1
00:00:09,080 --> 00:00:11,400
Hey Bill, how do you pronounce your last name?

2
00:00:12,980 --> 00:00:17,500
You're not going to be able to say it, but it's Demir Kapo.

3
00:00:18,420 --> 00:00:20,040
Do you want me to try it?

4
00:00:21,020 --> 00:00:23,660
I mean, I don't care.

5
00:00:23,660 --> 00:00:25,880
I won't get offended if you don't say it.

6
00:00:27,880 --> 00:00:29,940
Looks like we are live.

7
00:00:29,940 --> 00:00:31,580
Yep, we seem to be live.

8
00:00:31,580 --> 00:00:32,180
Alright.

9
00:00:33,220 --> 00:00:34,480
Welcome everyone.

10
00:00:34,480 --> 00:00:37,840
I want to introduce Bill.

11
00:00:37,840 --> 00:00:46,340
Bill, I just tried to do your last name in my head, and I was not successful at it, so I'd like you to say it for everybody if you care to.

12
00:00:47,120 --> 00:00:48,800
Sure, it's Demir Kapo.

13
00:00:48,800 --> 00:00:50,280
Alright, thank you for that.

14
00:00:51,000 --> 00:00:53,780
Instead of me murdering that, I wanted you to try it.

15
00:00:53,780 --> 00:00:59,520
So , Bill did a talk on demystifying modern Windows rootkits.

16
00:00:59,520 --> 00:01:02,880
This is your opportunity to ask questions of Bill.

17
00:01:02,880 --> 00:01:10,100
So, there are a few questions already coming in through the TrackOne Live QA channel.

18
00:01:10,100 --> 00:01:11,740
Let's just go ahead and get started.

19
00:01:12,760 --> 00:01:21,840
Eragon asks, what are the easiest features to find that might reveal a modern rootkit via static analysis?

20
00:01:23,260 --> 00:01:29,120
I think a good place to start for static analysis is going to be the strings.

21
00:01:29,120 --> 00:01:37,760
Because if they leave any debug strings behind, or any unique strings for that specific binary, that's a good thing to maybe add to your signatures.

22
00:01:37,760 --> 00:01:43,340
But another opportunity is going to be the imports of the driver.

23
00:01:43,340 --> 00:01:56,300
For example, if a driver imports a bunch of undocumented functions, that's obviously going to be a little bit more suspicious, given that legitimate drivers tend to try to stick with what's documented and what's stable.

24
00:01:56,300 --> 00:02:06,020
So, if there's any functions that it imports that is not stable, or it's just not really known about, it's something to look at.

25
00:02:06,180 --> 00:02:14,220
So, anything undocumented that's getting pulled in, you're thinking that's going to be your opportunity for shenanigans on that side.

26
00:02:17,060 --> 00:02:17,900
Potential.

27
00:02:18,600 --> 00:02:20,120
What was that, Pasties?

28
00:02:20,120 --> 00:02:21,560
I was just going to say that.

29
00:02:21,560 --> 00:02:22,540
Potential shenanigans.

30
00:02:22,540 --> 00:02:22,980
Potential shenanigans.

31
00:02:22,980 --> 00:02:23,980
It could still be legitimate.

32
00:02:23,980 --> 00:02:24,920
Yeah, that's true.

33
00:02:24,920 --> 00:02:29,860
So, next question from RPTK2015.

34
00:02:29,860 --> 00:02:34,020
Did you actually find any P-key when searching in Greyhat?

35
00:02:34,440 --> 00:02:38,980
Mentioned in the context of using a legitimate key to sign your driver.

36
00:02:39,600 --> 00:02:40,380
Yes.

37
00:02:40,380 --> 00:02:44,560
So, I didn't, of course, crack any of them.

38
00:02:44,560 --> 00:02:47,840
But, I mean, some of them were pretty obviously related to code signing.

39
00:02:47,840 --> 00:02:51,080
For example, I remember one that had, like, code signing in its name.

40
00:02:51,080 --> 00:03:01,320
So, it was pretty clear that these were probably associated with code signing and that it's potentially, if you crack it, you could use it for kernel-mode code signing.

41
00:03:01,320 --> 00:03:08,260
It all depends on the type of certificate it is and, you know, what vendor it came from and stuff like that.

42
00:03:08,260 --> 00:03:16,820
But I have definitely, I can confirm that I've seen potentially viable private keys on Greyhat.

43
00:03:17,340 --> 00:03:21,140
Do you know if there are some keys that are, like, more trusted than others?

44
00:03:21,140 --> 00:03:26,800
Like, some that you can use to sign code but that aren't trusted for, like, kernel-level drivers or something like that?

45
00:03:26,800 --> 00:03:32,600
I assume, like, a Microsoft signing key is, like, gold, but...

46
00:03:32,600 --> 00:03:33,700
Yeah, yeah.

47
00:03:33,700 --> 00:03:40,240
So, usually how it works is that you have, like, these certificate companies that issue these code signing certificates.

48
00:03:40,240 --> 00:03:44,260
And they work with Microsoft to get what's called a cross-signing certificate.

