Defeating dynamic data kernel rootkit attacks via VMM-based guest-transparent monitoring

Proceedings - International Conference on Availability, Reliability and Security, ARES 2009

Volumn , Issue , 2009, Pages 74-81

  Rhee, Junghwan ^a   Riley, Ryan ^a   Xu, Dongyan ^a   Jiang, Xuxian ^b  

^a Purdue University   (United States)

^b North Carolina State University   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CODE INJECTION; CODE INTEGRITY; DATA STATE; DYNAMIC DATA; ENTIRE SYSTEM; KERNEL MEMORY; MEMORY ACCESS; OPERATING SYSTEM KERNEL; ROOTKITS; VIRTUAL MACHINE MONITORS;

COMPUTER OPERATING SYSTEMS;

EID: 70349665533     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ARES.2009.116     Document Type: Conference Paper

References (27)

1. Stealth, adore-0.42. http://stealth.7350.org/rootkits.
2. Stealth, "adore-ng-0.53," http://stealth.7350.org/rootkits.
3. fuzen op, "FU rootkit," https://www.rootkit.com/vault/fuzen op/FU Rootkit.zip.
4. P. Silverman and C.H.A.O.S., "FUTo," http://www.rootkit.com/ newsread.php?newsid=433.
5. Fanbot, "W32/Fanbot.A@mm," http://www.symantec.com/security response/writeup.jsp?docid=2005-101715-5745-99.
6. E. Florio, "When Malware meets Rootkits," http://www.symantec. com/ avcenter/reference/when.malware.meets.rootkits.pdf.
7. A. Seshadri, M. Luk, N. Qu, and A. Perrig, "SecVisor: A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes,"in SOSP '07: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, ACM, 2007.
8. Ryan Riley and Xuxian Jiang and Dongyan Xu, "Guest-Transparent Prevention of Kernel Rootkits with VMM-based Memory Shadowing," in RAID 2008: Proceedings of 11th International Symposium on Recent Advances in Intrusion Detection, 2008.
9. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh, "Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor," in Proceedings for the 13th USENIX Security Symposium, August 2004.
10. N. L. Petroni and M. Hicks, "Automated Detection of Persistent Kernel Control-Flow Attacks," in CCS '07: Proceedings of the 14th ACM conference on Computer and communications security, (New York, NY, USA), pp. 103-115, ACM, 2007.
11. M. Boelen, "Rootkit Hunter 1.2.9," http://rkhunter.sourceforge. net/.
12. N. Murilo and K. Steding-Jessen, "chkrootkit V. 0.47," http://www. chkrootkit.org.
13. F-Secure, "F-Secure Blacklight," http://www.f-secure.com/ blacklight/ blacklight.html.
14. B. Cogswell and M. Russinovich, "RootkitRevealer v1.71," http://www. microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx.
15. pjf , "IceSword 1.20," http://www.blogcn.com/user17/pjf/index. html.
16. T. Lalwess, "Saint Jude," http://www.sourceforge.net/projects/ stjude.
17. Foundstone, "Carbonite - a rootkit detection and analyzer," http://www. foundstone.com/rdlabs/proddesc/carbonite.html.
18. J. Butler, "DKOM (Direct Kernel Object Manipulation)," http://www. blackhat.com/presentations/win-usa-04/bh-win-04-butler.pdf.
19. K. J. Jones, "Loadable Kernel Modules," ;login: The Magazine of USENIX and SAGE, 26(7), November 2001.
20. devik and sd, "Linux on-the-fly kernel patching without LKM," http: //www.phrack.org/issues.html?id=7&issue=58.
21. P. M. Chen and B. D. Noble, "When Virtual Is Better Than Real," in HOTOS '01: Proceedings of the Eighth Workshop on Hot Topics in Operating Systems, IEEE Computer Society, 2001.
22. B. D. Payne, M. Carbone, M. Sharif, and W. Lee, "Lares: An Architecture for Secure Active Monitoring Using Virtualization," in Oakland '08: Proceedings of 2008 IEEE Symposium on Security and Privacy, (Oakland, CA, USA), IEEE Computer Society, 2008.
23. N. L. Petroni, T. Fraser, A. Walters, and W. A. Arbaugh, "An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data," in Proceedings for the 15th USENIX Security Symposium, (Vancouver, B.C., Canada), July 2006.
24. T. Garfinkel and M. Rosenblum, "A Virtual Machine Introspection Based Architecture for Intrusion Detection," in Proceedings of the 10th Annual Network and Distributed Systems Security Symposium, February 2003.
25. S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer, "Non-Control- Data Attacks Are Realistic Threats," in SSYM'05: Proceedings of the 14th conference on USENIX Security Symposium, 2005.
26. P. Zhou and W. Liu and F. Long and S. Lu and F. Qin and Y. Zhou and S. Midkiff and J. Torrellas, "Accmon: Automatically detecting memoryrelated bugs via program counter-based invariants," in MICRO-37:Proceedings of the 37th International Symposium on Microarchitecture,2004.
27. Emre C. Sezer and Peng Ning and Chongkyung Kil and Jun Xu, "Memsherlock: an automated debugger for unknown memory corruption vulnerabilities," in CCS '07: Proceedings of the 14th ACM conference on Computer and communications security, ACM, 2007.