The Dark Side of the Moon: Advancing System Call Obfuscation via Stack Manipulation

No ratings

Presented at No Hat 2023 by

Alessandro Magnosi

www.nohat.ityoutu.be

Building upon the previous talk on thread stack spoofing and Stack Moonwalking, we will introduce advanced concepts and use cases of Full Moon, focusing on addressing limitations that were previously left unsolved. After that, we will present "Half-Moon", another StackMoonwalking technique that advances system call obfuscation. The Half-Moon technique is designed to conceal indirect system call invocations on Windows 64-bit platforms. Half-Moon builds upon the principles introduced by Full-Moon, enhancing the concealment of system calls within the call stack. Traditional approaches, including direct and indirect system calls, leave detectable traces through thread call stack analysis. Half-Moon circumvents this vulnerability by creating a seemingly legitimate call stack, evading detection mechanisms for indirect syscalls. We will delve into the technical intricacies of Half-Moon, showcasing its effectiveness in obfuscating system call invocations. After that, we will evaluate and discuss how this technique cannot be detected by using traditional detection algorithms, including our own Eclipse. Towards the end of the talk, we will discuss the impact of Control-Flow Enforcement Technology (CET) on these stack manipulation techniques. CET is a security mechanism designed to mitigate control-flow hijacking attacks. We will examine how StackMoonwalking aligns with or challenges CET, emphasising the interplay between stack spoofing techniques and advanced security measures, and we will try to answer an extremely important question: will CET be enough to fully prevent stack spoofing techniques? Finally, we will inspire and foster collaboration among researchers and practitioners, driving the development of robust memory evasion techniques that can withstand the adoption of CET and strengthen cybersecurity defences.