49
00:03:44,260 --> 00:03:54,280
So, this means that Microsoft says, yes, you can use this vendor or this root authority can issue certificates for kernel-mode code signing, just to give you an example there.

50
00:03:54,280 --> 00:03:57,740
And so, what you can do there is you can...

51
00:03:57,740 --> 00:04:04,600
So , some vendors don't have a cross-signing cert and they probably will not work for kernel-mode code signing, while others do.

52
00:04:05,100 --> 00:04:15,340
And so, that's usually the different levels is whether or not the vendor has, you know, deals with Microsoft or has a cross-signing certificate from Microsoft.

53
00:04:16,020 --> 00:04:21,000
Where would I look up that information if I wanted to find out more of a specific cert?

54
00:04:21,860 --> 00:04:27,020
Yeah, so, I think Microsoft has, like, a list of cross-signing certificates on just their...

55
00:04:28,360 --> 00:04:31,180
on MSDN, Microsoft documentation.

56
00:04:31,600 --> 00:04:33,180
Yeah, I found a page here.

57
00:04:33,180 --> 00:04:37,540
It's, like, cross-certificates for kernel-mode code signing.

58
00:04:38,340 --> 00:04:38,940
Gotcha.

59
00:04:38,940 --> 00:04:47,240
Okay, so, a follow-up question on that one would be, what's a good place to find leaked certificates were I to decide I needed one?

60
00:04:48,480 --> 00:04:58,460
Yeah, so, one of the places I mentioned that it's a good place to start for looking for leaked certificates is going to be on the... so, cheating-related forums.

61
00:04:58,460 --> 00:05:01,500
There's quite a few available there that some of them have been out for years.

62
00:05:01,620 --> 00:05:05,980
And I still think that, so, you can use them because a lot of the...

63
00:05:06,260 --> 00:05:12,880
a lot of antivirus simply don't have detections in place for these leaked certificates, even ones that, again, have been out for years.

64
00:05:12,960 --> 00:05:26,060
So, if you're out looking for a leaked certificate, look at game-hacking forums, look, like, search for leaked certificates, and then the game-hacking forums' names, and I can guarantee you that you'll find some.

65
00:05:26,060 --> 00:05:30,220
That's an interesting crossover that totally makes a ton of sense, but I was...

66
00:05:30,220 --> 00:05:33,580
it's not something that would have come to mind if I was ever going to go look for that.

67
00:05:35,380 --> 00:05:42,000
Yeah, especially considering who's making these things and, you know, who builds a lot of the games out there.

68
00:05:43,060 --> 00:05:44,900
RPTK has another question there.

69
00:05:44,900 --> 00:05:50,180
Can you explain a little more about why would the kernel accept a driver signed by an expired certificate?

70
00:05:50,920 --> 00:05:51,720
Yes.

71
00:05:51,720 --> 00:06:01,140
So, when you see a... let's say you go into the digital signatures section of a driver, and you see a certificate there, and it says, this certificate has expired.

72
00:06:01,140 --> 00:06:16,320
Well, what you're seeing there when you go to the digital signatures section is the result of winVerifyTrust, which is a user-mode function, whereas the kernel-mode code-signing policy is completely different, because that's in the kernel.

73
00:06:16,540 --> 00:06:25,760
So what you see returned by the winVerifyTrust function will, generally speaking, not always be what the kernel-mode code-signing policy checks for.

74
00:06:25,760 --> 00:06:30,640
And what I mean by that is, if the winVerifyTrust returns, this is expired, or this is revoked.

75
00:06:31,860 --> 00:06:41,440
Some reasons that a kernel code... that you might be able to still load that driver is because, at the time of signing, it was still valid.

76
00:06:41,720 --> 00:06:55,400
So, even without a timestamp, the kernel just assumes that, since this was at some point signed by a valid certificate, even if the certificate expired, it still should be loaded.

77
00:06:55,780 --> 00:06:57,500
That seems like a problem.

78
00:06:59,140 --> 00:07:00,180
Yeah, it seems like an overstatement.

79
00:07:00,180 --> 00:07:03,240
Yeah, I think it's mostly going to be for compatibility reasons.

80
00:07:03,260 --> 00:07:04,980
That's what I'd, I guess, assume.

81
00:07:04,980 --> 00:07:09,680
But it's speculation, given that I don't work for Microsoft, so I don't know the reasoning behind it.

82
00:07:09,680 --> 00:07:11,480
I'm sure there's a whole lot of history there.

83
00:07:11,980 --> 00:07:14,480
So we have another question.

84
00:07:15,620 --> 00:07:26,480
Trinsky is asking if you have any interest in creating a roadmap of resources, courses, or tutorials on your blog, a person can get to your level of reverse engineering competency.

85
00:07:27,360 --> 00:07:34,800
Yeah, so, for that question, it's mostly, you know, most of my, I guess, knowledge comes from just experience.

86
00:07:34,800 --> 00:07:40,940
And the best recommendation I can really give is to just try things out, you know, do CTFs.

87
00:07:40,940 --> 00:07:43,860
If you want to learn reverse engineering, you know, do the CTS.

88
00:07:44,140 --> 00:07:52,540
And really, you know, one of the ways that I go about, you know, looking for even projects or stuff to do, is I always stay curious.

