Orchestra: Intrusion Detection Using Parallel Execution and Monitoring of Program Variants in User-Space Babak Salamat, Todd Jackson , Andreas Gal, and Michael Franz Secure Systems and Languages Laboratory Department of Computer Science University of California, Irvine EuroSys 2009, April 2009 1
Multi-Variant Execution Variant 1 Variant 2 Variant 1 Variant 2 2
Detection Requirements Lock-step execution Feed all variants with identical input Variants which behave differently when attacked 3
Reverse Stack Growth Direction Stack objects are located in opposite positions Downward Upward Growing Stack Growing Stack Caller Data Return Address Free Space Return Address Frame Pointer . Other Data . . Buffer Buffer . . Other Data . Frame Pointer Return Address Free Space Return Address Caller Data 4
5
From Source to Execution Modified Modified Multi- Source Compiler Library Variant Code (GCC 4.2) (Dietlibc) Execution Modified RTL generation Modified code generation Modified assembly Implemented the code of the library multi-variant monitor ~10,000 LoC in C++ 6
Orchestra Architecture The monitor is a user-space application Diversified Application ... Variant 1 Variant n Library 1 Library n Conventional Application Multi-Variant Monitor Library Untrusted Trusted Operating System 7
Granularity of Monitoring Granularity of monitoring and Synchronization Ideally after each instruction Not always possible Performance issues Synchronize and monitor at system calls No harm is done without invoking a system call All instances must invoke the same syscall with equivalent arguments 8
System Call Monitoring Debugging facility of Linux (ptrace) is used to build the monitor The monitor is notified twice per system call Variant 1 Variant 2 Monitor Syscall Syscall 9
System Call Monitoring (cont.) Equivalency is checked at the beginning of a system call The system calls must be the same Arguments must be equivalent Pointers (buffers) have the same content Values are identical Results of the system call are written back to the variants at the end of the system call if needed 10
System Call Execution Non-state changing system call that produce immutable results are executed by all Variant 1 Variant 1 Variant 2 Variant 2 uname uname Monitor Monitor uname uname 11
System Call Execution (cont.) State changing system calls are executed by the monitor Variant 1 Variant 1 Variant 1 Variant 2 Variant 2 Variant 2 Monitor Monitor write(stdout) skipped skipped Monitor write(stdout) write(stdout) write(stdout) skipped skipped 5 5 5 12
System Call Execution (cont.) Non-state changing system call that produce non- immutable results are executed by all, results are copied from the first variant to all Variant 1 Variant 1 Variant 2 Variant 2 gettime gettime Monitor Monitor 8:00 8:01 8:00 8:00 gettime gettime 13
Data Transfer ptrace transfers only 4 bytes at a time very slow in transferring large buffers Variant 1 Monitor 4K Buffer 1000 ptrace calls 14
Data Transfer (cont.) We tried using named pipes, but they cannot transfer more than 4K bytes at a time Shared memory is fast and can transfer mega bytes Variant 1 Shared my Monitor Buffer memcpy memory 15
Data Transfer Performance Shared memory is about 1000 times faster than ptrace and 20 times faster than FIFO in transferring a 128K buffer )*+,-." /0/1" 23,+.4"5.67+8" !#####" !"#$%&'()*+&(,-*./0%&.01'%2( !####" !###" !##" !#" !" $" %&" !&$" '!&" &(" $(" %&(" !&$(" 345&/(6*7&(,389&%2( 16
Variant 1 Variant 2 Removing False Positives False positives are the major practical issue in using multi-variant execution 17
Multi-Threaded Variants Different scheduling of multi-threaded or multi-process applications can cause false positives Variant 2 Variant 1 Thread 2 Thread 2 read read write write Variant 1 Variant 2 Thread 1 Thread 1 18
Monitoring multi-threaded variants Corresponding threads/processes must be synchronized to each other Variant 1 Variant 2 Thread 2 Thread 2 Monitor read read Thread 2 Variant 1 Variant 2 Thread 1 Thread 1 Monitor write write Thread 1 19
File Descriptors The same file descriptor is always reported to all variants when they invoke system calls that return a file descriptor Variant 1 Variant 1 Variant 1 Variant 1 Variant 2 Variant 2 Variant 2 Variant 2 Monitor Monitor Monitor Monitor pipe pipe 11 7 open(1.txt, WR) open(1.txt, WR) pipe pipe skipped 11 9 skipped 5 5 open(1.txt, WR) 20
Process ID Monitor reports the process ID of the first variant to all The PID of the first variant’s child process is reported as the result of fork or clone to all the variants Variant 1 Variant 1 Variant 2 Variant 2 PID: 100 PID: 100 PID: 101 PID: 101 Monitor Monitor getpid getpid 100 101 getpid getpid 100 100 21
Process IDs in Arguments When variants need to run a system call that receives a PID, appropriate PID is restored before the execution of the system call Variant 1 Variant 1 Variant 2 Variant 2 PID: 100 PID: 100 PID: 101 PID: 101 Monitor Monitor kill(100) kill(100) kill(100) kill(101) 22
Asynchronous Signals Signal handlers can cause different sequences of system calls to be executed by the variants Variant 1 Variant 2 signal handler Syscall 8 Syscall 1 Syscall 1 23
Time and Random Numbers System calls that read time (e.g., gettimeofday) are executed by one variant and the result is copied to all By providing identical time and other system information to all variants, they likely use the same seed to generate random numbers The monitor reads /dev/urandom and copies the result to all variants Reading CPU time stamp counters (RDTSC) may still cause false positives 24
Performance (!!"# $!"# %!"# &!"# '!"# !"# )*+,-# ./01# .))# 21*# 1+*34*## 14*5678# EF#G<4)?H:B# 7)9# SPEC .+1## 2:*;4<## EE#G<4)?H:B# 6/01$## ;=:59### 4>?+84## F#G<4)?H:B# +*;#### 743+#### +1+)@4# ;+*# ABC# 7CDC441# +24*+.4# 25
Summary Multi-variant execution is an effective technique in detecting and disrupting attacks A reverse stack executable can prevent stack-based buffer overflow vulnerabilities in a multi-variant environment Our methods can remove most sources of false positives in multi-variant execution Running two parallel variants have about 15% overhead 26
Thank you Questions? 27
Recommend
More recommend
