CommSec D2 - Hiding Tasks via Hardware Task Switching
summary
Claims that IA-32 hardware task switching can run a hidden scheduler that the OS and standard tools miss, demonstrated by installing a driver to achieve ring 0 via driver, modify GDT and TSS and create a custom TSS that the CPU switches into on CALL/JMP. Demos on Windows and Linux show a task consuming extra CPU while Task Manager reports ~55%, overall load exceeds 100% and timers desynchronize; popular rootkit/malware scanners fail to detect the GDT/TSS changes. Only 32‑bit tested, multi‑core and 64‑bit remain unexplored.
AI-written summary · about
chapters (12)
- 0:00Introduction and team overview
- 1:53Task switching concept explained
- 4:05Hardware vs software task switching
- 7:05Basic concept of hiding tasks
- 10:27TSS descriptor and demo setup
- 11:15Demo of hardware task switching
- 14:07Detection tool evasion results
- 14:49Coexistence of OS and hardware scheduler
- 19:28Problems and security risks
- 21:19Limitations and future work
- 23:12Contributions and conclusion
- 24:18Q&A session
related talks
35mOpening the Box: Diagnosing Operating-System Task-Scheduler...
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
21mPreview: Operating Systems
40mLatency hints for CFS task
18mScheduler Tracing With ftrace + eBPF
41mUsing Microarchitectural Design to Break KASLR and More
34mA Journey into Linux Interrupt Handling Bottom Halves
16mHarvesting Memory-bound CPU Stall Cycles in Software with MSH