Sunday, August 31, 2008

Teamwork & Crediting

As cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 technology is getting more and more complex, security research, especially offensive security research on a system level, becoming more and more difficult to be done by one person. NX/XD, ASLR, various StackGuard-like things, VT-d, TXT, etc... - all those technologies leave less and less space for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 interesting system-level attacks. On cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r hand, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 widespread "deployment" of Web 2.0 creates a whole new area to explore, but that is a whole different world (plus cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re are still all those "human factor" attacks that exploit user stupidity, but again, this is a different area).

Our Xen 0wning Trilogy is a good example of how a team of researchers can still come up with interesting new system-level attacks against cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 very recent and securely design system. Take XenBluePill as an example.

It has first been months of research and coding done by Alex and myself to support nested hardware virtualization on AMD. Then cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re was months of Rafal's research about how to load code into cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 running Xen on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 fly ("Xen Loadable Modules"). That required ability to access Xen's memory in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 first place and Rafal's way for doing that was to use cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 DMA attack. But cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n it turned out that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Xen 3.3 uses VT-d protection to protect against this very kind of attacks. So cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n I came up with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 "Q35 attack" that exploited a problem with recent Intel BIOSes on recent mocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365rboards (details are coming this week). But I based my attack on a similar SMM attack that Rafal came up with a few months earlier on a different chipset, when he was looking into ways to compromise SMM handler, as we started thinking about HyperGuard project back cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n and Rafal was curious reliable cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 SMM protection is. In cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 meantime, Alex "converted" our working New Blue Pill that had full support for nested virtualization but was essentially a Windows driver, into a piece of code that was completely OS-independent (own memory management, etc.). Then I finally took Rafal's XLM framework, added a few minor things that were needed to load our "Windows-independent Windows driver" into Xen using XLM, fixed some minor stuff and... it finally worked! But that was possible only because of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 joint work by all cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 three people togecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r.

So, it is simply unfair to attribute all cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 glory and fame for our research to "Rutkowska" or "Rutkowska and team", as many news portals did. Please don't forget to credit all cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 co-authors! If you really would like to use a generic term, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n "Invisible Things Lab team" would probably serve better.

Speaking of our team, I also have an announcement that starting this month our team has officially been extended by yet anocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r person: Rong Fan from Beijing, China.

Rong is a software engineer, focusing on Intel's hardware virtualization technology (VT). A few months ago he wrote to me with some advanced questions regarding cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 implementation of our New BluePill that we published after cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 last year's Black Hat. Turned out that Rong, as part of his after-hour activity, is porting Bluepill to VT-x. After he succeeded, we decided to share our nested virtualization code for AMD with him so that he could investigate how to do it on VT-x. And about 2 months ago Rong succeeded with implementing full nested virtualization support for our NBP on Intel VT-x! During that time Rong has had an opportunity to find out that working with ITL is quite fun, so he decided to quit his job at Lenovo and joined ITL full time. Right now Rong is busy adding nested VT-x support to a normal Xen hypervisor.

So, Invisible Things Lab is all about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 team work. The whole idea behind ITL is to gacá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r togecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r a bunch of smart people, so that we could all work on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 most exciting problems togecá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r. Problems that might be too complex or time-consuming for just one person to solve. But it takes more cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n just money to get people to be creative and devote cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365mselves to work. Getting recognition is one of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 additional factors often needed. That's why ITL is not interested in "hiding" its employees, but racá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r in promoting cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir work and fairly crediting cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m.

2 comments:

les lectures de Assia said...

you're a bit pretentious.

Michael Dundas said...

Great blog post Joanna!

I am just reading it now (it's almost a month old), but well written and very true. It is nice to still see companies that have this type of philosophy -- it is cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 main reason I am still with my present employer.

-mike