Defeating return-oriented rootkits with "return-Less" kernels

EuroSys'10 - Proceedings of the EuroSys 2010 Conference

Volumn , Issue , 2010, Pages 195-208

  Li, Jinku ^a   Wang, Zhi ^a   Jiang, Xuxian ^a   Grace, Michael ^a   Bahram, Sina ^a  

^a NORTH CAROLINA STATE UNIVERSITY   (United States)

Author keywords

defense; return less kernel; return oriented rootkits

Indexed keywords

COMMODITY HARDWARE; EVALUATION RESULTS; FREEBSD; KEY TECHNIQUES; MALICIOUS CODES; OPCODES; OPERATING SYSTEMS; REGISTER ALLOCATION; ROOTKITS;

COMPUTER OPERATING SYSTEMS;

EID: 77954614533     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1755913.1755934     Document Type: Conference Paper

References (48)

1. Driver Signing Requirements for Windows. http://www.microsoft.com/whdc/ winlogo/drvsign/drvsign.mspx.
2. The LLVM Target-Independent Code Generator. http://llvm. org/docs/CodeGenerator.html.
3. W.X. http://en.wikipedia.org/wiki/W.X,.
4. Peephole Optimization. http://en.wikipedia.org/wiki/Peephole optimization, .
5. Xinu. http://en.wikipedia.org/wiki/Xinu.
6. M. Abadi, M. Budiu, Úlfar Erilingsson, and J. Ligatti. Control-Flow Integrity. In Proceedings of the 12th ACM Conference on Computer and Communications Security, October 2005.
7. AMD64 Architecture Programmers Manual Volume 3: General-Purpose and System Instructions. Advanced Micro Devices, 3.14 edition, September 2007.
8. P. Akritidis, M. Costa, M. Castro, and S. Hand. Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors. In Proceedings of the 18th USENIX Security Symposium, August 2009.
9. Apache. Apache HTTP Server Project. http://httpd.apache.org/.
10. ApacheBench. http://httpd.apache.org/docs/2.2/programs/ab.html.
11. E. Buchanan, R. Roemer, H. Shacham, and S. Savage. When Good Instructions Go Bad: Generalizing Return-Oriented Programming to RISC. In Proceedings of the 15th ACM Conference on Computer and Communications Security, October 2008.
12. M. Castro, M. Costa, and T. Harris. Securing Software by Enforcing Data-Flow Integrity. In Proceedings of the 7th USENIX Symposium on Operating Systems Design and Implementation, November 2006.
13. G. J. Chaitin, M. A. Auslander, A. K. Chandra, J. Cocke, M. E. Hopkins, and P. W. Markstein. Register Allocation Via Coloring. Computer Languages, 6:47-57, 1981.
14. C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, Q. Zhang, and H. Hinton. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proceedings of the 7th USENIX Security Symposium, January 1998.
15. J. Criswell, N. Geoffray, and V. Adve. Memory Safety for Low-Level Software/Hardware Interactions. In Proceedings of the 18th USENIX Security Symposium, August 2009.
16. D. Dhurjati and V. Adve. Backwards-Compatible Array Bounds Checking for C with Very Low Overhead. In Proceedings of the 28th International Conference on Software Engineering, May 2006.
17. H. Etoh. GCC extension for protecting applications from stack-smashing attacks. http://www.trl.ibm.com/projects/security/ssp/.
18. T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proceedings of the 10th Annual Network & Distributed System Security Symposium, February 2003.
19. R. Hund, T. Holz, and F. C. Freiling. Return-Oriented Rootkits: Bypasssing Kernel Code Integrity ProtectionMechanisms. In Proceedings of the 18th USENIX Security Symposium, August 2009.
20. X. Jiang, X. Wang, and D. Xu. Stealthy Malware Detection Through VMM-Based "Out-of-the-Box" Semantic View Reconstruction. In Proceedings of the 14th ACM Conference on Computer and Communications Security, October 2007.
21. T. Jim, J. G. Morrisett, D. Grossman, M. W. Hicks, J. Cheney, and Y.Wang. Cyclone: A Safe Dialect of C. In Proceedings of the 2002 USENIX Annual Technical Conference, June 2002.
22. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure Execution Via Program Shepherding. In Proceedings of the 11th USENIX Security Symposium, August 2002.
23. C. Kruegel, W. Robertson, and G. Vigna. Detecting Kernel- Level Rootkits Through Binary Analysis. In Proceedings of the 20th Annual Computer Security Applications Conference, December 2004.
24. A. Lanzi, M. Sharif, and W. Lee. K-Tracer: A System for Extracting Kernel Malware Behavior. In Proceedings of the 16th Annual Network & Distributed System Security Symposium, February 2009.