89
00:07:52,540 --> 00:08:03,860
And what I mean by that is, if I see some weird functionality by a program I'm using, like in real life, on my machine, I will probably quickly try to check underneath of what's happening here.

90
00:08:03,860 --> 00:08:06,040
You know, why is it doing this one weird thing?

91
00:08:06,040 --> 00:08:10,980
And oftentimes, I've found that that can actually lead to other issues, like actual security issues.

92
00:08:10,980 --> 00:08:18,660
So if you're looking for what, you know, what projects to do or what to reverse, it's really just going to be the software you use in your everyday life.

93
00:08:18,660 --> 00:08:27,220
And I don't have any plans to do like a course or something on just, you know, tutorials on how to reverse engineer, for example.

94
00:08:27,220 --> 00:08:38,560
But it's going to be really going out and finding your own projects that you find interesting, so that you'll continue pursuing it.

95
00:08:38,560 --> 00:08:40,360
That's, I guess, the trick I did.

96
00:08:40,360 --> 00:08:45,440
The reason that I was able to learn so fast was because I always did stuff I was always interested in.

97
00:08:45,440 --> 00:08:48,280
And that was, you know, in specifically game hacking.

98
00:08:48,280 --> 00:08:51,360
I love games, and I'm bad at games.

99
00:08:51,360 --> 00:09:00,120
So I had a, you know, self-interest to continue reverse engineering these games, and figuring out how they work, and maybe how the anti-cheat works.

100
00:09:00,120 --> 00:09:09,980
And then you'll end up learning a lot from just, you know, trying out things, trying to reverse new programs you might have not had looked at before, stuff like that.

101
00:09:09,980 --> 00:09:11,580
Well, a quick step back then.

102
00:09:11,580 --> 00:09:15,420
So you said you watch as a program does something unusual.

103
00:09:15,420 --> 00:09:20,800
It's not exactly the words you used, but what types of unusual things are you expecting?

104
00:09:20,800 --> 00:09:24,540
What types of things would make the radar go off?

105
00:09:24,980 --> 00:09:32,320
So just to give you an example of like a vulnerability I found a few years ago, was in the software called Dell Support Assist.

106
00:09:32,320 --> 00:09:40,400
And how that worked was when I went to update my drivers, because I installed a new SSD, I needed drivers for that one machine.

107
00:09:40,400 --> 00:09:45,640
The website claimed to be able to update my drivers, but from the website itself.

108
00:09:45,660 --> 00:09:48,500
And I was like, how does a website update my drivers?

109
00:09:48,500 --> 00:09:58,120
Well, it turns out that Dell pre-installs this software that basically allows its own website to communicate with it and install stuff like updates.

110
00:09:58,120 --> 00:10:02,000
Well, that's kind of weird, you know, because you're allowing a website to have that sort of access.

111
00:10:02,000 --> 00:10:07,680
And then I reverse engineered it further, and I found that the restrictions there weren't quite as strong.

112
00:10:07,680 --> 00:10:12,360
And I found a way to bypass the restrictions the application had.

113
00:10:12,680 --> 00:10:17,660
But so the weird part there was, well, it's a website claiming to, you know, update my drivers.

114
00:10:17,660 --> 00:10:19,080
That's not normal.

115
00:10:19,120 --> 00:10:24,080
Websites, it normally can't just do it automatically update my drivers itself.

116
00:10:24,180 --> 00:10:26,560
You know, it might be something I have to install and do it myself.

117
00:10:26,560 --> 00:10:28,440
But so in that case, that was something weird.

118
00:10:28,440 --> 00:10:32,400
It's just basically finding these, you know, why does this thing happen?

119
00:10:32,400 --> 00:10:34,200
Why did they design it this way?

120
00:10:34,200 --> 00:10:40,760
And it's looking for those logical flaws in their, like, design or just their code itself.

121
00:10:40,900 --> 00:10:41,500
Yeah.

122
00:10:41,680 --> 00:10:44,660
So this is one that I've actually hit myself.

123
00:10:45,980 --> 00:10:50,080
RPTK2015 asking another question, like, keep them coming.

124
00:10:50,080 --> 00:10:52,540
This dude's pretty orchic.

125
00:10:52,540 --> 00:10:53,720
I don't know.

126
00:10:54,000 --> 00:10:57,940
Could you explain on how secure boot blocks some of the driver signing methods?

127
00:10:57,940 --> 00:11:01,160
I've definitely noticed that some drivers work with UEFI and some don't.

128
00:11:01,160 --> 00:11:03,260
And it's usually a driver signature problem.

129
00:11:03,260 --> 00:11:03,820
Yeah.

130
00:11:03,820 --> 00:11:20,980
So the main issue you're going to have with secure boot is if you're, like, going after using a leaked certificate or if you're buying your own certificate, the thing to consider is if the certificate was issued after July 29th, 2015, that's the cutoff date.

131
00:11:20,980 --> 00:11:27,400
Then you're going to need a EV certificate, so extended validation certificate on newer versions of Windows 10.

132
00:11:27,400 --> 00:11:36,640
So what that means is you're going to have to, basically, the certificate vendors that give you these code signing certificates have to, you know, do extra validation.

