Sébastien Renaud (Senior Security Researcher, Quarkslab) & Kevin Szkudlapski (Junior Security Researcher, Quarkslab)

PRESENTATION TITLE: WinRT: The Metro-politan Museum of Security

PRESENTATION ABSTRACT:

Windows 8 will come with lots of change compared to Windows 7, not only with the new Metro interface, ARM support, but also from the security point of view with one of the main features being the new Windows RunTime - codenamed WinRT.

In this session, we will provide a birds eye view of what exactly WinRT is and what new security it provides. We will then look at it as a programmer: What language will support it and it can be accessed natively when it is not supposed to be, compiler protections such as SAFESEH, DYNAMICBASE and NXCOMPAT, and much more.

Along with this, we will also focus on the new application model. All applications intended for this runtime will be distributed by Microsft through an online store and will be checked and signed. MS provide a tool to pre-test your own applications before submitting it. We will demonstrate how we can bypass all the checks made by this tool to call forbidden APIs, and embed malware in valid applications.

Next, we will go into WinRT internal user land. We will show that the Windows registry is still here and at the heart of the WinRT technology. We’ll take three important parts of WinRT (Contract, Extension and Class) and will demonstrate how all of these parts interact together. Once we understand that, we wil inspect the life and death of a WinRT application, from its start to the end of the process, in order to understand all security features involved.  Last but not least, we will have a look at the new WinRT sandbox, comparing it to Chrome’s. We will introduce what we called the LowBox model. It  is the term we use to name the implementation of the sandbox used in the context of WinRT. We will explain what are the core features used by the Windows Runtime’s sandbox. A reimplementation in C of the core of the sandbox, abundantly commented, will also be delivered. 

ABOUT SEBASTIEN RENAUD

Sébastien Renaud is a senior security researcher at Quarkslab focusing on reverse engineering, vulnerability research and analysis with an emphasis on the Windows operating system. He enjoys programming tools and dissecting file formats and network protocols.

ABOUT KEVIN SZKUDLAPSKI

Kevin Szkudlapski is a junior security researcher working on reverse engineering and low level development. He enjoys studying new architectures and analyses how softwares communicate with hardware. He is the main developer of the medusa disassembler.