Hypervisor-based prevention of persistent rootkits

Proceedings of the ACM Symposium on Applied Computing

Volumn , Issue , 2010, Pages 214-220

  Chubachi, Yosuke ^a   Shinagawa, Takahiro ^a   Kato, Kazuhiko ^a  

^a UNIVERSITY OF TSUKUBA   (Japan)

Author keywords

file system; hypervisor; persistent rootkit; security

Indexed keywords

CRITICAL SYSTEMS; FILE SYSTEMS; HYPERVISOR; I/O DEVICE; LINES OF CODE; PROTECTION SCHEMES; ROOTKITS; SECURITY POLICY; SECURITY THREATS; WINDOWS XP;

SECURITY SYSTEMS;

SECURITY OF DATA;

EID: 77954753240     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1774088.1774131     Document Type: Conference Paper

References (24)

1. A. C. Arpaci-Dusseau and R. H. Arpaci-Dusseau. Information and control in gray-box systems. In Proc. of the 18th ACM Symposium on Operating Systems Principles (SOSP '01), pages 43-56, Oct. 2001.
2. K. R. Butler, S. McLaughlin, and P. D. McDaniel. Rootkit-resistant disks. In Proc. of the 15th ACM Conference on Computer and Communications Security (CCS 2008), pages 403-416, Nov. 2008.
3. P. M. Chen and B. D. Noble. When virtual is better than real. In Proc. of the 8th Workshop on Hot Topics in Operating Systems, pages 133-138, May 2001.
4. X. Chen, T. Garfinkel, E. C. Lewis, P. Subrahmanyam, C. A. Waldspurger, D. Boneh, J. Dwoskin, and D. R. Ports. Overshadow: A virtualization-based approach to retrofitting protection in commodity operating systems. In Proc. of the 13th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS XIII), pages 2-13, Mar. 2008.
5. B. Cogswell and M. Russinovich. RootkitRevealer. http://technet. microsoft.com/sysinternals/bb897445.aspx.
6. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. of the 10th Annual Network and Distributed System Security Symposium (NDSS '03), pages 191-206, Feb. 2003.
7. Intel Corporation. Iometer. http://www.iometer.org.
8. X. Jiang, X. Wang, and D. Xu. Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction. In Proc. of the 14th ACM Conference on Computer and Communications Security (CCS 2007), pages 128-137, Oct. 2007.
9. G. H. Kim and E. H. Spafford. The design and implementation of tripwire: A file system integrity checker. In Proc. of the 1st ACM Conference on Computer and Communications Security (CCS '94), pages 18-29, Nov. 1994.
10. K. Kourai and S. Chiba. HyperSpector: Virtual distributed monitoring environments for secure intrusion detection. In Proc. of the 1st ACM/USENIX International Conference on Virtual Execution Environments (VEE 2005), pages 197-207, June 2005.
11. L. Litty, H. A. Lagar-Cavilla, and D. Lie. Hypervisor support for identifying covertly executing binaries. In Proc. of the 17th USENIX Security Symposium, pages 243-258, July 2008.
12. Microsoft Corporation. Microsoft extensible firmware initiative FAT32 file system specification, Dec. 2000.
13. D. G. Murray, G. Milos, and S. Hand. Improving xen security through disaggregation. In Proc. of the 4th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE 2008), pages 151-160, Mar. 2008.
14. S. Patil, A. Kashyap, G. Sivathanu, and E. Zadok. I3FS: An in-kernel integrity checker and intrusion detection file system. In Proc. of the 18th Systems Administration Conference, pages 67-78, Nov. 2004.
15. N. A. Quynh and Y. Takefuji. Towards a tamper-resistant kernel rootkit detector. In Proc. of the 2007 ACM Symposium on Applied Computing (SAC 2007), pages 276-283, Mar. 2007.
16. R. Riley, X. Jiang, and D. Xu. Guest-transparent prevention of kernel rootkits with vmm-based memory shadowing. In Proc. of the 7th International Symposium on Recent Advances in Intrusion Detection(RAID 2008), pages 1-20, Sept. 2008.
17. G. Sala, D. Sgandurra, and F. Baiardi. Security and integrity of a distributed file storage in a virtual environment. In Proc. of the 4th International IEEE Security in Storage Workshop, pages 58-69, Sept. 2007.
18. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity oses. In Proc. of the 21st ACM Symposium on Operating Systems Principles (SOSP '07), pages 335-350, Oct. 2007.
19. T. Shinagawa, H. Eiraku, K. Tanimoto, K. Omote, S. Hasegawa, T. Horie, M. Hirano, K. Kourai, Y. Oyama, E. Kawai, K. Kono, S. Chiba, Y. Shinjo, and K. Kato. BitVisor: A thin hypervisor for enforcing I/O device security. In Proc. of the 5th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE 2009), pages 121-130, Mar. 2009.
20. M. Sivathanu, V. Prabhakaran, F. I. Popovici, T. E. Denehy, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Semantically-smart disk systems. In Proc. of the 2nd USENIX Conference on File and Storage Technologies(FAST '03), pages 73-88, Mar. 2003.
21. L. Stevenson and N. Altholz. Rootkits for Dummies. For Dummies, 2007.
22. Z. Wang, X. Jiang, W. Cui, and P. Ning. Countering kernel rootkits with lightweight hook protection. In Proc. of the 16th ACM Conference on Computer and Communications Security (CCS 2009), Nov. 2009.
23. Y. Zhang, Y. Gu, H. Wang, and D. Wang. Virtual-machine-based intrusion detection on file-aware block level storage. In Proc. of the 18th International Symposium on Computer Architecture and High Performance Computing (SBAC-PAD '06), pages 185-192, Oct. 2006.
24. X. Zhao, K. Borders, and A. Prakash. Towards protecting sensitive files in a compromised system. In Proc. of the 3rd International IEEE Security in Storage Workshop, pages 21-28, Dec. 2005.