A file system for safely interacting with untrusted USB flash drives - PowerPoint PPT Presentation

A file system for safely interacting with untrusted USB flash drives Ke Zhong , Zhihao Jiang ⋆ , Ke Ma ⋆ , and Sebastian Angel University of Pennsylvania ⋆ Shanghai Jiao Tong University

Most Storage has moved to cloud!

USB flash drives remain popular u Legacy data u No network connections u Store confidential data − Bitcoin keys − Medical records − ID photos

USB stack has several issues u Trust-by-default design principle u Devices can bypass kernel and access memory (DMA) u Driver code tends to be buggy − There are many drivers by third party producers u Masquerade as other devices − A device could declare to be a keyboard

USB stack has several issues u Trust-by-default design principle u Devices can bypass kernel and access memory (DMA) Could be exploited by u Driver code tends to be buggy a malicious flash drive − There are many drivers by third party producers u Masquerade as other devices − A device could declare to be a keyboard

USB stack has several issues u Trust-by-default design principle u Devices can bypass kernel and access memory (DMA) u Driver code tends to be buggy − There are many drivers by third party producers u Masquerade as other devices − A device could declare to be a keyboard

Previous work u Packet filtering − Cinch: Security’16 − USBFilter: Security’16 u Device authentication − ProvUSB: CCS’16 u Sandbox the device − GoodUSB: ACSAS’15

Limitation u Packet filtering − Malicious payload that changes dynamically avoids rule-based detection u Device authentication − Require new hardware/kernel modifications u Sandbox the device − False negative (i.e., a device is malicious but sandbox says it's ok)

We propose RBFuse , which is a file system that accesses flash drives without interacting with the USB stack on the host machine

Key idea RBFuse remaps memory space of host controller to a virtual machine, and exports file system of flash drives as a mountable virtual file system

System overview IOMMU

System overview Virtual machine VFS Server IOMMU

System overview Virtual machine USB Directory VFS Server VFS Client IOMMU

System overview Virtual machine USB Directory User space VFS daemon Server VFS Client IOMMU

System overview Virtual machine USB Directory User space VFS daemon Server VFS Client Fuse kernel IOMMU driver

How RBFuse runs Create a file Virtual machine “foo”! USB Directory VFS Server VFS Client IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS Server VFS Client IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS Server Execute VFS Client ① getattr IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory VFS “No such file” Server VFS Client “No such file” IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute VFS Client ① getattr IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute VFS Client ① getattr ② mknod IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory VFS “Succeed!” Server VFS Client “Succeed!” IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory VFS “foo exists!” Server VFS Client “foo exists!” IOMMU

How RBFuse runs Create a file Virtual machine “foo”! USB Directory ① getattr Done! VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU

Performance issues Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU

Performance issues Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU Too many requests for accessing metadata 3,000 getattr calls are issued when reading 1,000 files

Performance issues Write 1024KB Virtual machine to “foo”! USB Directory ①write 128KB ②write 128KB VFS …… Server Execute ⑧write 128KB VFS Client ①write 128KB ②write 128KB …… IOMMU ⑧write 128KB Write requests are split into smaller chunks

Performance issues Read 1024KB Virtual machine from “foo”! USB Directory ①read 128KB ②read 128KB VFS …… Server Execute ⑧read 128KB VFS Client ①read 128KB ②read 128KB …… IOMMU ⑧read 128KB Read requests are split into smaller chunks

Compromised virtual machine Virtual machine USB Directory VFS Server VFS Client IOMMU Malicious

Compromised virtual machine Virtual machine USB Directory VFS Compromised Server VFS Client IOMMU Malicious

Compromised virtual machine Virtual machine USB Directory VFS Compromised Server VFS Client IOMMU ①Confidential data might be stolen ②Files transferred might be tampered ③Issue malformed file system responses Malicious

Parsing errors Virtual machine USB Requests Directory Serialize VFS requests Server VFS Client Parse responses IOMMU

Parsing errors Virtual machine USB Requests Directory Serialize VFS requests Server VFS Client Parse responses IOMMU Parsers, if not designed correctly, can be easily compromised to exploit memory errors and integer overflow.

Agenda u How to address those challenges − Optimizations − Encrypted communication − Formally verified serializer and parser u Preliminary evaluation u Discussion & Conclusion

Agenda u How to address those challenges − Optimizations − Encrypted communication − Formally verified serializer and parser u Preliminary evaluation u Discussion & Conclusion

Caching metadata Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU

Caching metadata Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr getattr could be done locally VFS Client ① getattr at the VFS Client ② mknod ③ getattr IOMMU u Cache during initialization − RBFuse fetches and caches the metadata of all files and directories during initialization

Caching metadata Create a file Virtual machine “foo”! USB Directory ① getattr VFS ② mknod Server Execute ③ getattr VFS Client ① getattr ② mknod ③ getattr IOMMU u Cache during initialization − RBFuse fetches and caches the metadata of all files and directories during initialization u Update metadata accordingly − Mknod, write, etc.

Prefetching Read 1024KB Virtual machine from “foo”! USB Directory ①read 128KB ②read 128KB VFS …… Server Execute ⑧read 128KB VFS Client ①read 128KB ②read 128KB …… IOMMU ⑧read 128KB

Prefetching Read 1024KB Virtual machine from “foo”! USB Directory ①read 128KB ②read 128KB VFS …… Server Execute ⑧read 128KB VFS Client read 128KB + 896KB IOMMU Read subsequent chunks for large file

Prefetching Read all files Virtual machine in “dir” USB Directory ①read f1 ②read f2 VFS …… Server Execute ⑧read f8 VFS Client ①read f1 ②read f2 …… IOMMU ⑧read f8

Prefetching Read all files Virtual machine in “dir” USB Directory ①read f1 ②read f2 VFS …… Server Execute ⑧read f8 VFS Client read f1 + f2 ~ f8 IOMMU Read other small files in the same directory

Batching operations Write 1024KB Virtual machine to “foo”! USB Directory ①write 128KB ②write 128KB VFS …… Server Execute ⑧write 128KB VFS Client ①write 128KB ②write 128KB …… IOMMU ⑧write 128KB

Batching operations Write 1024KB Virtual machine to “foo”! USB Directory write 128KB + write 128KB VFS + …… Server Execute + write 128KB VFS Client write 128KB + write 128KB + …… IOMMU u Multiple write are combined into one + write 128KB

Batching operations Write 1024KB Virtual machine to “foo”! USB Directory write 128KB + write 128KB VFS + …… Server Execute + write 128KB VFS Client write 128KB + write 128KB + …… IOMMU u Multiple write are combined into one + write 128KB u Other requests related to write can also be merged − getattr, mknod, getattr, open, write, close u Speculatively respond to requests first − By monitoring remaining size of flash drives, if size permitted, then responds “succeed”