Understanding and Defeating Windows 8.1 Kernel Patch Protection

[Nytro]

Understanding and Defeating Windows 8.1 Kernel Patch Protection: It’s all about gong fu! (part 2)

Andrea Allievi

Talos Security Research and Intelligence Group - Cisco Systems Inc.

aallievi@cisco.com

November 20th, 2014 - NoSuchCon

Who am I

• Security researcher, focused on Malware Research

• Work for Cisco Systems in the TALOS Security Research and

Intelligence Group

• Microsoft OSs Internals enthusiast / Kernel system level developer

• Previously worked for PrevX, Webroot and Saferbytes

• Original designer of the first UEFI Bootkit in 2012, and other

research projects/analysis

Agenda

0. Some definitions

1. Introduction to Patchguard and Driver Signing Enforcement

2. Kernel Patch Protection Implementation

3. Attacking Patchguard

4. Demo time

5. Going ahead in Patchguard Exploitation

Download: http://www.nosuchcon.org/talks/2014/D2_01_Andrea_Allievi_Win8.1_Patch_protections.pdf