4 ms·
Kernel level drivers have access to user space memory and can see the unencrypted data easily.
by mentat 11y ago
Kernel level drivers have access to user space memory and can see the unencrypted data easily.
- mschuster91 11y agoYeah but they have to find the data first. Given that Chrome with 10 tabs easily eats 2GB of RAM, not an easy task imho.
- leereeves 11y agoAnd they'd have to be updated for every build of Chrome.
- Laforet 11y agoTrue, hence I wrote "for performance reasons or perhaps out of sheer laziness". There are better ways to handle it but they are not always the easiest.
- lazaroclapp 11y agoYou could just intercept the syscalls responsible for writing to the filesystem or executing programs, which I believe is standard AV practice. That way you have two points were you can check a file for viruses, regardless of where it comes from: when it is first written to disk and when it's loaded into memory but hasn't started executing. No need to grab it at the network level at all. It is more likely than the MiTM attack is being added in order to try to catch the traffic generated by an already installed piece of malware. Think a metamorphic trojan who talks to its command and control servers via HTTPS (maybe through a known social networking site). In such case, being able to decrypt the traffic might allow heuristic detection of a piece of malware that would normally avoid file-signature detection.
- munin 11y agoWindows doesn't allow you to "just intercept syscalls" and hasn't for about eight years.
- mschuster91 11y agoHuh? Process Monitor works just fine for me... at least for read-only interception. Don't know if blocking/rewriting syscalls works, though.
- munin 11y agoprocess monitor doesn't work by intercepting system calls, there's a specific API. it's co-operative.
- mschuster91 11y ago#TIL, thanks. I had always thought it operated like strace.
- jb613 11y agointercepting the win32 calls that make the syscall is often enough
- voidlogic 11y agoSince PTRACE (which is one easy way to do this) is part of POSIX, does this mean Windows no longer has a POSIX subsystem? Edit: I guess only Server and Enterprise have POSIX: http://brianreiter.org/2010/08/24/the-sad-history-of-the-microsoft-posix-subsystem/ http://brianreiter.org/2010/08/24/the-sad-history-of-the-mic...
- munin 11y agoptrace is not an easy way to do this... if you try and make an anti-virus or HIPS system based around ptrace you're going to have a very bad day (it's slow, attackers can detect it) the "normal" way this was done was to have your kernel driver replace system call implementations with wrappers that check an alternate security policy. this was done so often that linux implemented loadable security modules (LSM) and then SELinux on top of that, while other systems (grsec, rbac) exist as patches. it was also one of the main causes of system instability on windows because the people that wrote the wrapper functions did not understand nearly as much about the operating system as they thought, and introduced at best crashes and at worst outright vulnerabilities. so microsoft created a technology that stopped people from patching their kernel in that way. okay, in the game of cat-and-also-cat that is systems security in the same kernel-level privilege domain it doesn't "stop" them technically it "deters" them but the protection system is semi-random and silently updates, so if you figure out a way to break it and then later your clever hack is silently broken your customers computer will crash in a way that says "hey this one particular product just broke the rules and you should uninstall it" and why run that risk. they replaced it with a bunch of mature callback APIs that let you do kinda the same thing but with less chance of fucking everything up.
- mentat 11y agoCryptographic data has specific signatures. It really wouldn't be that hard to find. I bet there are off the shelf solutions already. As I remember it Heartbleed key finding used this.