Custos: Practical Tamper-Evident Auditing of Operating Systems - - PowerPoint PPT Presentation

▶
custos practical tamper evident auditing of operating
SMART_READER_LITE
LIVE PREVIEW

Custos: Practical Tamper-Evident Auditing of Operating Systems - - PowerPoint PPT Presentation

Oct 29, 2022 143 likes •736 views

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, Dave Tian Logs Are Useful 2 Custos: Practical

slide-1
SLIDE 1

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution

Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, Dave Tian

slide-2
SLIDE 2

Logs Are Useful

2

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-3
SLIDE 3

Logs Are Useful

3

  • 75% of incident response specialists said logs are the most

valuable artifact during an investigation.1

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Carbon Black Quarterly Incident Response Threat Report April 2019

slide-4
SLIDE 4

Logs Are Useful

4

  • 75% of incident response specialists said logs are the most

valuable artifact during an investigation.1

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Carbon Black Quarterly Incident Response Threat Report April 2019

slide-5
SLIDE 5

5

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-6
SLIDE 6

6

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-7
SLIDE 7

Attack Model

7

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering

slide-8
SLIDE 8

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering

8

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs about the compromise are crucial for forensics!

slide-9
SLIDE 9

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering

9

Logs about the compromise are crucial for forensics!

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

If the attacker does not tamper with them, we can detect the attack.

slide-10
SLIDE 10

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering

10

If the attacker tampers with them, we can’t detect the attack.

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

If the attacker does not tamper with them, we can detect the attack.

Logs about the compromise are crucial for forensics!

slide-11
SLIDE 11

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering

11

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-12
SLIDE 12

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 6. Lateral Movement

12

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-13
SLIDE 13

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 6. Lateral Movement

13

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Central Server?

slide-14
SLIDE 14

Attack Model

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 6. Lateral Movement

14

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs Integrity proofs

slide-15
SLIDE 15

Design Overview

15

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-16
SLIDE 16

Design Overview

1) TAMPER-EVIDENT LOGGING

16

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-17
SLIDE 17

Design Overview

1) TAMPER-EVIDENT LOGGING 2) AUDITING

17

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-18
SLIDE 18

18

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-19
SLIDE 19

19

sk // secret key

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

slide-20
SLIDE 20

20

sk // secret key c // counter H // current hash Logging: H.Update(mi)

! = #$%&' ()*&+( ,-|| … || ,+||0))

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

slide-21
SLIDE 21

21

sk // secret key c // counter H // current hash Logging: H.Update(m1)

! = #$%&' ()*&+( ,-|| … || ,+||0)) m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

slide-22
SLIDE 22

22

sk // secret key c // counter H // current hash Logging: H.Update(m2)

! = #$%&' ()*&+( ,-|| … || ,+||0)) m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

ENCLAVE

slide-23
SLIDE 23

23

sk // secret key c // counter H // current hash Logging: H.Update(mh)

! = #$%&' ()*&+( ,-|| … || ,+||0)) m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2 mh …

ENCLAVE

slide-24
SLIDE 24

24

sk // secret key c // counter H // current hash Logging: H.Update(mh)

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2 mh …

ENCLAVE

! = #$%&' ()*&+( ,-|| … || ,+||0))

slide-25
SLIDE 25

25

sk // secret key c // counter H // current hash Logging: H.Update(mh)

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2 mh …

Auditor

ENCLAVE

! = #$%&' ()*&+( ,-|| … || ,+||0))

slide-26
SLIDE 26

26

sk // secret key c // counter H // current hash Logging: H.Update(mh) Commitment: H.Update(c) ! = Sigsk(H) H.Init() c++

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2 mh …

Auditor

ENCLAVE

" = $%&'( (*+',( -.|| … || -,||1))

slide-27
SLIDE 27

Auditing

27

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1) CENTRALIZED AUDITING

slide-28
SLIDE 28

Auditing

28

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1) CENTRALIZED AUDITING 2) DECENTRALIZED AUDITING

slide-29
SLIDE 29

29

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logger+Auditor Logger+Auditor Logger+Auditor Logger+Auditor

Decentralized Auditing

slide-30
SLIDE 30

30

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z Logger v

ENCLAVE

pkv -> public key of v

slide-31
SLIDE 31

31

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z Logger v

ENCLAVE

audit challenge

1

pkv -> public key of v

slide-32
SLIDE 32

32

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z Logger v

ENCLAVE

! = #$%&'( (*+&,( -.|| … || -,||1))

audit challenge

1

pkv -> public key of v

slide-33
SLIDE 33

33

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z Logger v

ENCLAVE

! = #$%&'( (*+&,( -.|| … || -,||1))

audit challenge logs and 3

1 2

pkv -> public key of v

slide-34
SLIDE 34

34

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Verification (!, m1 , …, mh , c): H = Hash(m1 || … || mh || c) result = Verpk_v(!, H)

Auditor z Logger v

ENCLAVE

" = $%&'() (+,'-( ./|| … || .-||2))

audit challenge logs and !

