James Loureiro & Georgi Geshev - Platform agnostic kernel fuzzing

Platform agnostic kernel fuzzing James Loureiro Researcher, MWR InfoSecurity
Georgi Geshev Security Researcher, MWR InfoSecurity A number of toolsets have been around for a while which propose methods for identifying vulnerabilities in kernels, in particular POSIX kernels. However, none of these identified a method for generic fuzzing across Windows and POSIX kernels and have not been updated for some time.

This presentation will outline the research which has occurred in order to find exploitable bugs across both Windows and POSIX kernels, focusing on fuzzing system calls and library calls in the Windows environment. System calls will be briefly explained, how they work and how these can be fuzzed in order to find bugs. The presentation will then move on to explaining core libraries in the Windows environment and how to fuzz these effectively.

Other issues with creating a kernel fuzzing environment will be discussed, such as effective logging of calls in which the machine could BSOD and kernel panic, and how to correctly reproduce vulnerabilities that have been identified by the fuzzer. We will also cover efficient scaling of a kernel fuzzer so that a number of virtual machines are in operation that can generate a large number of crashes.

Finally, a brief summary of the vulnerabilities that have been identified will be provided. James Loureiro is a researcher at MWR InfoSecurity. During this time he has conducted research into a number of technologies, particularly ICS. Further, James has conducted research into Adobe Reader and other widely deployed platforms, which have identified vulnerabilities. These can be found on the MWR Labs website - labs.mwrinfosecurity.com. James has also presented previously at BSides London on this topic.

Georgi Geshev is a security researcher for MWR InfoSecurity in the UK. Born in the Eastern Bloc, a true wannabe Aussie now, he appreciates roo steaks and golden ales. His main areas of interest include bug hunting, reverse engineering and network protocols. It is a well known fact that Georgi only knows about MQ technology.

Twitter: @NerdKernel, @munmap, @mwrlabs