3 ms·

I used to work on Control Flow Integrity (CFI/XFI) research at places like MSR Silicon Valley and VMware, as far back as 2006. Back then, sandboxing a kernel mo

I used to work on Control Flow Integrity (CFI/XFI) research at places like MSR Silicon Valley and VMware, as far back as 2006. Back then, sandboxing a kernel module like ramdisk.sys was doable with a lot of binary rewriting magic, and later with custom LLVM passes, but nowadays it should be a simple matter of compiling the code with clang and the appropriate flags, to completely rule out this type of memory safety error, turning a BSOD into a polite log message and disabling the faulty driver.

pcwalton 2y ago
I mean, this is basically what eBPF accomplishes in Linux.
- gclawes 2y ago
  There is eBPF for Windows: https://github.com/microsoft/ebpf-for-windows https://github.com/microsoft/ebpf-for-windows I'd hope security products in the future leverage this more than custom kernel-mode sensors.
  - capitainenemo 2y ago
    Was discussed on HN last week. Top comment notes the Windows support is still very limited. https://news.ycombinator.com/item?id=41033579 https://news.ycombinator.com/item?id=41033579
    - capitainenemo 2y ago
      ... oh. and the article by Brendan Gregg in the HN link above had the telling phrase: "Once Microsoft's eBPF support for Windows becomes production-ready"
torginus 2y ago
from what I understand, CrowdStrike has essentially put a Turing-complete interpreter for their scripting language into the kernel. I doubt you can do much when something is that general purpose.
- capitainenemo 2y ago
  Do you have more information on that? Hadn't read anything about the CS kernel module running arbitrary code. Was it a factor in the crash? 'course, Microsoft also put turing complete scripting in ring 0 years ago for performance reasons (TTFs - XML/HTML parsing and GUI rendering too - to beat other OSes apparently) and that certainly did lead to exploited vulnerabilities... https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c9174 https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c91... https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-040 https://learn.microsoft.com/en-us/security-updates/securityb... https://www.fortinet.com/blog/threat-research/one-bit-to-rule-them-all-bypassing-windows-10-protections-using-a-single-bit https://www.fortinet.com/blog/threat-research/one-bit-to-rul... https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2011/2639658?redirectedfrom=MSDN https://learn.microsoft.com/en-us/security-updates/SecurityA... https://news.ycombinator.com/item?id=9769099 https://news.ycombinator.com/item?id=9769099 (this comment in particular https://news.ycombinator.com/item?id=9783863 https://news.ycombinator.com/item?id=9783863)
- jacobgorm 2y ago
  It doesn’t matter if you are doing full Fault Isolation with XFI. I recommend reading the paper here https://www.usenix.org/legacy/event/osdi06/tech/full_papers/erlingsson/erlingsson.pdf https://www.usenix.org/legacy/event/osdi06/tech/full_papers/...
- magicalhippo 2y ago
  Lua has been used in Linux kernel modules[1][2]. At least for the ZFS case I know they were satisfied with the ability to limit what the Lua scripts could do to avoid issues. [1]: https://lwn.net/Articles/830154/ https://lwn.net/Articles/830154/ [2]: https://openzfs.github.io/openzfs-docs/man/master/8/zfs-program.8.html https://openzfs.github.io/openzfs-docs/man/master/8/zfs-prog...

pcwalton 2y ago

I mean, this is basically what eBPF accomplishes in Linux.

gclawes 2y ago
There is eBPF for Windows: https://github.com/microsoft/ebpf-for-windows https://github.com/microsoft/ebpf-for-windows I'd hope security products in the future leverage this more than custom kernel-mode sensors.
- capitainenemo 2y ago
  Was discussed on HN last week. Top comment notes the Windows support is still very limited. https://news.ycombinator.com/item?id=41033579 https://news.ycombinator.com/item?id=41033579
  - capitainenemo 2y ago
    ... oh. and the article by Brendan Gregg in the HN link above had the telling phrase: "Once Microsoft's eBPF support for Windows becomes production-ready"

torginus 2y ago

from what I understand, CrowdStrike has essentially put a Turing-complete interpreter for their scripting language into the kernel. I doubt you can do much when something is that general purpose.

capitainenemo 2y ago
Do you have more information on that? Hadn't read anything about the CS kernel module running arbitrary code. Was it a factor in the crash? 'course, Microsoft also put turing complete scripting in ring 0 years ago for performance reasons (TTFs - XML/HTML parsing and GUI rendering too - to beat other OSes apparently) and that certainly did lead to exploited vulnerabilities... https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c9174 https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c91... https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-040 https://learn.microsoft.com/en-us/security-updates/securityb... https://www.fortinet.com/blog/threat-research/one-bit-to-rule-them-all-bypassing-windows-10-protections-using-a-single-bit https://www.fortinet.com/blog/threat-research/one-bit-to-rul... https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2011/2639658?redirectedfrom=MSDN https://learn.microsoft.com/en-us/security-updates/SecurityA... https://news.ycombinator.com/item?id=9769099 https://news.ycombinator.com/item?id=9769099 (this comment in particular https://news.ycombinator.com/item?id=9783863 https://news.ycombinator.com/item?id=9783863)
jacobgorm 2y ago
It doesn’t matter if you are doing full Fault Isolation with XFI. I recommend reading the paper here https://www.usenix.org/legacy/event/osdi06/tech/full_papers/erlingsson/erlingsson.pdf https://www.usenix.org/legacy/event/osdi06/tech/full_papers/...
magicalhippo 2y ago
Lua has been used in Linux kernel modules[1][2]. At least for the ZFS case I know they were satisfied with the ability to limit what the Lua scripts could do to avoid issues. [1]: https://lwn.net/Articles/830154/ https://lwn.net/Articles/830154/ [2]: https://openzfs.github.io/openzfs-docs/man/master/8/zfs-program.8.html https://openzfs.github.io/openzfs-docs/man/master/8/zfs-prog...