25. C. Lattner and V. Adve. LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In Proceedings of the 2004 International Symposium on Code Generation and Optimization, March 2004.
26. LMbench. LMbench - Tools for Performance Analysis. http://www.bitmover. com/lmbench/lmbench.html/.
27. W. M. McKeeman. Peephole Optimization. Communications of the ACM, 8:443-444, 1965.
28. M. K. McKusick and G. V. Neville-Neil. The Design and Implementation of the FreeBSD Operating System. Addison-Wesley Professional, 2004. ISBN 0-201-70245-2.
29. S. Nagarakatte, J. Zhao, M. M. K. Martin, and S. Zdancewic. SoftBound: Highly Compatible and Complete Spatial Memory Safety for C. In Proceedings of the ACM SIGPLAN 2009 Conference on Programming Language Design and Implementation, June 2009.
30. G. C. Necula, J. Condit, M. Harren, S. McPeak, and W. Weimer. CCured: Type-Safe Retrofitting of Legacy Software. ACM Transactions on Programming Languages and Systems, 27:477-526, 2005.
31. H. Ozdoganoglu, T. N. Vijaykumar, C. E. Brodley, B. A. Kupperman, and A. Jalote. SmashGuard: A Hardware Solution to Prevent Security Attacks on the Function Return Address. IEEE Transactions on Computers, 55:1271-1285, 2006.
32. B. D. Payne, M. Carbone, M. I. Sharif, and W. Lee. Lares: An Architecture for Secure Active Monitoring Using Virtualization. In Proceedings of the 2008 IEEE Symposium on Security and Privacy, May 2008.
33. F. M. Q. Pereira and J. Palsberg. Register Allocation After Classical SSA Elimination is NP-Complete. In Proceedings of the 9th International Conference on Foundations of Software Science and Computation Structures, March 2006.
34. N. L. Petroni and M. Hicks. Automated Detection of Persistent Kernel Control-Flow Attacks. In Proceedings of the 14th ACMConference on Computer and Communications Security, October 2007.
35. N. L. Petroni, T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor. In Proceedings of the 13th Conference on USENIX Security Symposium, August 2004.
36. N. L. Petroni, T. Fraser, A. Walters, and W. A. Arbaugh. An Architecture for Specification-Based Detection of Semantic Integrity Violations in Kernel Dynamic Data. In Proceedings of the 15th USENIX Security Symposium, July 2006.
37. M. Poletto and V. Sarkar. Linear Scan Register Allocation. ACM Transactions on Programming Languages and Systems, 21:895-913, 1999.
38. R. Riley, X. Jiang, and D. Xu. Guest-Transparent Prevention of Kernel Rootkits with VMM-based Memory Shadowing. In Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection, September 2008.
39. R. Riley, X. Jiang, and D. Xu. Multi-Aspect Profiling of Kernel Rootkit Behavior. In Proceedings of the 4th ACM European Conference on Computer Systems, March 2009.
40. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A Tiny Hypervisor to Provide Lifetime Kernel Code Integrity for Commodity OSes. In Proceedings of the 21st ACM Symposium on Operating Systems Principles, October 2007.
41. H. Shacham. The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). In Proceedings of the 14th ACM Conference on Computer and Communications Security, October 2007.
42. T. Shinagawa, H. Eiraku, K. Tanimoto, K. Omote, S. Hasegawa, T. Horie, M. Hirano, K. Kourai, Y. Oyama, E. Kawai, K. Kono, S. Chiba, Y. Shinjo, and K. Kato. BitVisor: A Thin Hypervisor for Enforcing I/O Device Security. In Proceedings of the 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, March 2009.
43. Vendicator. Stack Shield: A "stack smashing" technique protection tool for Linux. http://www.angelfire.com/sk/stackshield/info.html.
44. Y.-M. Wang, D. Beck, B. Vo, R. Roussev, and C. Verbowski. Detecting Stealth Software with Strider GhostBuster. In Proceedings of the 2005 International Conference on Dependable Systems and Networks, June 2005.
45. Z. Wang, X. Jiang, W. Cui, and P. Ning. Countering Kernel Rootkits with Lightweight Hook Protection. In Proceedings of the 16th ACM Conference on Computer and Communication Security, October 2009.
46. X. Yang, N. Cooprider, and J. Regehr. Eliminating the Call Stack to Save RAM. In Proceedings of the ACM Conference on Languages, Compilers, and Tools for Embedded Systems, June 2009.
47. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security, October 2007.
48. H. Yin, Z. Liang, and D. Song. HookFinder: Identifying and Understanding Malware Hooking Behaviors. In Proceedings of the 16th Annual Network & Distributed System Security Symposium, February 2008.