Bypassing Kernel-Mode Signing Policy - Virus Bulletin

1 Modern Bootkit Trends: Bypassing Kernel-Mode Signing Policy Aleksandr Matrosov Eugene Rodionov Agenda Evolution of payloads and rootkits Bypassing code integrity checks attacking windows Bootloader Modern Bootkit details: Win64/Olmarik Win64/Rovnix What Facilitates Bootkit Attack Vector Evolution of Rootkits Evolution of Rootkit Installation Malicious Web-site Exploit Vulnerability Bypass ASLR/DEP Escape Sandbox Execute Payload Download Rootkit Escalate Local Privilege Install Rootkit Kernel-Mode Exploit Dropper Evolution of Rootkit Features Bypassing HIPS/AV x86 privilege escalation installing rootkit driver Rootkit self-defense surviving reboot injecting payload User mode kernel mode Dropper Evolution of Rootkit Features Bypassing HIPS/AV x86 x64 privilege escalation installing rootkit driver Rootkit self-defense

2 Surviving reboot injecting payload Rootkit Rootkit self-defense surviving reboot injecting payload Bypassing signature check Bypassing MS PatchGuard User mode kernel mode o Kernel-Mode Code Signing Policy : It is difficult to load unsigned Kernel-Mode driver o Kernel-Mode Patch Protection (Patch Guard): SSDT (System Service Dispatch Table) IDT (Interrupt Descriptor Table) GDT (Global Descriptor Table) MSRs (Model Specific Registers) Obstacles for 64-bit Rootkits Bypassing Code Integrity Checks Subverting KMCSP o Abusing vulnerable, signed, legitimate Kernel-Mode driver o Switching off Kernel-Mode code Signing checks by altering BCD data.

3 Abusing WinPE Mode disabling Signing check enabling test Signing o Patching Bootmgr and OS loader Bypassing Integrity Checks USER-MODEB ypassing Integrity Check Techniques kernel -MODETESTSIGNING ONDISABLE INTEGRITY CHECKSVBR(Volume Boot Record)System Boot ModificationMBR(Master Boot Record) attacking windows Bootloader Boot Process Full kernel Initialization MBR First User-Mode Process kernel Services BIOS Services BIOS Initialization Boot Loader Early kernel Initialization Hardware Boot Process with Bootkit Infection load malicious MBR/VBR NT kernel modifications load rootkit driver Code Integrity Check BootmgrOS loader OS kernel dependenciesOS kernelBoot-start driversNon boot-start Kernel-Mode driversEvolution of Bootkits o Bootkit PoC evolution: eEye Bootroot (2005) Vbootkit (2007) Vbootkit v2 (2009) Stoned Bootkit (2009) Evilcore x64 (2011) o Bootkit Threats evolution.

4 Win32/Mebroot (2007) Win32/Mebratix (2008) Win32/Mebroot v2 (2009) Win64/Olmarik (2010/11) Win64/Rovnix (2011) Win64/Olmarik TDL4 Installation on x64 Write FS image,patch MBR and Adjust SE_SHUTDOWN_PRIVILEGE failsuccessCopy itself into%TMP% directoryExploitationMS10-092successfail Createmanifest requesting admin privilegeCallZwRaiseHardErrorto create BSOD Prepare hidden FS image Report to C&CRestart DropperCallShellExecutefailsuccessBCD Elements determining KMCSP (before KB2506014) BCD option Description BcdLibraryBoolean_DisableIntegrityCheck (0x16000020) disables Kernel-Mode code integrity checks BcdOSLoaderBoolean_WinPEMode (0x26000022) instructs kernel to be loaded in preinstallation mode, disabling Kernel-Mode code integrity checks as a byproduct BcdLibraryBoolean_AllowPrereleaseSignatu res (0x16000049) enables test Signing Abusing Win PE mode.

5 TDL4 modules Module name Description mbr (infected) infected MBR loads ldr16 module and restores original MBR in memory ldr16 hooks 13h interrupt to disable KMCSP and substitute with ldr32 or ldr64 ldr32 reads TDL4 s Kernel-Mode driver from hidden file system and maps it into Kernel-Mode address space ldr64 implementation of ldr32 module functionality for 64-bit OS int 13h service provided by BIOS to communicate with IDE HDD controller Load infected MBRI nfected mbr is loadedand executedLoad ldr16 from hidden file systemHook BIOS int 13h handler and restore original MBR ldr16 is loadedand executedLoad VBRO riginal mbr isloaded and executedLoad bootmgrVBR is loaded and executedread

