%PDF-1.6
%
54 0 obj
<>
endobj
32 0 obj
<>
endobj
51 0 obj
<>stream
2009-06-29T09:39:25-04:00
Writer
2009-07-10T15:09:40-07:00
2009-07-10T15:09:40-07:00
OpenOffice.org 2.4
application/pdf
Cloudburst: Hacking 3D (and Breaking Out of VMware) for Black Hat USA 2009
Virtualization is everywhere, and VMware is a major actor in the domain. A MacOS user running a Windows only application in a Fusion guest. A malware researcher analysing the latest Conficker in a Workstation guest. A big company running a cloud virtualized on some ESX servers. All of them rely on the security offered by the virtualization software, as a breakout would have disastrous consequences.
Yet VMware products include implement a lot of functionality, and as such have a decent chance to include some bugs. CLOUDBURST is the combination of 3 of those found in the virtualized video device (more specifically the 3D code). Combined, these allow a user in a Guest to execute code on the Host. Since the virtualized device code is the same for all the branches of the products, this impacts Workstation, as well as Fusion or ESX. Immunity, Inc. will present the various vulnerabilities and the techniques used to exploit the bug reliably, even on platforms with ASLR or DEP such as Vista SP1. Once exploited, Immunity will demonstrate how to establish MOSDEF between the Host and Guest.
Kostya Kortchinsky
uuid:9cc55232-ebb7-406a-bb13-e2ae0fdb23cb
uuid:c1bd01d1-2e35-4cc3-9a33-235c0047d5d2
endstream
endobj
50 0 obj
<>
endobj
55 0 obj
<>/MediaBox[0 0 612 792]/Resources 56 0 R/Type/Page>>
endobj
58 0 obj
<>stream
xRj1+t.#mX[`S_PH߯dgmiJ ^i<3RS!ƘOpw #Ncx."|ǣZl?PUel|r=A^{bz4hKg{t¹(JzaUA~q|MVDD{b~n. IFݥH)h2mJ73I}Ixy+%!~dXΣ/1×F}+sDfȆ)Wh9d8[ NM>?D)ƪ[K~{~z_
endstream
endobj
56 0 obj
<>/Font 57 0 R/ProcSet[/PDF/Text/ImageC/ImageI/ImageB]>>
endobj
57 0 obj
<>
endobj
62 0 obj
<>
endobj
66 0 obj
<>
endobj
70 0 obj
<>
endobj
73 0 obj
<>
endobj
77 0 obj
<>
endobj
81 0 obj
<>
endobj
85 0 obj
<>
endobj
89 0 obj
<>
endobj
93 0 obj
<>
endobj
97 0 obj
<>
endobj
101 0 obj
<>
endobj
99 0 obj
<>
endobj
100 0 obj
<>stream
x]n8ཟBvQXOHYi@#WGt>R4uwϷ?oytnW/^}cZNy:Շo|v/yUjNi%]O|_sՖ㆔_cs^mzWmasM]ǧôڶcsS1疹EYY٘
w#rbNsmܳGn@?@?@?@?~_~_~_~_~_~_~_~_W~_W~_W~_W~_W~_W~_W~_W~_ᷚs~7~7~7~R~7~7~7~9w~w~w~w~w~w~w~tF8#Hg3ٶ
l+ڲrY,h6;сDt8.Pi|Fv +KdDTguNm-^F
̸>-AāNą,ua`ʼnALt&8eM<#art˄F{ǁNtޮLvqpvvΙK2=n=azf1OOg$@;<)bwW<}ynS~y.XG)3,ud@ژ4͛rPvc1Kzp
endstream
endobj
98 0 obj
<>stream
xst%o5vvl۶N:ܱmwm۶mn;jz\k=k͚U{S(1%\XyƮΪ<@sW#_BQh-x;\ h7rn
q5 X,ll Vffw9Q;x:Y[uPբ`@linQ7-΅ 4x:X8LM4Z$-m, b4^o,Op )HtN
@md2bt6c0I!ag*foO7pp$[:Mhomgnfvl0uu`ҰttʈW_0s t =L,i@$?ki{v6r\\'+8hni?@\+8Yz 13U;60pE#[ _Q oN +3uTd2vf 篐5?M4o.&K9ӽlO-*_%]mlCUTWV#;_e1r#kdkie_Z|s]NPؙ ,[:KZz M-]L,ӖEhؙl,Ζ|h13IuKk;ߧ;a373鿀hW'?7f=&pVMq (쵒o[G" Nb#ί^N8MY p(l3ՊL;OT˂bѕ$V~%.I
*C+zn,o8JUUhS$fa>UP;Λ
?O
$pltjUguf@,5Vq=E$
>7r@sQlL|//807FLm
'ynNݣ wmbAy~3N0yU%,)DlY"5SRB.q3cP݇¼j; %^Rʙ:%F(pHĬkI,Pk:sE\ZQ>?F31j
pP5n.+1'
]t-dqy|W*` vE'2nc9)|Ay88AA?&8
{^!
$IkxB[\:кS3EQ9402Ȕ ߒc 0?TdgQP즅ƈ d{Δ*ڝ+Σpe:[KDùπ1녵A_<0 ROWM:ߪ!ѯФy
ϪY*{ tѻϚgJ#S6@h.l
4|_@`1}d垆TШ#Qi12 0`hTQz&vh