Soft-timer driven transient kernel control flow attacks and defense

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2008, Pages 97-107

  Wei, Jinpeng ^a   Payne, Bryan D ^a   Giffin, Jonathon ^a   Pu, Calton ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CONTROL FLOWS; CPU CYCLES; FALSE NEGATIVES; FALSE POSITIVES; MALWARE; NEW CLASS; REFERENCE MONITORS; RUN-TIME; TIMER DRIVEN; VIRTUAL MACHINES;

COMPUTER CRIME; SECURITY SYSTEMS;

BENCHMARKING;

EID: 60649107135     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2008.40     Document Type: Conference Paper

References (28)

1. M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti. Control-flow integrity. In ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, Nov. 2005.
2. W. A. Arbaugh, D. J. Farber, and J. M. Smith. A secure and reliable bootstrap architecture. In IEEE Symposium on Security and Privacy, Oakland, CA, May 1997.
3. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In ACM Symposium on Operating Systems Principles (SOSP), Bolton Landing, NY, Oct. 2003.
4. D. Bovet and M. Cesati. Understanding the Linux Kernel, Second Edition. O'Reilly, Dec. 2002.
5. D. Brumley. Invisible intruders: rootkits in practice. ;login:, 24, Sept. 1999.
6. T. c. Chiueh, G. Venkitachalam, and P. Pradhan. Integrating segmentation and paging protection for safe, efficient and transparent software extensions. In 17th ACM Symposium on Operating Systems Principles (SOSP), Charleston, SC, Dec. 1999.
7. H. Chen and D. Wagner. MOPS: an infrastructure for examining security properties of software. In 9th ACM Conference on Computer and Communications Security (CCS), Washington, DC, Nov. 2002.
8. C. Consel and O. Danvy. Tutorial notes on partial evaluation. In 20th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), Charleston, SC, Jan. 1993.
9. C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang, and H. Hinton. Stack-Guard: Automatic adaptive detection and prevention of buffer-overflow attacks. In 7th USENIX Security Symposium, San Antonio, TX, Jan. 1998.
10. D. Engler and K. Ashcraft. RacerX: Effective, static detection of race conditions and deadlocks. In ACM Symposium on Operating Systems Principles (SOSP), Bolton Landing, NY, Oct. 2003.
11. U. Erlingsson and F. Schneider. IRM enforcement of Java stack inspection. In IEEE Symposium on Security and Privacy, Oakland, CA, May 2000.
12. S. Hultquist. Are rootkits the next big threat to enterprises? http://www2.csoonline.com/blog\-view.html?CID=32882, Apr. 2007.
13. G. Kim and E. Spafford. The design and implementation of Tripwire: A file system integrity checker. In 2nd ACM Conference on Computer and Communications Security (CCS), Fairfax, VA, Nov. 1994.
14. S. Lu, S. Park, C. Hu, X. Ma, W. Jiang, Z. Li, R. Popa, and Y. Zhou. MUVI: Automatically inferring multi-variable access correlations and detecting related semantic and con-currency bugs. In ACM Symposium on Operating Systems Principles (SOSP), Stevenson, WA, Oct. 2007.
15. G. Necula, S. McPeak, S. Rahul, and W. Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In Conference on Compiler Construction (CC), Grenoble, France, Apr. 2002.
16. B. Payne, M. Carbone, and W. Lee. Secure and flexible monitoring of virtual machines. In 23rd Annual Computer Security Applications Conference (ACSAC), Miami, FL, Dec. 2007.
17. B. Payne, M. Carbone, M. Sharif, and W. Lee. Lares: An architecture for secure active monitoring using virtualization. In IEEE Symposium on Security and Privacy, Oakland, CA, May 2008.
18. N. Petroni, Jr., T. Fraser, J. Molina, and W. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In 13th USENIX Security Symposium, San Diego, CA, Aug. 2004.
19. N. Petroni, Jr., T. Fraser, A. Walters, and W. A. Arbaugh. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In 15th USENIX Security Symposium, Vancouver, BC, Aug. 2006.
20. N. Petroni, Jr. and M. Hicks. Automated detection of persistent kernel control-flow attacks. In 14th ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, Oct. 2007.
21. rd. Writing linux kernel keylogger. Phrack, 59(11), June 2002.
22. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In 13th USENIX Security Symposium, San Diego, CA, Aug. 2004.
23. J. Saltzer and M. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 63(9), Sept. 1975.
24. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. In ACM Symposium on Operating Systems Principles (SOSP), Stevenson, WA, Oct. 2007.
25. A. Seshadri, M. Luk, E. Shi, a. Perrig, L. van Doorn, and P. Khosla. Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. In ACM Symposium on Operating Systems Principles (SOSP), Brighton, United Kingdom, Oct. 2005.
26. Solar Designer. Getting around non-executable stack (and fix). Bugtraq, Aug. 1997.
27. D. Tsafrir, Y. Etsion, and D. Feitelson. Secretly monopolizing the CPU without superuser privileges. In USENIX Security Symposium, Boston, MA, Aug. 2007.
28. D. Wagner and D. Dean. Intrusion detection via static analysis. In IEEE Symposium on Security and Privacy, Oakland, CA, May 2001.