Over the Edge: Silently Owning Windows 10's Secure Browser Erik - PowerPoint PPT Presentation

Over the Edge: Silently Owning Windows 10's Secure Browser Erik Bosman , Kaveh Razavi, Herbert Bos and Cristiano Giu ff rida

This presentation: Deduplication (software side-channel) 1

This presentation: Deduplication (software side-channel) + Rowhammer (hardware bug) 1

This presentation: Deduplication (software side-channel) + Rowhammer (hardware bug) Exploit MS Edge without software bugs (from JavaScript) 1

This presentation: Deduplication (software side-channel) + Rowhammer a n i h c (hardware bug) a M t s e p u d e D Exploit MS Edge without software bugs (from JavaScript) 1

Outline: Deduplication - leak heap & code addresses JavaScript Array +0.0 +3.141592 42. 1 NaN 2

Outline: Deduplication - leak heap & code addresses chakra.dll JavaScript Array +0.0 +3.141592 42. 1 NaN 2

Outline: Deduplication - leak heap & code addresses - create a fake object 2

Outline: Deduplication - leak heap & code addresses - create a fake object Rowhammer - create reference to our fake object 2

Outline: Deduplication - leak heap & code addresses - create a fake object Rowhammer - create reference to our fake object 2

memory deduplication A method of reducing memory usage. Used in virtualisation environments, (was) also enabled by default on Windows 8.1 and 10. 3

memory deduplication physical memory process A process B 4

memory deduplication physical memory process A process B 4

memory deduplication physical memory process A process B 4

memory deduplication physical memory process A process B 4

memory deduplication physical memory process A process B 4

memory deduplication physical memory process A * * * * * * * * * * * * * * process B * * * * * * * * * * * * * 4

memory deduplication: The Problem Deduplicated memory does not need to have the same origin. (unlike fork(), file-backed memory) An attacker can use deduplication as a side-channel 5

deduplication side-channel attack normal write 6

deduplication side-channel attack normal write write 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * trap to kernel 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * trap copy to whole kernel page 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * trap copy update to whole page kernel page tables 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * trap copy update return to whole page from kernel page tables kernel 6

deduplication side-channel attack normal write write copy on write (due to deduplication) * trap copy update return to whole page from write kernel page tables kernel 6

deduplication side-channel attack A 1-bit side channel which is able to leak data across security boundaries - cross VM - cross-process - leak process data from javascript code 7

having fun with deduplication - covert channel 8

having fun with deduplication - covert channel - detect running software 9

Wordpad memory dump wordpad not running 10

Wordpad memory dump wordpad not running 10

Wordpad memory dump wordpad running 11

Wordpad memory dump wordpad running 11

Signal not as clear as expected, Reason: file backed memory not deduplicated the same way on Windows. 12

Skype memory dump skype not running 13

Skype memory dump skype not running 13

Skype memory dump skype running 14

Skype memory dump skype running 14

For our Edge exploit, a single-bit, page-granularity info leak isn't enough 15

Can we generalize this to leaking arbitrary data, like an ASLR pointer or a password? 16

Challenge 1: The secret we want to leak does not span an entire page. 17

turning a secret into a page secret 18

turning a secret into a page known data secret secret page 18

Challenge 2: The secret we want to leak has too much entropy to leak all at once. 19

primitive #1: alignment probing known data secret secret page 20

primitive #1: alignment probing known data secret secret page 20

primitive #2: partial reuse known data secret secret page 21

primitive #2: partial reuse known data secret secret page 21

Outline: Deduplication - leak heap & code addresses chakra.dll 22

JIT function epilogue (MS Edge) secret mov RCX,0x1c20 mov RAX, [code address] jmp RAX trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap ... known data 23

JIT function epilogue (MS Edge) page mov RCX,0x1c20 mov RAX, [code address] jmp RAX trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap 24

JIT function epilogue (MS Edge) page mov RCX,0x1c20 mov RAX, [code address] jmp RAX trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap trap 24

Outline: Deduplication - leak heap & code addresses chakra.dll 25

Outline: Deduplication - leak heap & code addresses chakra.dll JavaScript Array +0.0 +3.141592 42. 1 NaN 25

We were not able to create pages leaking only part of our heap pointer. 25

Heap pointer entropy in Edge 0x5F48143540 26

Heap pointer entropy in Edge advertised ASLR (24 bit) 0x5F48143540 26

Heap pointer entropy in Edge advertised ASLR (24 bit) 0x5F48143540 non-deterministic bits (+/- 36 bit) 26

Heap pointer entropy in Edge 64G advertised ASLR (24 bit) 0x5F48143540 non-deterministic bits (+/- 36 bit) 26

Heap pointer entropy in Edge 64G advertised ASLR (24 bit) 0x5F48143540 256T non-deterministic bits (+/- 36 bit) 26

Heap pointer entropy in Edge 64G * redundancy advertised ASLR (24 bit) 0x5F48143540 256T non-deterministic bits * redundancy (+/- 36 bit) 26

Slab allocator for JavaScript objects array object 27

Slab allocator for JavaScript objects array array object data 27

Slab allocator for JavaScript objects array array object data Allocated together 27

Slab allocator for JavaScript objects array (almost) object arbirary data Allocated together 27

Slab allocator for JavaScript objects 16K slab 28

Slab allocator for JavaScript objects ... 1M VirtualAlloc() 28

Slab allocator for JavaScript objects 1st after VirtualAlloc() call ... 1M VirtualAlloc() 28

Slab allocator for JavaScript objects 29

Slab allocator for JavaScript objects potential 1M aligned objects 29

Slab allocator for JavaScript objects potential 1M aligned objects 29

Slab allocator for JavaScript objects potential 1M aligned objects 29

Heap pointer entropy in Edge 64G * redundancy advertised ASLR (24 bit) 0x5F48143540 256T non-deterministic bits * redundancy (+/- 36 bit) 30

Heap pointer entropy in Edge 64G * redundancy advertised ASLR (24 bit) 0x5F48100000 entropy after 1MB alignment (20 bit) 30

Heap pointer entropy in Edge 64G * redundancy advertised ASLR (24 bit) 0x5F48100000 4G entropy after 1MB alignment * redundancy (20 bit) 30

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

birthday problem 31

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32

primitive #3: birthday heapspray physical memory attacker memory victim memory 32