Automated detection of persistent kernel control-flow attacks

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2007, Pages 103-115

  Petroni Jr , Nick L ^a   Hicks, Michael ^a  

^a University of Maryland ^*  (United States)

Author keywords

CFI; Integrity; Kernel; Rootkit; Virtualization

Indexed keywords

AUTOMATED DETECTION; CONTROL-FLOW; CONTROL-FLOW GRAPHS; CPU-INTENSIVE; NEW APPROACHES; OPERATING SYSTEM KERNEL; ROOTKITS; STATE-BASED; VIRTUAL MACHINE MONITORS; VIRTUALIZATIONS; WEB SERVERS;

COMPUTER OPERATING SYSTEMS;

QUALITY ASSURANCE;

EID: 50249114395     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1315245.1315260     Document Type: Conference Paper

References (39)

1. M. Abadi, M. Budiu, Ú. Erlingsson, and J. Ligatti. Control-flow integrity. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), Nov. 2005.
2. Aditya Kapoor and Ahmed Sallam. Rootkits Part 2: A Technical Primer. http://www.mcafee.com/us/local-content/white-papers/wp-rootkits-0407pdf, 2007.
3. A. Baliga, P. Kamat, and L. Iftode. Lurking in the Shadows: Identifying Systemic Threats to Kernel Data. In 2007 IEEE Symposium on Security and Privacy, May 2007.
4. E. Bangeman. Gartner: virtualization to rule server room by 2010. http://arstechnica.com/news.ars/post/20070508-gartner-virtualization-to-rule- server-room-by-2010.html, May 2007.
5. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), 2003.
6. H.-J. Boehm and M. Weiser. Garbage collection in an uncooperative environment. Software - Practice and Experience, 18 (9):807-820, 1988.
7. S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer. Non-Control-Data Attacks Are Realistic Threats. In Proceedings of the USENIX Security Symposium, Aug. 2005.
8. B. Cogswell and M. Russinovich. Microsoft rootkitrevealer. http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx, 2007.
9. J. Condit, M. Harren, Z. Anderson, D. Gay, and G. Necula. Dependent types for low-level programming. In Proceedings of th e Europea n Symposium on Programming (ESOP), Apr. 2007.
10. J. Condit, M. Harren, S. McPeak, G. C. Necula, and W. Weimer. CCured in the Real World. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), June 2003.
11. Ú. Erlingsson and F. B. Schneider. SASI Enforcement of Security Policies: a Retrospective. In Proceedings of the Workshop on New Security Paradigms, 2000.
12. F-Secure. F-secure blacklight. http://www.f-secure.com/blacklight/ blacklight.html, 2007.
13. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A Virtual-Machine Based Platform for Trusted Computing. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), Oct. 2003.
14. T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the Symposium on Network and Distributed System Security (NDSS), Feb. 2003.
15. J. Grizzard. Towards Self-Healing Systems: Re-establishing Trust in Compromised Systems. PhD thesis, Georgia Institute of Technology, 2006.
16. S. Hultquist. Are rootkits the next big threat to enterprises? http://www2.csoonline.com/blog-view.html?CID=32882, Apr. 2007.
17. T. Jim, G. Morrisett, D. Grossman, M. Hicks, J. Cheney, and Y. Wang. Cyclone: A safe dialect of C. In Proceedings of the USENIX Annual Technical Conference, June 2002.
18. R. Kennell and L. H. Jamieson. Estabilishing the Genuity of Remote Computer Systems. In Proceedings of the USENIX Security Symposium, Aug. 2003.
19. T. Klein. Rootkit profiler LX. http://www.trapkit. de/research/ rkprofiler/rkplx/rkplx.html, 2007.
20. L. Litty and D. Lie. Manitou: a layer-below approach to fighting malware. In Proceedings of the Workshop on Architectural and system support for improving software dependability (ASID), 2006.
21. G. C. Necula, S. McPeak, S. P. Rahul, and W. Weimer. CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs. In Proceedings of the International Conference on Compiler Construction (CC), Apr. 2002.
22. G. C. Necula, S. McPeak, and W. Weimer. Ccured: type-safe retrofitting of legacy code. In Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages (POPL), 2002.
23. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor. In Proceedings of the USENIX Security Symposium, Aug. 2004.
24. N. L. Petroni, T. Fraser, A. Walters, and W. A. Arbaugh. An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data. In Proceedings of the USENIX Security Symposium, Aug. 2006.
25. N. L. Petroni and M. Hicks. Automated detection of persistent kernel control-flow attacks (extended version). Technical Report CS-TR-4880, Department of Computer Science, University of Maryland, Sep. 2007.
26. H. Saidi. Guarded models for intrusion detection. In Proceedings of the ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), June 2007.
27. R. Sailer, T. Jaeger, X. Zhang, and L. van Doorn. Attestation-based Policy Enforcement for Remote Access. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), Nov. 2004.
28. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and Implementation of a TCG-based Integrity Measurement Architecture. In Proceedings of the USENIX Security Symposium, Aug. 2004.
29. A. Seshadri, M. Luk, E. Shi, A. Perrig, L. van Doorn, and P. Khosla. Pioneer: Verifying Code Integrity and Enforcing Untampered Code Execution on Legacy Systems. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), Oct. 2005.
30. A. Seshadri, A. Perrig, L. van Doorn, and P. Khosla. SWATT: SoftWare-based ATTestation for Embedded Devices. In Proceedings of the IEEE Symposium on Security and Privacy, May 2004.
31. E. Shi, A. Perrig, and L. V. Doorn. BIND: A Fine-grained Attestation Service for Secure Distributed Systems. In Proceedings of the IEEE Symposium on Security and Privacy, May 2005.
32. Solar Designer. Getting around non-executable stack (and fix). Bugtraq, Aug. 1997.
33. SPEC. Standard Performance Evaluation Corporation. http://www.spec.org, 2007.
34. N. Swamy, M. Hicks, G. Morrisett, D. Grossman, and T. Jim. Safe manual memory management in cyclone. Science of Computer Programming (SCP), 62 (2):122-144, Oct. 2006. Special issue on memory management.
35. V Mware, Inc. V Mware Workstation. http://www.vmware.com, 2007.
36. R. Wahbe, S. Lucco, T. E. Anderson, and S. L. Graham. Efficient Software-Based Fault Isolation. In Proceedings of the ACM Symposium on Operating Systems Principles (SOSP), December 1993.
37. Xen Source, Inc. A Performance Comparison of Commercial Hypervisors. http://www.xensource.com/files/hypervisor-performance-comparison-1-0-5-with-esx- datapdf, 2007.
38. X. Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer. Secure Coprocessor-based Intrusion Detection. In Proceedings of the ACM SIGOPS European Workshop, Sep. 2002.
39. F. Zhou, J. Condit, Z. Anderson, I. Bagrak, R. Ennals, M. Harren, G. Necula, and E. Brewer. Safedrive: Safe and recoverable extensions using language-based techniques. In Proceedings of the Symposium on Operating System Design and Implementation (OSDI), Nov. 2006.