Defensive techniques to increase computer security
Among other disclosed subject matter, a computer-implemented method includes initializing a first descriptor table and a second descriptor table. The first descriptor table is associated with a first permission level and the second descriptor table is associated with a second permission level that is different from the first permission level. The first descriptor table and the second descriptor table are associated with a hardware processor and initialized by an operating system kernel. The method also includes providing a memory address associated with the first descriptor table, in response to a descriptor table address request. The descriptor table address request is provided by a software process. The method also includes updating the second descriptor table, in response to an update request.
1. A computer-implemented method, the method comprising:
initializing a first descriptor table associated with a first permission level;
generating a random location for a second descriptor table, wherein the random location is a location that is not determinable by user mode software processes using commands associated with a hardware processor
initializing the second descriptor table at the random location, wherein the second descriptor table is associated with a second permission level that is different from the first permission level, the first descriptor table and the second descriptor table are associated with the hardware processor and initialized by an operating system kernel, the first permission level is read only and the second permission level is read write;
in response to a descriptor table address request, providing a memory address associated with the first descriptor table, wherein the descriptor table address request is provided by at least one user mode software process; and
in response to an update request for the first descriptor table by the at least one user mode software process, updating the second descriptor table responsive to the operating system kernel determining that the update request is valid and trusted, wherein the location of the second descriptor table is not revealed to the at least one user mode software process.
2. The computer-implemented method of claim 1 wherein updating the second descriptor table causes the first descriptor table to be updated.
3. The computer-implemented method of claim 1 wherein the first descriptor table and the second descriptor table comprise interrupt descriptor tables.
4. The computer-implemented method of claim 1 wherein the first descriptor table and the second descriptor table comprise global descriptor tables.
5. The computer-implemented method of claim 1 wherein the descriptor table address request comprises a store global descriptor table instruction or a store interrupt descriptor table instruction.
6. The computer-implemented method of claim 1 wherein data included in the first descriptor table is equal to data included in the second descriptor table.
7. The computer-implemented method of claim 1 wherein the software process comprises malware or a computer virus.
8. A non-transitory, computer-readable medium storing instructions operable when executed to cause a hardware processor to perform operations comprising:
initializing a first descriptor table associated with a first permission level;
generating a random location for a second descriptor table, wherein the random location is a location that is not determinable by user mode software processes using commands associated with the hardware processor;
initializing the second descriptor table at the random location, wherein the second descriptor table is associated with a second permission level that is different from the first permission level, the first descriptor table and the second descriptor table are associated with the hardware processor and initialized by an operating system kernel, the first permission level is read only and the second permission level is read write;
in response to a descriptor table address request, providing a memory address associated with the first descriptor table, wherein the descriptor table address request is provided by at least one user mode software process; and
in response to an update request for the first descriptor table by the at least one user mode software process, updating the second descriptor table responsive to the operating system kernel determining that the update request is valid and trusted, wherein the location of the second descriptor table is not revealed to the at least one user mode software process.
9. The computer-readable medium of claim 8 wherein updating the second descriptor table causes the first descriptor table to be updated.
10. The computer-readable medium of claim 8 wherein the first descriptor table and the second descriptor table comprise interrupt descriptor tables.
11. The computer-readable medium of claim 8 wherein the first descriptor table and the second descriptor table comprise global descriptor tables.
12. The computer-readable medium of claim 8 wherein the descriptor table address request comprises a store global descriptor table instruction or a store interrupt descriptor table instruction.
13. The computer-readable medium of claim 8 wherein data included in the first descriptor table is equal to data included in the second descriptor table.
14. The computer-readable medium of claim 8 wherein the software process comprises malware or a computer virus.
15. A system comprising:
memory for storing data; and
one or more hardware processors operable to perform operations comprising:
initializing a first descriptor table associated with a first permission level;
generating a random location for a second descriptor table, wherein the random location is a location that is not determinable by user mode software processes using commands associated with the one or more hardware processors;
initializing the second descriptor table at the random location, wherein the second descriptor table is associated with a second permission level that is different from the first permission level, the first descriptor table and the second descriptor table are associated with the one or more hardware processors and initialized by an operating system kernel, the first permission level is read only and the second permission level is read write;
in response to a descriptor table address request, providing a memory address associated with the first descriptor table, wherein the descriptor table address request is provided by at least one user mode software process; and
in response to an update request for the first descriptor table by the at least one user mode software process, updating the second descriptor table responsive to the operating system kernel determining that the update request is valid and trusted, wherein the location of the second descriptor table is not revealed to the at least one user mode software process.
16. The system of claim 15 wherein updating the second descriptor table causes the first descriptor table to be updated.
17. The system of claim 15 wherein the first descriptor table and the second descriptor table comprise interrupt descriptor tables.
18. The system of claim 15 wherein the first descriptor table and the second descriptor table comprise global descriptor tables.
19. The system of claim 15 wherein the descriptor table address request comprises a store global descriptor table instruction or a store interrupt descriptor table instruction.
20. The system of claim 15 wherein data included in the first descriptor table is equal to data included in the second descriptor table.
21. The system of claim 15 wherein the software process comprises malware or a computer virus.