DRIP: A framework for purifying trojaned kernel drivers

Proceedings of the International Conference on Dependable Systems and Networks

Volumn , Issue , 2013, Pages

  Gu, Zhongshu ^a   Sumner, William N ^a   Deng, Zhui ^a   Zhang, Xiangyu ^a   Xu, Dongyan ^a  

^a Purdue University   (United States)

Author keywords

Kernel Drivers; System Security; Trojan Detection

Indexed keywords

KERNEL DRIVERS; OPERATING SYSTEM KERNEL; RUNTIMES; SECURITY ACCESS; SYSTEM SECURITY; TROJAN DETECTIONS; TROJANS;

PERSONAL COMPUTING;

PURIFICATION;

EID: 84883401291     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN.2013.6575342     Document Type: Conference Paper

References (40)

1. Sony, Rootkits and Digital Rights Management Gone Too Far, http://blogs.technet.com/b/markrussinovich/archive/2005/10/31/ sonyrootkits-and-digital-rights-management-gone-too-far.aspx.
2. Legit bootkits, http://www.securelist.com/en/analysis/204792203/Legit bootkits.
3. Infecting loadable kernel modules, http://www.phrack.org/issues. html?issue=61&id=10#article.
4. Infecting loadable kernel modules kernel versions 2.6.x/3.0.x, http://www.phrack.org/issues.html?issue=68&id=11#article.
5. Module injection in 2.6 kernel, http://www.linuxforum.net/forum/showflat. php?Cat=&Board=security&Number=536404&page=0&view= collapsed&sb=5&o=31&fpart.
6. Driverless Kernel Mode Rootkit, http://www.rohitab.com/discuss/topic/ 28440-driverless-kernel-mode-rootkit.
7. Kernel Driver Backdooring, http://securitylabs.websense.com/content/ Blogs/2730.aspx.
8. The ERESI Reverse Engineering Software Interface, http://www.eresi- project.org.
9. M. M. Swift, B. N. Bershad, and H. M. Levy, Improving the Reliability of Commodity Operating Systems, in Proceedings of the nineteenth ACM symposium on Operating systems principles, ser. SOSP '03. ACM, 2003, pp. 207-222.
10. S. Boyd-Wickizer and N. Zeldovich, Tolerating Malicious Device Drivers in Linux, in Proceedings of the 2010 USENIX conference on USENIX annual technical conference. USENIX Association, 2010, pp. 9-9.
11. A. Srivastava and J. Giffin, Efficient Monitoring of Untrusted Kernel-Mode Execution, in Proceedings of the 18th Annual Network and Distributed Systems Security Symposium, 2011.
12. X. Xiong, D. Tian, and P. Liu, Practical Protection of Kernel Integrity for Commodity OS from Untrusted Extensions, in Proceedings of the 18th Annual Network and Distributed System Security Symposium, 2011.
13. T. Ball, E. Bounimova, B. Cook, V. Levin, J. Lichtenberg, C. McGarvey, B. Ondrusek, S. K. Rajamani, and A. Ustuner, Thorough Static Analysis of Device Drivers, in Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006, ser. EuroSys '06. ACM, 2006, pp. 73-85.
14. V. Kuznetsov, V. Chipounov, and G. Candea, Testing Closed-Source Binary Device Drivers with DDT, in Proceedings of the 2010 USENIX conference on USENIX annual technical conference. USENIX Association, 2010, pp. 12-12.
15. Linux Test Project, http://ltp.sourceforge.net.
16. skipfish web application security scanner, https://code.google.com/p/ skipfish.
17. curl-loader, http://curl-loader.sourceforge.net.
18. C. Cadar, D. Dunbar, and D. Engler, KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs, in Proceedings of the 8th USENIX conference on Operating systems design and implementation. USENIX Association, 2008, pp. 209-224.
19. M. J. Renzelmann, A. Kadav, and M. M. Swift, SymDrive: Testing Drivers without Devices, in Proceedings of the 10th USENIX conference on Operating Systems Design and Implementation. USENIX Association, 2012, pp. 279-292.
20. V. Chipounov, V. Kuznetsov, and G. Candea, S2E: A Platform for In-Vivo Multi-Path Analysis of Software Systems, pp. 265-278, 2011.
21. K. Sen, D. Marinov, and G. Agha, CUTE: A Concolic Unit Testing Engine for C, in Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering, ser. ESEC/FSE-13. ACM, 2005, pp. 263-272.
