Hypervisor support for identifying covertly executing binaries

Proceedings of the 17th USENIX Security Symposium

Volumn , Issue , 2008, Pages 243-258

  Litty, Lionel ^a   Lagar Cavilla, H Andrés ^a   Lie, David ^a  

^a UNIVERSITY OF TORONTO   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

MALWARE; SEMANTICS;

BINARY FORMAT; CODE EXECUTION; CODE MODIFICATIONS; EXECUTABLES; HYPERVISORS; SECURITY TOOLS; SEMANTIC GAP; SOURCE CODES;

LINUX;

EID: 84855404052     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (35)

1. K. Adams and O. Agesen. A comparison of software and hardware techniques for x86 virtualization. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 2–13, Oct. 2006.
2. O. Agesen and P. Subrahmanyam. Method and system for performing virtual to physical address translations in a virtual machine. U.S. Patent 7069413, Dec. 2006.
3. K. Asrigo, L. Litty, and D. Lie. Using VMM-based sensors to monitor honeypots. In Proceedings of the 2nd International Conference on Virtual Execution Environments (VEE), pages 13–23, June 2006.
4. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In Proceedings of the 19th ACM Symposium on Operating Systems Principles (SOSP), pages 164–177, Oct. 2003.
5. D. Beck, B. Vo, and C. Verbowski. Detecting stealth software with Strider GhostBuster. In International Conference on Dependable Systems and Networks (DSN), pages 368–377, Apr. 2005.
6. P. M. Chen and B. D. Noble. When virtual is better than real. In 8th Workshop on Hot Topics in Operating Systems (HotOS), pages 133–138, May 2001.
7. B. Cogswell and M. Russinovich. RootkitRevealer v1.71, Nov. 2006.
8. J. C. Dehnert, B. K. Grant, J. P. Banning, R. Johnson, T. Kistler, A. Klaiber, and J. Mattson. The Transmeta Code Morphing™software: using speculation, recovery, and adaptive retranslation to address real-life challenges. In Proceedings of the International Symposium on Code Generation and Optimization (CGO), pages 15–24, Mar. 2003.
9. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Terra: A virtual machine-based platform for trusted computing. In Proceedings of the 19th ACM Symposium on Operating Systems Principles (SOSP), pages 193–206, Oct. 2003.
10. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proceedings of the 10th Symposium on Network and Distributed System Security (NDSS), pages 191–206, Feb. 2003.
11. J. A. Halderman and E. W. Felten. Lessons from the Sony CD DRM episode. In Proceedings of the 15th USENIX Security Symposium, pages 77–92, Aug. 2006.
12. G. Hoglund and J. Butler. Rootkits: Subverting the Windows Kernel. Addison Wesley, 2005.
13. X. Jiang, X. Wang, and D. Xu. Stealthy malware detection through VMM-based “out-of-the-box” semantic view reconstruction. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS), pages 128–138, Oct. 2007.
14. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. Antfarm: Tracking processes in a virtual machine environment. In Proceedings of the 2006 Annual Usenix Technical Conference, pages 1–14, May 2006.
15. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau. VMM-based hidden process detection and identification using Lycosid. In Proceedings of the 4th International Conference on Virtual Execution Environments (VEE), pages 91–100, Mar. 2008.
16. P. A. Karger, M. E. Zurko, D. W. Bonin, A. H. Mason, and C. E. Kahn. A VMM security kernel for the VAX architecture. In Proceedings of the 1990 IEEE Symposium on Security and Privacy, pages 2–19, 1990.
17. G. H. Kim and E. H. Spafford. The design and implementation of Tripwire: A file system integrity checker. In ACM Conference on Computer and Communications Security, pages 18–29, 1994.
18. L. Litty and D. Lie. Manitou: A layer-below approach to fighting malware. In Proceedings of the Workshop on Architectural and System Support for Improving Software Dependability (ASID), pages 6–11, Oct. 2006.
19. Microsoft. Visual Studio, Microsoft Portable Executable and Common Object File Format specification, May 2006. Rev. 8.0.
20. NIST. National software reference library, 2008. http://www.nsrl.nist.gov/.
21. M. Oberhumer, L. Molnár, and J. Reiser, 2008. http://upx.sourceforge.net/.
22. PaX, 2008. http://pax.grsecurity.net/.
23. N. L. Petroni Jr., T. Fraser, J. Molina, and W. A. Arbaugh. Copilot–a coprocessor-based kernel runtime integrity monitor. In Proceedings of the 13th USENIX Security Symposium, pages 179–194, Aug. 2004.
24. N. L. Petroni, Jr., T. Fraser, A. Walters, and W. A. Arbaugh. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. In Proceedings of the 15th USENIX Security Symposium, pages 289–304, July 2006.
25. N. L. Petroni, Jr. and M. Hicks. Automated detection of persistent kernel control-flow attacks. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS), pages 103–115, Oct. 2007.
26. P. Royal, M. Halpin, D. Dagon, R. Edmonds, and W. Lee. Polyunpack: Automating the hidden-code extraction of unpack-executing malware. In Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC), pages 289–300, Dec. 2006.
27. M. Russinovich. Process Explorer, 2007. http://technet.microsoft.com/sysinternals/bb896-653.aspx.
28. M. E. Russinovich and D. A. Solomon. Microsoft Windows Internals: Microsoft Windows Server 2003, Windows XP, and Windows 2000. Microsoft Press, 2005.
29. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In Proceedings of the 13th USENIX Security Symposium, pages 223–238, Aug. 2004.
30. A. Schuster. Reconstructing a binary, Apr. 2006. http://computer.forensikblog.de/en/2006/04/reconstructing a binary.html.
31. A. Seshadri, M. Luk, N. Qu, and A. Perrig. SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. In Proceedings of the 21st ACM Symposium on Operating Systems Principles (SOSP), Oct. 2007.
32. H. Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS), pages 552–61, Oct. 2007.
33. TIS Committee. Tool Interface Standard (TIS) Executable and Linking Format (ELF) specification, May 1995. V1.2.
34. P. C. van Oorschot, A. Somayaji, and G. Wurster. Hardware-assisted circumvention of self-hashing software tamper resistance. IEEE Transactions on Dependable and Secure Computing, 2(2):82–92, Apr.-June 2005.
35. E. Witchel, J. Cates, and K. Asanović. Mondrian memory protection. In Proceedings of the 10th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pages 304–316, Oct. 2002.