0x01 – Killing Windows Kernel Mitigations • Hacker News Board

Re: 0x01 – Killing Windows Kernel Mitigations

#11

Post by snvzz » Sat, Dec 14, 2024, 4:50 AM UTC

anyfoo wrote: post #7

cahoot_bird wrote: post #5

Earlier quoted context omitted.

Super interesting. At one point thought control flow guard + DEP/ASLR was suppose to prevent this stuff, guess it can't be prevented nearly completely by now. Sounds like this took a lot of work to figure out, well done. Any comment on reporting to Microsoft or perhaps motivation for this research?

So called "post-exploit" mitigations are practically always only hardening, i.e. making subsequent attacks harder (and fewer). Ideally much harder. But if you want an absolutely, provably (within limits, i.e. halting problem etc.) secure system, you have to eliminate bugs that can lead to any exploitable situations beforehand. In this case for example, that would mean no situation existing that could cause a buffer o…

Capabilities (as implemented in e.g. seL4) is the way to go.

Re: 0x01 – Killing Windows Kernel Mitigations

#12

Post by gavinray » Sat, Dec 14, 2024, 11:57 AM UTC

Expect game cheat developers to adopt this within the week.

Re: 0x01 – Killing Windows Kernel Mitigations

#13

Post by MortyWaves » Sat, Dec 14, 2024, 12:05 PM UTC

It’s good that it is so well written so that Microsoft know how to fix it

Re: 0x01 – Killing Windows Kernel Mitigations

#14

Post by gizmo686 » Sat, Dec 14, 2024, 11:21 PM UTC

snvzz wrote: post #11

anyfoo wrote: post #7

Earlier quoted context omitted.

So called "post-exploit" mitigations are practically always only hardening, i.e. making subsequent attacks harder (and fewer). Ideally much harder. But if you want an absolutely, provably (within limits, i.e. halting problem etc.) secure system, you have to eliminate bugs that can lead to any exploitable situations beforehand. In this case for example, that would mean no situation existing that could cause a buffer o…

Capabilities (as implemented in e.g. seL4) is the way to go.

Capabilities are a better security model, but don't protect you from kernel bugs. Provably correct kernels (such as seL4) do.

Having said that, being a microkernel, seL4 ends up pushing a bunch of potentially buggy code to use space. There are real benefits to that, but if you can exploit the page table server, the system is pretty much yours.