22. F. Bellard, QEMU, a Fast and Portable Dynamic Translator. USENIX, 2005.
23. A. Mavinakayanahalli, P. Panchamukhi, J. Keniston, A. Keshavamurthy, and M. Hiramatsu, Probing the Guts of Kprobes, in Proceedings of the 2006 Linux Symposium, vol. 2, 2006, pp. 109-124.
24. Linux kernel module that allows you to set events on pressed keys, http://en.chuso.net/linux-kernel-module-that-allows-you-to-setevents-on-pressed- keys.html.
25. F. Zhou, J. Condit, Z. Anderson, I. Bagrak, R. Ennals, M. Harren, G. Necula, and E. Brewer, SafeDrive: Safe and Recoverable Extensions Using Language-Based Techniques, in Proceedings of the 7th symposium on Operating systems design and implementation. USENIX Association, 2006, pp. 45-60.
26. V. Ganapathy, M. J. Renzelmann, A. Balakrishnan, M. M. Swift, and S. Jha, The Design and Implementation of Microdrivers, in Proceedings of the 13th international conference on Architectural support for programming languages and operating systems, ser. ASPLOS XIII. ACM, 2008, pp. 168-178.
27. D. Williams, P. Reynolds, K. Walsh, E. Sirer, and F. Schneider, Device Driver Safety Through a Reference Validation Mechanism, in Proceedings of the 8th USENIX conference on Operating systems design and implementation. USENIX Association, 2008, pp. 241-254.
28. R. Wahbe, S. Lucco, T. Anderson, and S. Graham, Efficient Software-Based Fault Isolation, in ACM SIGOPS Operating Systems Review, vol. 27, no. 5. ACM, 1994, pp. 203-216.
29. U. Erlingsson, M. Abadi, M. Vrable, M. Budiu, and G. Necula, XFI: Software Guards for System Address Spaces, in Proceedings of the 7th symposium on Operating systems design and implementation. USENIX Association, 2006, pp. 75-88.
30. B. Ford and R. Cox, Vx32: Lightweight User-level Sandboxing on the x86, in USENIX 2008 Annual Technical Conference on Annual Technical Conference. USENIX Association, 2008, pp. 293-306.
31. B. Yee, D. Sehr, G. Dardyk, J. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, and N. Fullagar, Native Client: A Sandbox for Portable, Untrusted x86 Native Code, in Security and Privacy, 2009 30th IEEE Symposium on. IEEE, 2009, pp. 79-93.
32. M. Castro, M. Costa, J. Martin, M. Peinado, P. Akritidis, A. Donnelly, P. Barham, and R. Black, Fast Byte-Granularity Software Fault Isolation, in Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles. ACM, 2009, pp. 45-58.
33. Y. Mao, H. Chen, D. Zhou, X. Wang, N. Zeldovich, and M. Kaashoek, Software fault isolation with API integrity and multi-principal modules, in Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles. ACM, 2011, pp. 115-128.
34. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda, Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis, in Proceedings of the 14th ACM conference on Computer and communications security. ACM, 2007, pp. 116-127.
35. A. Lanzi, M. Sharif, and W. Lee, K-Tracer: A System for Extracting Kernel Malware Behavior, in Proceedings of the 16th Annual Network and Distributed System Security Symposium, 2009.
36. H. Yin, Z. Liang, and D. Song, HookFinder: Identifying and Understanding Malware Hooking Behaviors, in Proceedings of the 15th Annual Network and Distributed System Security Symposium, 2008.
37. Z. Wang, X. Jiang, W. Cui, and X. Wang, Countering Persistent Kernel Rootkits Through Systematic Hook Discovery, in Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2008, pp. 21-38.
38. R. Riley, X. Jiang, and D. Xu, Multi-Aspect Profiling of Kernel Rootkit Behavior, in Proceedings of the 4th ACM European conference on Computer systems. ACM, 2009, pp. 47-60.
39. B. Dolan-Gavitt, T. Leek, M. Zhivich, J. Giffin, and W. Lee, Virtuoso: Narrowing the Semantic Gap in Virtual Machine Introspection, in Security and Privacy (SP), 2011 IEEE Symposium on. IEEE, 2011, pp. 297-312.
40. V. Chipounov and G. Candea, Reverse Engineering of Binary Device Drivers with RevNIC, in Proceedings of the 5th European conference on Computer systems. ACM, 2010, pp. 167-180.