha'.
forest
forest
It's about a BSD hypervisor called bhyve which has very few capabilities, so he's working on extending its capabilities. It doesn't protect a running kernel or anything.
Anonymous
19:43
As far as KDP goes, your assertion that static KDP is snakeoil security, I pretty much agree with in entirety.
Anonymous
It doesn't really do anything all that useful. The most useful thing it does is stop people from turning off the HVCI mechanism.
Anonymous
Other than that, totally useless.
Anonymous
I have written a lot of this in my answer but that's the TLDR.
forest
forest
What kernel data structures does it protect?
Anonymous
Well, it's hard to say because Windows is closed source. The one thing I do know it protects is HVCI.
Anonymous
19:45
Other than that, that's... It.
Anonymous
Microsoft are promoting it like it stops code execution, or thats what they want you to believe, it doesn't.
Anonymous
You can still execute and write, you can just only do it in VTL0.
forest
forest
I imagine it works for pre-code execution or more limited writes (not arbitrary writes).
Like the Dynamic KDP seems actually fairly useful.
Anonymous
Yeah, that seems to be the case.
Anonymous
Dynamic KDP is a different thing, I cannot speak to its effectiveness, it seems useful.
Anonymous
19:46
But from my point of view after writing this answer, Static KDP is worthless. Or almost worthless.
Anonymous
And in-fact the technology around the KDP API is what provides the value... Not the API itself.
forest
forest
It prevents overwrites that get into slabs (or whatever Windows calls it) from modifying ones with executable content. Although why Windows needs to make an executable slab in the first place...
Anonymous
It would be nice if I were able to a clear indication of what other kernel data structures Static KDP aims to protect. But based on my research and understanding the only one Microsoft has explicitly called out is the fact that Static KDP protects the HVCI from being overwritten. Thus protecting against unsigned driver loading (which we discussed before).
Anonymous
But TL;DR, it is pretty much security theater.
forest
forest
ah...
I'm sure you could find out what structures it protects if you can examine the EPTs.
Anonymous
19:49
Yeah, you're probably right. But I am not aware of how to do that. I mean, I can look into it.
forest
forest
Not sure either, but there's probably a way. I know you could do it with JTAG, but I have a feeling all boards with VBS of any kind enabled will have JTAG support in the board fused out.
Anonymous
I'll try look into it. I will say, even though I don't think Static KDP is all that useful, this was a very fun exercise.
Anonymous
I am mostly nearly finished with my answer. I want to explain a few more things before I post it, I'll likely finish it tomorrow. With any luck I'll have written it in such a way it is understandable to others to... I did my best at explaining it.
Anonymous
It doesn't help MSFT renames things! That is really quite confusing (I think so).
forest
forest
If you can provide a formal threat model provided by MS (or at least an implied one), that'd be great.
Anonymous
19:52
Yeah, I am going to try and pull together everything I found around threat model which is kinda' dotted amongst videos, article extracts, etc.
forest
forest
Awesome!
Anonymous
Maybe one day someone will come here and explain Dynamic KDP.
Anonymous
It does seem like a useful feature. But I just can't make sense of it...
Anonymous
Perhaps I will try at a later date and then update my answer.
forest
forest
I can understand it.
Dynamic KDP, that is.
It's just W^X, but within the kernel and enforced via EPTs.
Anonymous
19:53
Oh, right. I think you actually explained that before I just forgot.
forest
forest
The whole "secure pool" thing seems like just the way they implemented it.
Anonymous
Well, I think your question was more Static KDP based anyways.
Anonymous
But there is probably room for a dynamic kdp question too :D or just an addition to the current question.
forest
forest
I might open a new question for Dynamic KDP, but I think I do understand it.
But Static KDP... I just can't think of what it'd be really useful for. And if all it's doing is protecting from the occasional buffer overflow to overwrite driver policy structures, why wouldn't regular page table write protection be sufficient? Why involve a hypervisor at all?
From what I can tell, in order for an attacker to change the page tables or disable write protection globally, they'd need to have arbitrary code execution in the first place...
Anonymous
Well, the hypervisor is involved not because it needs to be but because that already exists on Windows.
Anonymous
19:59
So, basically, from what I understand, this is how the technology came.
Anonymous
They introduced the hypervisor, then SLAT then an IOMMU.
Anonymous
With that added, they introduced these "Virtual Secure Modes" (VTL0 and VTL1).
Anonymous
With that added they wanted a way to protect the HVCI from being attacked from VTL0 (which it previously could)
forest
forest
Well SLAT is part of VT-x/AMD-v.
Anonymous
ANd by attacking the HVCI, people were loading unsigned drivers.
forest
forest
20:01
And the IOMMU (VT-d) came first.
Anonymous
So they added this KDP API to stop the HVCI being attacked.
Anonymous
As well as also being able to put keys and hashes inside an even higher level privilege.
Anonymous
Right, yes. Those came at the same time.
Anonymous
My point being that the hypervisor was already there.
forest
forest
Oh do they do that as well? Put keys and the like in protected memory?
Yeah. VBS and everything came after VT-x with EPTs and VT-d2 with IR and x2apic.
Anonymous
20:02
Yeah, they put hashes and Kerberos keys inside VTL1 now.
Anonymous
KDP is nothing more than a set of software APIs to manage all of this.
Anonymous
The technology basically already existed.
forest
forest
Yeah hypervisor-based security is something that's been well known as a concept for ages.
Anonymous
Yeah, so that's pretty much the reason why they use the hypervisor at all. It was the route they were going to take from the beginning of Windows 10. They're just bolting things into it.
Anonymous
Anyways, I am not feeling too well (eek) so I am going to get an early night. Hopefully I don't wake up sick.. Think I am just beat down.
forest
forest
20:07
Every time I get on you're just about to leave. Damn.
Anonymous
Sorry :(
Anonymous
I have not been feeling great lately.
Anonymous
I am getting stressed with everything that is mounting on me and the news doesn't help.
Anonymous
I'll be around longer on the weekend though :D This is the least amount of time I've used my PC in well.... Forever.
forest
forest
Maybe you should take a break from hard work.
Anonymous
20:09
Yeah...
Anonymous
You're probably right.
Anonymous
I will take a small break after I finish this course, I guess.
Anonymous
The good news is that both IDF and Hamas agreed to a ceasefire. The bad news is that the media are still reporting it as if IDF were just responding to Hamas...
Anonymous
Anyways, that's tomorrow's problem... I am gonna go sleep and hopefully wake up repaired.
Anonymous
Goodnight :D
forest
forest
20:14
night!
in Tavern on the Meta on Meta Stack Exchange Chat, 14 mins ago, by forest distrusts StackExchange
No, I'm not an admin on this website I just don't want to be you know abducted cause technically that's IP grabbing which is illegal and this is what it says and it's not making it very clear on who can see it says If you're ever bothered by someone who posts annoying messages, you'll be able to view the IP address from which each message was posted, and block it or pre-approve messages before they're posted. — Akasuki Suzuki 14 mins ago
(linked to a chat transcript because the original message is now deleted)
 
3 hours later…
forest
forest
23:17
Aha! @JsupportsPalestine github.com/intel/vbh
Also, static.sched.com/hosted_files/kvmforum2019/d9/VBH_final.pdf
An example use of VBH (the module linked above): github.com/bitdefender/vbh_sample
Sadly they haven't released the source code for all of the kernel hardening portion, but gave some examples at github.com/intel/vbh/blob/master/sources/kernelhardening.c (protecting e.g. MSRs).
01:00 - 19:0019:00 - 00:00

« first day (3808 days earlier)      last day (1370 days later) »