Organizer
Partner Company
Exploit Windows Kernel In 2020
Yunhai Zhang
Abstract
Exploit Windows kernel vulnerabilities used to be trivial, and then there were mitigations. Microsoft has introduced a lot of mitigations in kernel to break exploitation techniques. Nowadays, exploit a Windows kernel vulnerability need to bypass all enabled mitigations, such as KASLR, NX/DEP, SMEP, SMAP, TypeIsolation, KCFG, VBS and HVCI.
This presentation will go through these mitigations, discuss the trade-off between security and usability in its implementation and the potential attack surface. Based on that, this presentation will also demonstrate several tricks to achieve code execution in kernel with all the mitigations enabled.
Speaker Info
Yunhai Zhang is Director of NSFOCUS TIANJI LAB. He has worked on information security for more than a decade. He has spoken at many security conferences in the past, such as Blackhat, Bluehat, DEFCON, POC, TSec, XCon, etc.
He has won the Microsoft Mitigation Bypass Bounty 5 years in a row since 2014.