133
00:11:36,640 --> 00:11:42,520
And typically the certificate is given to you on, like, a USB drive instead of just sending you the private key file.

134
00:11:42,800 --> 00:11:56,140
So that, you know, for versions of Windows 10 that have secure boot enabled, you're basically preventing drivers that aren't signed with an EV certificate to be loaded just because that's the policy that follows.

135
00:11:56,140 --> 00:11:58,220
And in those newer versions.

136
00:11:58,580 --> 00:12:11,540
And so, but if your leaked certificate was released before, issued before July 29th, 2015, then it will still work on these newer builds with this secure boot protection, I guess you call it.

137
00:12:11,820 --> 00:12:14,520
There is sort of an extension of that.

138
00:12:14,720 --> 00:12:22,080
When I encountered this issue, there was a registry flag that you could set that was sort of bypassed it.

139
00:12:22,080 --> 00:12:23,380
It was unattended upgrade.

140
00:12:23,380 --> 00:12:25,760
It was from Windows 7 to Windows 10 upgrade.

141
00:12:25,760 --> 00:12:28,900
Did you try playing around with that to see if we might?

142
00:12:29,500 --> 00:12:36,560
I know, mostly because the leaked certificates, like you can just, the ones publicly available are issued before that cutoff date.

143
00:12:36,700 --> 00:12:40,300
So, I mean, it's like, there's like, almost all of them are issued.

144
00:12:40,300 --> 00:12:46,320
I mean, at least right now, you know, the leaked certificates I used was when I found it was issued before that date.

145
00:12:46,320 --> 00:12:50,400
So I haven't actually found the leaked certificate that was issued after it yet.

146
00:12:50,400 --> 00:12:55,740
So it's easy enough to find it that you haven't had to hunt down that possible other way to get it done.

147
00:12:57,080 --> 00:12:58,040
Right, right, right.

148
00:12:58,040 --> 00:13:03,360
And so there's quite a number of ways you can approach the problem of, you know, getting your driver loaded.

149
00:13:03,420 --> 00:13:12,040
And at that point, well, if you don't even need to look into, you know, other ways there, it's a non-issue, I guess you call it.

150
00:13:12,040 --> 00:13:20,740
But it's something to keep in mind, you know, going forward, once those leaked certificates start to run out, you're probably going to run into that issue of that date restriction.

151
00:13:20,740 --> 00:13:32,080
And at that point, I'd probably recommend the second method of loading a driver and abusing another legitimate driver that has been signed with like an EV certificate.

152
00:13:32,280 --> 00:13:40,040
But again, the problem with that, in my talk, I mentioned it is that you can run into a lot of stability issues when abusing another driver and trying to load your own.

153
00:13:40,040 --> 00:13:45,120
Just because there's oftentimes going to be stability concerns like race conditions.

154
00:13:45,840 --> 00:13:47,200
That makes sense.

155
00:13:49,980 --> 00:13:55,340
So Trunsky is asking, did you test your rootkit against any of the top EDRs?

156
00:13:55,840 --> 00:13:56,620
No, I didn't.

157
00:13:56,620 --> 00:14:01,720
But I took EDRs into consideration when designing the application.

158
00:14:01,720 --> 00:14:07,620
And for example, how I hook communication between the AFT driver and user mode applications.

159
00:14:07,620 --> 00:14:13,880
I always went for methods that would try to make it as expensive as possible to detect.

160
00:14:13,880 --> 00:14:18,600
Because I feel like that's the best approach is not security through obscurity.

161
00:14:18,600 --> 00:14:27,620
It's going to be, how can I make the antivirus have to go through a very expensive and time-consuming process to detect me?

162
00:14:27,620 --> 00:14:30,600
Because oftentimes they'll reconsider for those reasons.

163
00:14:30,600 --> 00:14:35,680
Or another perspective might be, how can I cause compatibility issues?

164
00:14:35,680 --> 00:14:43,120
If there's an application that already does these suspicious operations, maybe I can impersonate that application.

165
00:14:43,120 --> 00:14:48,260
And the antivirus would have to accept it because the legitimate application also does suspicious operations.

166
00:14:48,260 --> 00:14:52,120
Trigger bad false positives that they can't work around themselves.

167
00:14:52,440 --> 00:14:53,280
Right, right, right.

168
00:14:53,280 --> 00:14:55,720
Or it's very difficult to detect around that.

169
00:14:56,700 --> 00:14:58,600
Yeah, makes sense.

170
00:14:58,600 --> 00:15:04,440
Yeah, I feel like a lot of security is just making the other side do more work to get to the same goal.

171
00:15:06,980 --> 00:15:10,180
So RPTK asks another question here.

172
00:15:10,560 --> 00:15:17,260
There were some methods you were able to see that were not HVCI compatible.

173
00:15:17,260 --> 00:15:21,000
Can you please explain a little bit about HVCI mitigations?

174
00:15:22,280 --> 00:15:26,960
Yeah, so the HVCI, let me look what it stands for.

175
00:15:26,960 --> 00:15:30,620
It's like, yeah, virtualization-based protection of code integrity.

