📢 Honored to return to Yale University last week to speak at the Department of Computer Science colloquium on Operating Systems security -- exactly 10 years after my first talk there on the same topic!
In this "tin anniversary" edition, I reflected on how OS kernel exploitation and defense have evolved over the past decade, and shared highlights from some of our recent work in the field over the last five years:
✳️ xMP (IEEE S&P 2020: 📄 https://cs.brown.edu/~vpk/papers/xmp.sp20.pdf, 💾 https://github.com/virtsec/xmp) — Selective intra-kernel memory isolation using hardware-assisted virtualization.
✳️ SafeSLAB (ACM CCS 2024: 📄 https://cs.brown.edu/~vpk/papers/safeslab.ccs24.pdf, 💾 https://github.com/tum-itsec/safeslab) — Kernel heap hardening through memory tagging.
✳️ EPF (USENIX ATC 2023: 📄 https://cs.brown.edu/~vpk/papers/epf.atc23.pdf, 💾 https://gitlab.com/brown-ssl/epf) — Exploiting the (e)BPF sub-system for bypassing modern protections and ways to fix this.
(Joint work with @mikepo, Marius Momeu, Vaggelis Atlidakis, @dijin, and Sergej Proskurin.)
If this area of research interests you, you might also find our recent work on BeeBox (strengthening eBPF against transient execution attacks, USENIX Security 2024: 📄 https://cs.brown.edu/~vpk/papers/beebox.sec24.pdf, 💾 https://gitlab.com/brown-ssl/beebox) and IUBIK (leveraging memory tagging and pointer authentication to isolate attacker-controlled data in kernel space, to appear in IEEE S&P 2025) worth a look.
It was a real pleasure catching up with friends, colleagues, and students. And with the spring weather fully cooperating, I couldn't resist snapping a few photos of Yale's beautiful campus in the early morning light.
Thank you to my host Charalampos Papamanthou and the Yale CS department for the warm welcome and thoughtful discussion!
