Shepherding Loadable Kernel Modules through On-demand Emulation

Authors:
Chaoting Xuan;John Copeland;Raheem Beyah
Affiliations:
School of Electrical and Computer Engineering, Georgia Institute of Technology,;School of Electrical and Computer Engineering, Georgia Institute of Technology,;School of Electrical and Computer Engineering, Georgia Institute of Technology, and Department of Computer Science, Georgia State University,
Venue:
DIMVA '09 Proceedings of the 6th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Year:
2009

Citing 22
Cited 1

Secure Execution via Program Shepherding

Proceedings of the 11th USENIX Security Symposium
Detecting Kernel-Level Rootkits Through Binary Analysis

ACSAC '04 Proceedings of the 20th Annual Computer Security Applications Conference
Rootkits: Subverting the Windows Kernel

Rootkits: Subverting the Windows Kernel
Detecting Stealth Software with Strider GhostBuster

DSN '05 Proceedings of the 2005 International Conference on Dependable Systems and Networks
Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems

Proceedings of the twentieth ACM symposium on Operating systems principles
SubVirt: Implementing malware with virtual machines

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Secure coprocessor-based intrusion detection

EW 10 Proceedings of the 10th workshop on ACM SIGOPS European workshop
Practical taint-based protection using demand emulation

Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006
Copilot - a coprocessor-based kernel runtime integrity monitor

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Lurking in the Shadows: Identifying Systemic Threats to Kernel Data

SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
An architecture for specification-based detection of semantic integrity violations in kernel dynamic data

USENIX-SS'06 Proceedings of the 15th conference on USENIX Security Symposium - Volume 15
lmbench: portable tools for performance analysis

ATEC '96 Proceedings of the 1996 annual conference on USENIX Annual Technical Conference
SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes

Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles
Automated detection of persistent kernel control-flow attacks

Proceedings of the 14th ACM conference on Computer and communications security
Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction

Proceedings of the 14th ACM conference on Computer and communications security
VMM-based hidden process detection and identification using Lycosid

Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
Cloaker: Hardware Supported Rootkit Concealment

SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Countering Persistent Kernel Rootkits through Systematic Hook Discovery

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Automatic Inference and Enforcement of Kernel Data Structure Invariants

ACSAC '08 Proceedings of the 2008 Annual Computer Security Applications Conference
Hypervisor support for identifying covertly executing binaries

SS'08 Proceedings of the 17th conference on Security symposium
A forced sampled execution approach to kernel rootkit identification

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection

Toward Revealing Kernel Malware Behavior in Virtual Execution Environments

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Despite many advances in system security, rootkits remain a threat to major operating systems. First, this paper discusses why kernel integrity verification is not sufficient to counter all types of kernel rootkits and a confidentiality-violation rootkit is demonstrated to evade all integrity verifiers. Then, the paper presents, DARK, a rootkit prevention system that tracks a suspicious loadable kernel module at a granite level by using on-demand emulation, a technique that dynamically switches a running system between virtualized and emulated execution. Combining the strengths of emulation and virtualization, DARK is able to thoroughly capture the activities of the target module in a guest OS, while maintaining reasonable run-time performance. To address integrity-violation and confidentiality-violation rootkits, we create a group of security policies that can detect all avialiable Linux rootkits. Finally, it is shown that normal guest OS performance is unaffected. The performance is only decreased when rootkits attempt to run, while most rootkits are detected at installation.