176
00:15:30,620 --> 00:15:33,500
So essentially what it does is it's a mitigation.

177
00:15:33,500 --> 00:15:36,720
If you have virtualization enabled, you should be able to enable it.

178
00:15:36,720 --> 00:15:48,240
That basically makes it so once the driver is loaded into memory, especially its executable sections, it can never again have those executable sections set to writable.

179
00:15:48,720 --> 00:15:58,420
The memory protections will never be able to be writable for that memory page because it's an executable section.

180
00:15:58,420 --> 00:16:06,920
So essentially it prevents code hooking, for example, or basically modifying the actual bytes of the driver's executable code.

181
00:16:07,780 --> 00:16:09,580
That makes sense.

182
00:16:12,260 --> 00:16:15,000
So I apparently missed this.

183
00:16:15,000 --> 00:16:19,420
Can you talk a little bit about your Peacemaker project and how it compares to Spectre?

184
00:16:20,680 --> 00:16:21,520
Sure.

185
00:16:21,520 --> 00:16:31,840
So Peacemaker was a proof-of-concept EDR that I wrote a few months ago, which was basically the opposite of what I'm doing now.

186
00:16:31,840 --> 00:16:35,960
Instead of writing a rootkit, I wrote a driver to detect malware.

187
00:16:36,240 --> 00:16:44,940
And the biggest difference between the two is the fact that one of them is a blue-teaming defense application while the other one is a rootkit.

188
00:16:45,260 --> 00:16:48,020
But how does it compare?

189
00:16:48,020 --> 00:16:54,020
Well, Peacemaker is going to be... I believe it's a little bit less efficient in general.

190
00:16:54,020 --> 00:17:01,400
And I followed a stricter code design policy for myself in this latest one.

191
00:17:01,400 --> 00:17:05,060
So, I mean, those are, I guess, how it compares.

192
00:17:05,060 --> 00:17:08,300
But they're two different projects for two different reasons.

193
00:17:10,100 --> 00:17:11,580
That's fair.

194
00:17:11,700 --> 00:17:17,200
So speaking about other projects and other places you might want to push this research...

195
00:17:17,800 --> 00:17:30,920
You already mentioned a little bit about a gap of the upgrade process for if you end up running out of certificates that were signed before the cutoff date.

196
00:17:30,920 --> 00:17:37,920
What other interesting things are out there for somebody who wants to do research in the same field that you're in?

197
00:17:37,920 --> 00:17:44,300
What would you recommend for somebody who is looking for a neat project to jump in and start working?

198
00:17:45,900 --> 00:17:52,440
So for, I guess, neat projects of where to start, it would first of all be...

199
00:17:52,440 --> 00:18:02,960
If you're interested in learning more about the Windows kernel or the internals of the Windows operating system, the best recommendation I have, besides experience, is going to be...

200
00:18:02,960 --> 00:18:12,580
Some of the books out there include the Windows internals, 7th edition is the latest one, that really goes into depth about the internals of the Windows operating system.

201
00:18:12,580 --> 00:18:21,200
But it's really going to be finding a way to make security interesting for you or make learning interesting to you.

202
00:18:21,200 --> 00:18:25,080
And that's the best way I can recommend, I guess, of how to...

203
00:18:25,080 --> 00:18:34,660
What's the best way to go about learning these difficult topics is to gamify it and is to incentivize the research itself.

204
00:18:35,920 --> 00:18:39,660
But yeah, in general, it's going to be...

205
00:18:39,660 --> 00:18:46,060
Most of your experience and knowledge is going to come from experience and just playing with things, trying new things.

206
00:18:46,060 --> 00:18:49,920
And for projects you could do, it varies.

207
00:18:49,920 --> 00:18:55,820
You can try looking at reversing drivers for vulnerabilities in their IOCTL interface.

208
00:18:55,820 --> 00:18:58,760
That's what I started with, at least.

209
00:18:59,020 --> 00:19:03,640
And you can try to find a way to abuse those drivers.

210
00:19:03,640 --> 00:19:06,260
Like the abuse legitimate drivers portion.

211
00:19:06,260 --> 00:19:13,760
If you're looking for some drivers to, I guess, that might be vulnerable, a lot of OEM drivers have security issues in them.

212
00:19:14,200 --> 00:19:15,820
I'm always shocked.

213
00:19:16,680 --> 00:19:18,980
I've become desensitized to it.

214
00:19:18,980 --> 00:19:24,100
Almost every OEM driver has something questionable in it.

215
00:19:24,380 --> 00:19:29,280
And I guess that's the place to start if you're looking for vulnerable drivers.

216
00:19:29,280 --> 00:19:36,720
It almost sounds like as you're approaching these projects, the new thing pops out at you.

217
00:19:36,720 --> 00:19:43,000
Maybe not from getting a depth into, hey, I'm going to find all of the drivers out there.

218
00:19:43,000 --> 00:19:47,040
But you're looking for other things, you're learning everything you can.

219
00:19:47,040 --> 00:19:51,820
And then the context for your next project kind of filters out from that.

220
00:19:51,820 --> 00:19:56,520
Or do you find that you have to go searching for what you're going to attack next?