1 2

pkv -> public key of v

slide-35
SLIDE 35

35

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-36
SLIDE 36

36

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mi)

Logger v

ENCLAVE

slide-37
SLIDE 37

37

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh)

m1

Logger v

m2 mh …

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation

slide-38
SLIDE 38

38

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh)

m1

Logger v

m2 mh …

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k …

slide-39
SLIDE 39

39

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh)

m1

Logger v

m2 mh …

ENCLAVE

Auditor

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k …

slide-40
SLIDE 40

40

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh) Commitment: H.Update(c) ! = Sigsk(H) H.Init() c++

m1

Logger v

m2 mh …

ENCLAVE

Auditor

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k …

slide-41
SLIDE 41

41

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh) Commitment: H.Update(c) ! = Sigsk(H) H.Init() c++

m1

Logger v

m2 mh …

ENCLAVE

Verification (!, m’1 , …, m’k , c): H = Hash(m’1 || … || m’k || c) result = Verpk_v(!, H)

Auditor

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k …

slide-42
SLIDE 42

42

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh) Commitment: H.Update(c) ! = Sigsk(H) H.Init() c++

m1

Logger v

m2 mh …

ENCLAVE

Verification (!, m’1 , …, m’k , c): H = Hash(m’1 || … || m’k || c) result = Verpk_v(!, H)

Auditor

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k …

slide-43
SLIDE 43

43

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mh) Commitment: H.Update(c) ! = Sigsk(H) H.Init() c++

m1

Logger v

m2 mh …

ENCLAVE

Verification (!, m’1 , …, m’k , c): H = Hash(m’1 || … || m’k || c) result = Verpk_v(!, H)

Auditor

ENCLAVE

Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log tampering

m’2 m’1 m’k … Full security analysis on the paper!

slide-44
SLIDE 44

44

Microbenchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-45
SLIDE 45

45

Microbenchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Karande et al. ”SGX-log: Securing System Logs With SGX." ASIACCS 2017. 2 Hartung et al. “Practical and Robust Secure Logging from Fault-Tolerant Sequential Aggregate Signatures”, ProvSec 2017

0.001 0.01 0.1 1 10 100 1000 10000 100000 Custos SGX-Log BGLS Logging Latency (μs)

1 2

slide-46
SLIDE 46

46

Application Benchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-47
SLIDE 47

47

Application Benchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 1.1 1.2 nginx apache2 redis blast blast-multicore

Normalized Runtime

Insecure Custos

slide-48
SLIDE 48

48

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-49
SLIDE 49

49

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

  • Deploy Custos on 100 nodes.
slide-50
SLIDE 50

50

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

  • Deploy Custos on 100 nodes.
  • Replay attack from DARPA Transparent Computing engagement:

– Professional red-team emulating a nation state attacker.

slide-51
SLIDE 51

10:52

51

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

  • 1. Failed Compromise

Attempt (Exploit of Firefox 54.0.1)

  • 2. Initial Access

(Exploit of Firefox 54.0.1)

  • 3. Unprivileged Shell

11:42

Complete the attack

11:46

slide-52
SLIDE 52

10:52

52

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

  • 1. Failed Compromise

Attempt (Exploit of Firefox 54.0.1)

  • 2. Initial Access

(Exploit of Firefox 54.0.1)

  • 3. Unprivileged Shell

11:42

Complete the attack

11:46

slide-53
SLIDE 53

11:46:17

53

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

  • 4. Download Drakon
  • 5. Privilege Escalation

(through Drakon binary)

  • 6. Log Tampering

11:46:44 11:46:47

Custos’ auditing discovered log tampering!

10:52 11:42 11:46

slide-54
SLIDE 54

Conclusion

54

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-55
SLIDE 55

Conclusion

  • Log integrity is important.

55

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

slide-56
SLIDE 56

Conclusion

  • Log integrity is important.
  • Custos is a practical solution

for log integrity.

56

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mi)

m

Logger

ENCLAVE

slide-57
SLIDE 57

Conclusion

  • Log integrity is important.
  • Custos is a practical solution

for log integrity.

  • Custos can discover log

tampering in near real-time.

57

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mi)

m

Logger

ENCLAVE

slide-58
SLIDE 58

Conclusion

  • Log integrity is important.
  • Custos is a practical solution

for log integrity.

  • Custos can discover log

tampering in near real-time.

  • https://bitbucket.org/sts-lab/custos

58

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key c // counter H // current hash Logging: H.Update(mi)

m

Logger

ENCLAVE