Subverting Operating System Properties through Evolutionary DKOM - - PowerPoint PPT Presentation

▶
subverting operating system properties through
SMART_READER_LITE
LIVE PREVIEW

Subverting Operating System Properties through Evolutionary DKOM - - PowerPoint PPT Presentation

Nov 01, 2023 474 likes •708 views

Subverting Operating System Properties through Evolutionary DKOM Attacks Mariano Graziano, Lorenzo Flore, Andrea Lanzi, Davide Balzarotti Cisco Systems, Inc. Universita degli Studi di

slide-1
SLIDE 1

Subverting Operating System Properties through Evolutionary DKOM Attacks

Mariano ¡Graziano, ¡Lorenzo ¡Flore, ¡Andrea ¡Lanzi, ¡Davide ¡Balzarotti ¡ Cisco ¡Systems, ¡Inc. ¡ Universita’ ¡degli ¡Studi ¡di ¡Milano ¡ Eurecom ¡ DIMVA ¡2016 ¡-­‑ ¡San ¡Sebastian, ¡Spain ¡

slide-2
SLIDE 2

TRADITIONAL DKOM ATTACKS

EPROCESS EPROCESS EPROCESS

slide-3
SLIDE 3

TRADITIONAL DKOM ATTACKS

EPROCESS EPROCESS EPROCESS

slide-4
SLIDE 4

TRADITIONAL DKOM DEFENSES

  • Kernel data integrity solutions:
  • invariants
  • external systems
  • memory analysis
  • data partitioning
slide-5
SLIDE 5

EVOLUTIONARY DKOM ATTACKS

Time

data structure of interest

slide-6
SLIDE 6

EVOLUTIONARY DKOM ATTACKS

Violation of a temporal property

slide-7
SLIDE 7

EVOLUTIONARY DKOM ATTACKS

Violation of a temporal property the attack cannot b e d e t e c t e d looking at a single snapshot

slide-8
SLIDE 8

STATE VS PROPERTY

  • Traditional DKOM affects the state and are

discrete

  • Evolutionary DKOM (E-DKOM) affects the

evolution in time of a given property and are continuous

slide-9
SLIDE 9

THREAT MODEL

  • Attacker has access to ring0
  • Malicious code not detectable by current solutions
  • Attacker cannot modify kernel code and attack the

VMM

slide-10
SLIDE 10

EXAMPLE: LINUX CFS SCHEDULER

slide-11
SLIDE 11

SUBVERTING THE SCHEDULER

target

slide-12
SLIDE 12

SUBVERTING THE SCHEDULER

target right most

slide-13
SLIDE 13

SUBVERTING THE SCHEDULER

target right most

Set ¡targetvruntime ¡> ¡rightmostvruntime ¡

slide-14
SLIDE 14

SUBVERTING THE SCHEDULER

target target

We affected the evolution of the data structure over time. We altered the scheduler property (fair execution).

slide-15
SLIDE 15

ATTACK EVALUATION

  • Temporarily block an IDS or Antivirus
  • Temporarily block Inotify
slide-16
SLIDE 16

DEFENSES?

  • Reference monitor that mimics the OS property:
  • OS specific
  • Difficult to generalize
slide-17
SLIDE 17

DEFENSE FRAMEWORK

slide-18
SLIDE 18

DEFENSE FRAMEWORK

slide-19
SLIDE 19

DEFENSE FRAMEWORK

slide-20
SLIDE 20

OVERHEAD

Normal ¡operations Stress ¡test

slide-21
SLIDE 21

CONCLUSIONS

  • New DKOM attack based on data structures evolution
  • Experiment on the Linux CFS scheduler
  • Defense solution based on hypervisor
  • General mitigation/solution very hard
slide-22
SLIDE 22

Mariano Graziano magrazia@cisco.com @emd3l

QUESTIONS?