Self-signed executables: Restricting replacement of program binaries by malware

2nd USENIX Workshop on Hot Topics in Security, HotSec 2007

Volumn , Issue , 2007, Pages

  Wurster, Glenn ^a   Van Oorschot, P C ^a  

^a CARLETON UNIVERSITY   (Canada)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER OPERATING SYSTEMS; NETWORK SECURITY;

END USERS; EXECUTABLES; LINUX ENVIRONMENT; PROGRAM BINARY; TRUSTED AUTHORITIES;

MALWARE;

EID: 84977850543     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (22)

1. A. Apvrille, D. Gordon, S. Hallyn, M. Pourzandi, and V. Roy. Digsig: Run-time authentication of binaries at kernel level. In Proc. LISA '04: Eighteenth Systems Ad- ministration Conference, pages 59-66, 2004.
2. A. Baliga, X. Chen, and L. Iftode. Paladin: Automated detection and containment of rootkit attacks. Technical Report DCS-TR-593, Rutgers University Department of Computer Science, January 2006.
3. A. Baliga, P. Kamat, and L. Iftode. Lurking in the shad- ows: Identifying systemic threats to kernel data. In Proc. 2007 IEEE Symposium on Security and Privacy, pages 246-251, May 2007.
4. bsign. Web site. http://packages.debian.org/stable/ admin/bsign.html.
5. J. Collake. Hacking Windows file protection. Web Page, May 2007. http://www.bitsum.com/aboutwfp.asp.
6. M. Conover. Analysis of the Windows Vista se- curity model. Technical report, Symantec Corp., 2006. http://www.symantec.com/avcenter/reference/ Windows Vista Security Model Analysis.pdf.
7. T. Garfinkel and M. Rosenblum. A virtual machine in- trospection based architecture for intrusion detection. In Proc. 2003 Network and Distributed Systems Security Symposium, pages 191-206. Internet Society, February 2003.
8. J. Y. Halpern and R. van der Meyden. A logical recon- struction of SPKI. Journal of Computer Security, 11(4), January 2004.
9. A. Huang. Hacking the Xbox. No Starch Press, Inc., 2003.
10. A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen. De- tecting past and present intrusions through vulnerability- specific predicates. In SOSP '05: Proceedings of the twen- tieth ACM symposium on Operating systems principles, pages 91-104. ACM Press, 2005.
11. G. H. Kim and E. H. Spafford. Experiences with Tripwire: Using integrity checkers for intrusion detection. Technical Report CSD-TR-93-071, Purdue University, 1993.
12. G. H. Kim and E. H. Spafford. The design and imple- mentation of Tripwire: A file system integrity checker. In ACM Conference on Computer and Communications Security, pages 18-29, 1994.
13. G. Kroah-Hartman. Signed kernel modules. Linux Jour- nal, 117:48-53, January 2004.
14. C. Kruegel, W. Robertson, and G. Vigna. Detecting kernel-level rootkits through binary analysis. In Proc. 20th Annual Computer Security Applications Conference (ACSAC'04), pages 91-100, Washington, DC, USA, 2004. IEEE Computer Society.
15. Microsoft. Description of the Windows file protection fea- ture. Web Page, May 2007. http://support.microsoft. com/kb/222193.
16. A. Pennington, J. Strunk, J. Griffin, C. Soules, G. Good- son, and G. Ganger. Storage-based intrusion detection: Watching storage activity for suspicious behavior. In Proc. 12th USENIX Security Symposium, pages 137-151, August 2003.
17. N. L. Petroni Jr., T. Fraser, J. Molina, and W. A. Ar- baugh. Copilot - a coprocessor-based kernel runtime in- tegrity monitor. In Proc. 13th USENIX Security Sympo- sium, pages 179-194, August 2004.
18. N. L. Petroni Jr., T. Fraser, A. Walters, and W. Arbaugh. An architecture for specification-based detection of se- mantic integrity violations in kernel dynamic data. In Proc. 15th USENIX Security Symposium, pages 289-304, August 2006.
19. J. Rutkowska. Subverting Vista kernel for fun and profit. Blackhat Presentation, August 2006. http://blackhat.com/presentations/bh-usa-06/ BH-US-06-Rutkowska.pdf.
20. L. van Doorn, G. Ballintign, and W. A. Arbaugh. Signed executables for linux. Technical Report CS-TR-4259, Uni- versity of Maryland, 2001.
21. Y.-M. Wang, D. Beck, B. Vo, R. Roussev, and C. Ver- bowski. Detecting stealth software with strider ghost- buster. In Proc. International Conference on Depend- able Systems and Networks (DSN-DCCS), pages 368-377, June 2005.
22. X. Zhao, K. Borders, and A. Prakash. Towards protect- ing sensitive files in a compromised system. In Proc. Third IEEE International Security in Storage Workshop (SISW'05), pages 21-28, 2005.