▼
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Tuesday, June 09, 2015

How to enable CoreOS to boot on top of iKGT (Intel Kernel Guard Technology) ?

›
Linked to here:  https://01.org/intel-kgt/blogs  or  https://01.org/intel-kgt/blogs/bzhu5/2015/coreos-ikgt <END>

Intel Kernel Guard Technology is released as opensource software

›
See the official site for details: https://01.org/intel-kgt <END>
Monday, April 06, 2015

Common security design issues in privileged hypervisor or in any privileged emulators

›
Recently I've reviewed nearly 100 Xen Security Advisories ( http://xenbits.xen.org/xsa/ ), except some bad security coding practices for...
Monday, January 26, 2015

Control-flow processor exceptions (single-stepping on branches) on control-flow branch instructions (jmp/call/ret)

›
"single-stepping on branches" is processor hardware feature of x86/Intel architecture. When it is enabled, the processor generates...
Friday, January 16, 2015

How to defend against Stack Pivoting attacks on existing 32-bit x86 processor architecture?

›
Stack Pivoting is a common technique widely used by vulnerability exploits to bypass hardware protections like NX/SMEP, or to chain ROP ( Re...
5 comments:
Monday, December 15, 2014

Using LBR (Last Branch Record) feature to detect ret2usr (return-to-user) attack w/ MMU paging structure corruption

›
SMEP (Supervisor Mode Execution Prevention) is a mitigation that aims to prevent the CPU from running code from user-mode while in kernel-mo...
Thursday, December 11, 2014

New security feature - Control Flow Guard (CFG) - available in Visual Studio 2015 Preview

›
This blog announced that  the Preview for Visual Studio 2015 includes a new, work-in-progress feature, called Control Flow Guard (CFG). 
Friday, November 21, 2014

Defending Against ret2dir Attacks (partially) with Virtualization Technology?

›
I was so excited when recently reading the paper ( ret2dir: Rethinking Kernel Isolation ) from  Vasileios P. Kemerlis . This post is basical...

Improve Performance for Separating Kernel and User Address Space with Process-Context Identifiers (PCIDs)

›
This post is not talking about any new idea, just about what I'm thinking..
Tuesday, November 18, 2014

Page Table Structure Corruption Attacks - How to Mitigate it?

›
On x86 and many other processor architectures (with MMU), page tables are critical data structures for address translations. And many hardwa...
Monday, November 17, 2014

Implement software-based SMEP with Non-Execute (NX) bit in page tables to secure kernel/user virtual memory address space.

›
In my previous post , I talked about how to implement a software-based SMEP ( S upervisor Mode Execution Protection ) with virtualization/hy...
10 comments:
Sunday, November 16, 2014

DMA Attacks Against McAfee DeepSafe

›
Rafal Wojtczuk (from Bromium , previously Invisible Things Lab ) presented DMA attacks against DeepSafe. 

Latest researching status of ROP/JOP attacks and defenses

›
Control Flow Hijacking, like ROP, becomes a hot topic in recent years since ever DEP(W^X enforcement) and SMEP were introduced in h/w proces...
Wednesday, November 12, 2014

How to Implement a software-based SMEP(Supervisor Mode Execution Protection) with Virtualization/Hypervisor Technology

›
As my previous post indicated, SMEP is a powerful security feature, and easy to deploy in modern commodity OS. However this feature require...
Saturday, November 08, 2014

What does Transactional Synchronization Extensions (TSX) processor technology mean to vulnerability exploits (e.g. Brute Forcing)?

›
Intel Transactional Synchronization Extensions  (TSX) was introduced since from Haswell processor with adding hardware transactional memory...

Using LBR (Last Branch Record) Feature to Detect IDT-Shadowing-Based Malicious IDT Hooking

›
Thanks to Yushi  who shared a presentation ( ELI: Bare-Metal Performance for I/O Virtualization ) with me. In that hypervisor (ELI), it inno...
Sunday, November 02, 2014

Security OS Design (cont.): Write Protection for Linux Kernel critical data structures (GDT, IDT, syscall table, task_strcture, mm_struct,...)

›
To be continued for previous post , let me review what must be changed in Linux kernel in order to prevent buffer overrun/overflow attacks f...
Wednesday, October 22, 2014

Security OS Kernel Design: an idea to prevent malicious software overwriting the critical system kernel data structures

›
Recently, when reading this paper " HyperSafe - A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity ", an...

Control Flow Integrity (CFI)

›
Traditionally, arbitrary malicious code execution (e.g. caused by buffer overflow, stack or heap manipulation) is one of major threats in co...
Sunday, September 28, 2014

ARM TrustZone (Security Extension) and Virtualization Extension vs x86 Virtualization Technology

›
A typical virtualization system on both x86 and ARM includes three major parts: CPU virtualization Memory virtualization, and  I/O virtu...