221
00:19:57,640 --> 00:20:00,900
In general, not even just Windows Kernel stuff.

222
00:20:01,040 --> 00:20:04,720
I generally don't search for projects to do.

223
00:20:04,720 --> 00:20:07,520
Again, it's just finding stuff that might be interesting.

224
00:20:07,920 --> 00:20:12,940
If a program is doing something suspicious, there you go, that's a project right there.

225
00:20:12,940 --> 00:20:14,780
Find out why it's doing that thing.

226
00:20:14,780 --> 00:20:18,720
Or anything similar it's doing that could be called into question.

227
00:20:18,720 --> 00:20:28,380
But for Windows Kernel, one thing I do is I try to get part of the virus scanning platforms out there.

228
00:20:28,380 --> 00:20:30,560
One I am part of is hybrid analysis.

229
00:20:30,560 --> 00:20:33,940
And what I'll do is I'll occasionally search for drivers on there and download them.

230
00:20:33,940 --> 00:20:37,880
And just take a quick peek under the hood and you can see what's going on there.

231
00:20:38,280 --> 00:20:42,780
And so that's a good place to find these driver files if you're trying to search for them.

232
00:20:43,840 --> 00:20:45,080
Sorry, go ahead.

233
00:20:45,080 --> 00:20:47,800
I was going to say, are those already infected drivers?

234
00:20:47,800 --> 00:20:53,120
Or are these just tons of driver repository kind of thing?

235
00:20:53,280 --> 00:20:54,400
It's just a repository.

236
00:20:54,400 --> 00:20:57,520
These aren't necessarily bad drivers or vulnerable drivers.

237
00:20:57,520 --> 00:21:01,520
These are just potent, might be legitimate drivers as well.

238
00:21:01,520 --> 00:21:03,300
So it's just a driver repository.

239
00:21:04,760 --> 00:21:09,880
Have you looked at any other driver infections just to see how they are doing those hooks?

240
00:21:09,880 --> 00:21:15,700
Get basically similar ideas and work back from the attack side rather than being like, oh, this is weird.

241
00:21:15,800 --> 00:21:18,780
Instead of like, oh, this is an active attack, how are they doing this?

242
00:21:18,780 --> 00:21:21,020
Could this apply to other situations?

243
00:21:21,520 --> 00:21:26,120
So basically, do you look at malware or do you just look for new things in weird drivers?

244
00:21:26,700 --> 00:21:29,400
I look for new things in weird drivers.

245
00:21:29,500 --> 00:21:33,300
I don't specifically just look at drivers I know that are malicious.

246
00:21:34,460 --> 00:21:38,160
What I do is I'll reverse engineer, like I said, OEM drivers.

247
00:21:38,160 --> 00:21:39,900
And that's a starting point.

248
00:21:39,900 --> 00:21:40,940
Those are legitimate.

249
00:21:40,940 --> 00:21:44,660
And I'll just look into what I can find.

250
00:21:45,080 --> 00:21:49,440
First of all, it's like auditing attack surfaces, finding out what can you actually talk to.

251
00:21:49,540 --> 00:21:52,960
And then it's finding out now you know what you can talk to.

252
00:21:52,960 --> 00:21:58,120
What are the access controls in place that limit how much you can talk to the application?

253
00:21:58,200 --> 00:21:59,340
And it's going from there.

254
00:21:59,340 --> 00:22:04,420
It's that type of investigation of what can you access and how can you manipulate what you can access.

255
00:22:05,820 --> 00:22:06,820
Cool.

256
00:22:07,120 --> 00:22:11,560
So Truinsky asked a question that fits into kind of the direction I was pointing there.

257
00:22:11,560 --> 00:22:14,700
How do you balance your personal life and doing research?

258
00:22:14,700 --> 00:22:18,580
So you're clearly deeply involved in this.

259
00:22:18,580 --> 00:22:26,600
At what point is this all you do and how do you fit in the rest of the stuff you want to do with your life?

260
00:22:27,660 --> 00:22:28,440
Yes.

261
00:22:28,440 --> 00:22:31,420
So, well, specifically how I manage my time is going to...

262
00:22:31,940 --> 00:22:38,000
The big thing is, you know, over the summer I didn't do most of my most of my research was before I was in school.

263
00:22:38,040 --> 00:22:41,080
So before, you know, any internship or summer work.

264
00:22:41,200 --> 00:22:43,920
So it's going to be in school.

265
00:22:43,920 --> 00:22:46,040
I've just I've got too much free time.

266
00:22:46,960 --> 00:22:53,580
And so I just spend that time researching or, you know, I spend some of that time trying to research things.

267
00:22:53,580 --> 00:22:54,760
And it's different.

268
00:22:54,760 --> 00:22:57,600
You know, if you have a full time job, I don't know if I have a recommendation for you.

269
00:22:57,600 --> 00:23:01,960
Because a fact is, I know how like 40 hours a week is rough.

270
00:23:02,820 --> 00:23:06,260
You know, you'll probably be tired when you get home.

271
00:23:06,260 --> 00:23:09,660
So , you know, doing research then it can be difficult sometimes.