6 BcdBootmgr is loaded and executedLoad EmsEnabled option with WinPeLoad , , , ant etcdistrort /MININT optionCall KdDebuggerInitialize1 from loaded ldr32 or ldr64"Continue kernel initializationLoad drv32 or drv64"Load bootmgrAbusing Win PE mode: Workflow MS Patch (KB2506014) o BcdOsLoaderBoolean_WinPEMode option no longer influences Kernel-Mode code Signing Policy o Size of the export directory of has been changed Win64/Rovnix Win64/Rovnix: Installation Check if already infectedsuccessfailDetermine OSDigit CapacityCheck OSVersionInstall Corresponding Kernel-Mode DriverInitiate System RebootOverwrite Bootstrap Code of Active PartitionVista/Win7 Check Admin PrivilegessuccessWindows 2000 Self Delete and ExitCall ShellExecuteEx API with runas failWindows XPWin64/Rovnix: Bootkit Overview Load MBRLoad VBRLoad bootmgrLoad or modereal mode/protected modeLoad kernel and boot start driversreal mode/protected modeLoad bootstrap codereal mode/protected modereal modeTarget of Win64\RovnixWin64/Rovnix.

7 Infected Partition Layout MBRVBRB ootstrap CodeFile System DataVBRM alicious CodeFile System DataBootstrap CodeMBRNTFS bootstrap code(15 sectors)Before InfectingAfter InfectingMalicious Unsigned DriverCompressedDatao Win64/Rovnix overwrites bootstrap code of the active partition o The malicious driver is written either: before active partition, in case there is enough space to the end of the hard drive, otherwise Win64/Rovnix: Bootkit Details Load MBRMBR is loadedand executedLoad VBRP atch bootmgrVBR is loaded and executedRead BCDR estore bootmgr, hook int1 handler and copy itself over IDTLoad parametersare read from BCDLoad , , , ant etcHook BlImgAllocateImageBufferMap malicious driver into Kernel-Mode address spaceContinue kernel initializationLoad malicious bootstrap codeMalicious bootstrap code is loaded and executedHook BIOS int 13h handler and restore original bootstrap codeOriginal bootstrap code is restoredLoad bootmgrBootmgr is loaded and receives controlWin64/Rovnix.

8 Loading Unsigned Driver o Insert malicious driver in BootDriverList of KeLoaderBlock structure o When kernel receives control it calls entry point of each module in the BootDriverList KeLoaderBlock Malicious Driver Win64/Rovnix: Abusing Debugging Facilities Win64/Rovnix: o hooks Int 1h tracing handles hardware breakpoints (DR0-DR7) o overwrites the last half of IDT (Interrupt Descriptor Table) is not used by OS As a result the malware is able to: set up hooks without patching bootloader components retain control after switching into protected mode Win64/Rovnix: Abusing Debugging Facilities Win64/Rovnix: o hooks Int 1h tracing handles hardware breakpoints (DR0-DR7) o overwrites the last half of IDT (Interrupt Descriptor Table) is not used by OS As a result the malware is able to.

9 Set up hooks without patching bootloader components retain control after switching into protected mode Olmarik vs Rovnix Characteristics Win64/Olmarik Win64/Rovnix Privilege escalation MS10-092 Reboot technique ZwRaiseHardError API ExitWindowsEx API MBR/VBR infection MBR VBR (bootstrap code) Loading driver ZwCreateDriver API Inserting into boot driver list of KeLoaderBlock structure Payload injection KeInitializeApc/ KeInstertQueueApc APIs KeInitializeApc/ KeInstertQueueApc APIs Self-defense Kernel-Mode hooks, MBR monitoring Number of modules 10 2 Stability of code Threat complexity Bootkit Attack Vector Modern Bootkits Approaches o Hooking BIOS 13h Interrupt Handler Win64/Olmarik o Tracing Bootloader Components Win64/Rovnix Deep Boot (PoC) o Stealing a Processor s Core EvilCore (PoC) Tracing Bootloader Components o Microsoft windows Bootloader Components.

10 O Surviving processor s execution mode switching Malware has to retain control after execution mode switching IDT and GDT are most frequently abused data structures Component Name Processor Execution Mode Bootstrap code real mode Bootmgr real mode/protected mode protected mode What Facilitates the Attack Vector? o Untrusted platform problem BIOS controls boot process, but who controls it? The trust of trust is below point of attack BootmgrOS loader OS kernel dependenciesOS kernelBoot-start driversNon boot-start Kernel-Mode driversPre boot firmwarePoint of AttackThe Root of TrustHow to Defend Against the Attack? oTo resist bootkit attacks we need the root of trust be above point of attack: TPM UEFI Secure Boot BootmgrOS loader OS kernel dependenciesOS kernelBoot-start driversNon boot-start Kernel-Mode driversPre boot firmwarePoint of AttackThe Root of Trust Conclusion Bootkits ability to bypass KMCSP Return of old-school techniques MBR infections Win64/Olmarik (TDL4) 1st widely spread Win64 rootkit Win64/Rovnix debugging facilities to subvert KMCSP Untrusted platform facilitates bootkit techniques References The Evolution of TDL: Conquering x64 Defeating x64.