09-05, 12:00–12:30 (Europe/Amsterdam), Second track
In a world where user-mode security is often prioritized, vulnerabilities in kernel drivers pose significant risks and can lead to privilege escalation and other severe system compromises. This presentation offers a thorough guide to identifying and analyzing these vulnerabilities. We will examine the impact of kernel driver vulnerabilities, including their exploitation in real-world attacks and their use by red teams. We will demonstrate methods for building a driver database from diverse sources while filtering for only the most promising drivers.
We will then delve into the most important technical features of kernel drivers such as user-to-kernel communication, driver architecture, and essential functionionality. Finally, we will elaborate on identifying and assessing many common vulnerability types such as heap overflows, handle leaks, and race conditions. Additionally, we will provide some practical advice on setting up research environments, debugging, and automated analysis to get you set up right away. By the end of the presentation, you'll be equipped to start your own kernel driver vulnerability research. Based on our current results, we expect many vulnerabilities are still to be found!
In this talk, we will explore the crucial aspects of finding and exploiting vulnerabilities in kernel drivers, a key area in cybersecurity research. Kernel drivers are core system components, and vulnerabilities in these components can have a large impact on systems. The talk will begin by highlighting the importance of kernel driver vulnerabilities and the impact they can have, demonstrated through real-world examples of malware and threat actor activities.
We will share insights from our own research, revealing the prevalence of vulnerabilities in various drivers and the types of vulnerabilities we've encountered. Attendees will learn about all aspects needed to kick-start vulnerability research in this area. This includes building a driver database, understanding different driver types, knowing which ones are most likely to contain exploitable vulnerabilities and recognizing common vulnerability classes.
The talk will also cover practical aspects of interacting with drivers, including methods for loading them and understanding the communication interfaces between user and kernel space. This knowledge is critical for understanding the attack surface of drivers. Additionally, we will discuss setting up a research environment and several automated tools to streamline the process of vulnerability discovery.
Overall, this talk aims to equip participants with the skills and knowledge needed to start their journey in finding kernel driver vulnerabilities, enhancing their ability to contribute to cybersecurity defenses. Whether you're a beginner or looking to refine your techniques, this session will provide valuable insights into this complex and impactful area of research.
Jan-Jaap Korpershoek is an experienced ethical hacker working at the Adversary Simulation team of Northwave. He blends his experience in the areas of reverse engineering, red teaming and penetration testing to find new and creative ways to test infrastructure and applications. Jan-Jaap has a bachelor in technical computer science and a master in Cyber Security. He has a broad interest in all things computer science related and is always up for an interesting challenge.