Securing The Kernel via Static Binary Rewriting and Program Shepherding

TL;DR

This paper presents a static binary rewriting tool for Windows kernels that monitors control flow transfers to detect and prevent kernel exploits, enhancing security against remote and local privilege escalation attacks.

Contribution

The authors introduce a novel static binary rewriting approach for Windows kernels that enables control flow monitoring without third-party software, improving kernel exploit defenses.

Findings

Effective detection of control flow hijacking attempts.

Prevention of remote kernel exploitation.

Compatibility with multiple Windows versions.

Abstract

Recent Microsoft security bulletins show that kernel vulnerabilities are becoming more and more important security threats. Despite the pretty extensive security mitigations many of the kernel vulnerabilities are still exploitable. Successful kernel exploitation typically grants the attacker maximum privilege level and results in total machine compromise. To protect against kernel exploitation, we have developed a tool which statically rewrites the Microsoft Windows kernel as well as other kernel level modules. Such rewritten binary files allow us to monitor control flow transfers during operating system execution. At this point we are able to detect whether selected control transfer flow is valid or should be considered as an attack attempt. Our solution is especially directed towards preventing remote kernel exploitation attempts. Additionally, many of the local privilege escalation attacks are also blocked (also due to additional mitigation techniques we have implemented). Our tool was tested with Microsoft Windows XP, Windows Vista and Windows 7 (under both virtual and physical machines) on IA-32 compatible processors. Our apparatus is also completely standalone and does not require any third party software.