20.500.12556/RUL-160375 Napadi DMA na operacijske sisteme Windows DMA attacks on Windows operating systems Neposreden dostop do pomnilnika (angl., Direct Memory Access, DMA) je tehnologija, ki omogoča hitrejši prenos podatkov med posameznimi deli strojne opreme brez obremenjevanja centralne procesne enote, hkrati pa ustvari potencialne ranljivosti, katere lahko napadalci zlorabijo za nedovoljen dostop do pomnilnika ali drugih občutljivih podatkov. Namen naloge je preučiti napade na DMA, osredotočene na operacijske sisteme Windows. Predstavljenih je več primerov izvedbe napada, vključno z manipulacijo datotečnega sistema, vzpostavljanjem lupin na zaklenjenih sistemih in branjem pomnilnika. Analizirani so potrebni strojni in programski pripomočki, kot so Screamer PCIe Squirrel in PCILeech, ter njihovo delovanje in omejitve. Naloga vključuje tudi predlog vzpostavitve zaščitnih ukrepov, kot so varni zagon (angl., Secure Boot), zaščita jedra DMA in sistemov za zaznavanje napadov (angl., Endpoint Detection and Response, EDR), ki pomagajo pri zaznavi in preprečevanju teh napadov. Direct Memory Access (DMA) is a technology that allows faster data transfer between individual pieces of hardware without burdening the central processing unit; it also creates potential vulnerabilities that can be exploited by attackers to gain unauthorised access to memory or other sensitive data. The purpose of this thesis is to investigate DMA attacks targeting Windows operating systems. Several examples of attack execution are presented, including file system manipulation, memory dumping, shell creation on locked systems and reading the main memory. The necessary hardware and software tools, such as Screamer PCIe Squirrel and PCILeech, are analysed, in regards to their performance and limitations. The task also includes a reccomendation for implementation of safeguards such as Secure Boot, DMA kernel protection and EDR systems, which aid in detecting and preventing these attacks. DMA Windows napad ranljivost DMA Windows attack vulnerability true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2024-08-27 10:05:00 2024-08-27 10:05:03 2024-09-20 06:43:54 0000-00-00 00:00:00 2024 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 37595 208252419 Dorn_Jakob_-_Napadi_DMA_na_operacijske_sisteme_Windows.pdf Dorn_Jakob_-_Napadi_DMA_na_operacijske_sisteme_Windows.pdf 1 DC637568F280ECF8465BB04205DED8B9 f2f25387496ed210986d23fbf14cef8fa7d5af8c5e3f2e04452fc04d8f3d3f35 d73459f7-644a-11ef-8f74-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=189021 Fakulteta za računalništvo in informatiko 0 0 0