272
00:23:09,660 --> 00:23:12,340
And so I don't know if I have any recommendations specific to that.

273
00:23:12,340 --> 00:23:18,820
But in general, I try to use this free time I have as much as possible, like valuably, I guess.

274
00:23:19,100 --> 00:23:26,240
And since I have so much free time in school, you know, I dedicate a portion of that to doing my own research.

275
00:23:27,620 --> 00:23:28,860
That's awesome.

276
00:23:29,400 --> 00:23:38,480
So not that we want to point towards anything specific, but you did mention that there were some CTFs out there that are good training resources.

277
00:23:38,620 --> 00:23:44,860
Maybe this is a good time for you to say, do you have a favorite CTF for teaching this type of material?

278
00:23:44,860 --> 00:23:51,960
Other than, you know, you were talking about the Windows, Windows internal stuff that you can read the 30 pound book.

279
00:23:52,540 --> 00:23:54,280
So it's actually unfortunate.

280
00:23:54,280 --> 00:23:58,540
I find that a lot of CTFs don't really focus on Windows related challenges.

281
00:23:58,540 --> 00:24:04,000
It's really rare you'll see like an actual challenge that's dedicated about Windows internals.

282
00:24:04,000 --> 00:24:11,000
It's usually, you know, like if it's like a binary exploitation thing, generally speaking, I see it being like Linux application, right?

283
00:24:11,120 --> 00:24:13,800
Maybe running even on the ARM architecture.

284
00:24:13,880 --> 00:24:18,640
But I just rarely see I don't have any good CTFs to recommend for Windows related stuff.

285
00:24:18,640 --> 00:24:24,060
Just because oftentimes you probably won't see Windows related stuff.

286
00:24:24,280 --> 00:24:28,240
One of them I can I know I can mention that it's pretty good.

287
00:24:28,240 --> 00:24:33,680
It's I guess you call my favorite CTF overall is the Flareon reversing CTF.

288
00:24:33,700 --> 00:24:35,740
They have some really interesting challenges there.

289
00:24:35,740 --> 00:24:37,520
You know, it's not just going to be Windows stuff.

290
00:24:37,520 --> 00:24:43,760
It's going to be, you know, reversing a bunch of different architectures and applications, figuring out what they do.

291
00:24:44,280 --> 00:24:47,460
It's one of the favorite ones I participate in.

292
00:24:49,100 --> 00:24:53,980
Also, I mean, I guess that also kind of exposes like that CTF sounds awesome.

293
00:24:53,980 --> 00:24:57,900
It seems like any for anyone that's watching that there's a gap in the community.

294
00:24:58,080 --> 00:24:59,920
Windows CTFs.

295
00:24:59,920 --> 00:25:01,380
There you go.

296
00:25:03,100 --> 00:25:04,800
Next DEF CON talk.

297
00:25:06,720 --> 00:25:08,540
Well, so what's next for you?

298
00:25:08,540 --> 00:25:13,100
If you could pick which direction you would point for your for your next research topic?

299
00:25:15,260 --> 00:25:18,120
That's simple to say, I honestly don't have a next direction.

300
00:25:18,160 --> 00:25:19,920
I don't have the next project.

301
00:25:19,920 --> 00:25:22,520
I'm again, I kind of just go with the flow.

302
00:25:22,620 --> 00:25:29,300
I see it really is literally just looking at the everyday software I use.

303
00:25:29,300 --> 00:25:33,660
And then if I know that I just tend to notice stuff like this is weird.

304
00:25:33,660 --> 00:25:37,960
And that's how I how I go about doing it for this specific for my talk.

305
00:25:37,960 --> 00:25:44,160
I came up with it, I guess you could say is is our schools or our schools security club.

306
00:25:44,200 --> 00:25:50,960
A red team needed a new we wanted new malware to use against our best blue team competitors.

307
00:25:50,960 --> 00:25:55,360
So we run competitions where we do like we simulate a corporate environment.

308
00:25:55,360 --> 00:26:00,460
And you have a red team that tries to maintain persistence and a blue team that tries to kick you out.

309
00:26:00,460 --> 00:26:07,140
Blue teams also have like uptime and these challenges that they have to keep services up while the red team tries to mess with them.

310
00:26:07,140 --> 00:26:13,520
And so there was just a need there for me to develop some tooling against our top blue teamers.

311
00:26:13,820 --> 00:26:18,560
And so that's why I decided to look into this, you know, maybe like two birds with one stone type thing.

312
00:26:18,560 --> 00:26:20,100
You know, I thought it'd be interesting.

313
00:26:20,820 --> 00:26:25,600
So there's educational resources about rootkits out there like books, I know for sure.

314
00:26:25,720 --> 00:26:32,680
But I haven't really seen open source tooling around, you know, kernel level Windows rootkits out there.

315
00:26:32,680 --> 00:26:34,100
It's rare to see it.

316
00:26:34,100 --> 00:26:36,920
So I thought it would actually be a pretty interesting project.

317
00:26:38,920 --> 00:26:40,580
Looks like it turned out that way.

318
00:26:41,720 --> 00:26:44,380
Did you end up crushing the blue team with this?

319
00:26:45,740 --> 00:26:47,320
Yes, yes, definitely.

320
00:26:47,420 --> 00:26:58,140
I remember having conversations about, you know, like, when I suggested that I was abusing legitimate communication, explaining to these blue teamers how I was doing things.

321
00:26:58,200 --> 00:27:03,200
They were really confused about, you know, like, how would you abuse a legitimate port on my machine?

322
00:27:03,200 --> 00:27:06,900
Because they were looking for malware and I was using...

323
00:27:06,900 --> 00:27:09,760
So they have to have certain services uptime, right?

324
00:27:09,760 --> 00:27:12,380
So they have to have these services always up.

325
00:27:12,480 --> 00:27:16,320
So I was just using that fact to get into their machine.

326
00:27:16,320 --> 00:27:18,700
Because they could, like, take down that service.

327
00:27:18,700 --> 00:27:27,780
So even if they knew, and they didn't, that I was abusing these legitimate services for communication, you know, they would firewall everything except for those services.

328
00:27:27,780 --> 00:27:32,480
And I'd still be able to get access because, you know, communicating through their services.

329
00:27:32,480 --> 00:27:35,720
Yeah, it was a really fun time.

330
00:27:37,740 --> 00:27:43,320
One person is asking for a clarification on the CTF, like, where they can find it, the Flareon.

331
00:27:43,320 --> 00:27:47,500
They found flare-on.com.

332
00:27:47,720 --> 00:27:50,480
Yeah, it is the Flareon.

333
00:27:50,480 --> 00:27:53,700
Flare-on.com is the one I mentioned.

334
00:27:53,820 --> 00:27:57,340
And another question from RPTK2015.

335
00:27:57,340 --> 00:28:02,340
In the resources you proposed, ReactOS, could you explain a little bit about that?

336
00:28:02,980 --> 00:28:03,680
Yeah, sure.

337
00:28:03,680 --> 00:28:12,440
So ReactOS is essentially a bunch of engineers, reverse-engineered Windows kernel, and wrote it one-to-one.

338
00:28:12,440 --> 00:28:19,800
I wouldn't say, obviously, it's not one-to-one 100%, but it's actually, like, insanely accurate of the actual Windows kernel.

339
00:28:19,800 --> 00:28:22,760
So it's kind of like an open-source Windows kernel.

340
00:28:22,760 --> 00:28:27,740
You'll find that a lot of the functions in the actual kernel has been re-implemented in there.

341
00:28:27,740 --> 00:28:29,480
It follows the same structure.

342
00:28:30,000 --> 00:28:33,540
It's just quite literally an open-source clone of Windows.

343
00:28:34,000 --> 00:28:39,180
And it's an amazing resource because sometimes you'll find undocumented functions.

344
00:28:39,180 --> 00:28:40,420
You don't know what it does.

345
00:28:40,420 --> 00:28:49,560
And luckily, you can go to the ReactOS project and just take a look at the source of that because people have spent hours reversing that one function for you.

346
00:28:49,560 --> 00:28:54,780
Now, some of this is going to be outdated because the ReactOS kernel replicates the XP kernel.

347
00:28:54,900 --> 00:28:58,810
But still, the core functionality is going to be pretty similar.

348
00:29:00,500 --> 00:29:01,180
Excellent.

349
00:29:01,180 --> 00:29:03,980
So we are right at the end of our scheduled time.

350
00:29:03,980 --> 00:29:10,300
Is there anything else you'd like to impart upon us before we call it for the day?

351
00:29:11,320 --> 00:29:13,060
Yeah, I mean, not really.

352
00:29:13,060 --> 00:29:15,760
I appreciate everyone for coming out to my talk.

353
00:29:15,760 --> 00:29:28,760
Keep in mind that I'd like more red teamers to start using Windows kernel-level rootkits and going that route because I think there's some interesting...

354
00:29:29,320 --> 00:29:31,040
more advanced actors use it.

355
00:29:31,040 --> 00:29:39,820
And I feel like more red teamers need to start simulating those advanced actors that have been using these rootkit techniques for years.

356
00:29:39,820 --> 00:29:43,840
I just feel like we have such a good community for user-mode malware.

357
00:29:43,840 --> 00:29:49,040
But we rarely see much for kernel-mode, if that makes sense.

358
00:29:49,040 --> 00:29:58,140
So I guess that's the parting message is please start looking into it because the real adversaries out there already have this ready to go.

359
00:29:58,280 --> 00:29:59,380
That makes sense.

360
00:29:59,380 --> 00:30:09,440
Well, we'll get you to post all of your contact information into track one and let people find you wherever you tell them that they can find you.

361
00:30:09,440 --> 00:30:17,440
And I really appreciate that you gave us some time today to both give that presentation and then spend this time in the Q&A.

362
00:30:17,660 --> 00:30:22,700
So thank you very much and hopefully we'll see more from you soon.

363
00:30:23,240 --> 00:30:24,180
Yep.

364
00:30:24,180 --> 00:30:25,360
Have a good one.

365
00:30:25,360 --> 00:30:26,340
Thank you, Bill.

366
00:30:26,340 --> 00:30:26,980
Thanks, guys.