Subverting System Authentication With Context-Aware, Reactive - - PowerPoint PPT Presentation

▶
subverting system authentication with context aware
SMART_READER_LITE
LIVE PREVIEW

Subverting System Authentication With Context-Aware, Reactive - - PowerPoint PPT Presentation

Oct 02, 2022 277 likes •817 views

Background Detailed Design Implementation Evaluation Related Work Summary Subverting System Authentication With Context-Aware, Reactive Virtual Machine Introspection Yangchun Fu , Zhiqiang Lin, Kevin Hamlen Department of Computer Science The

slide-1
SLIDE 1

Background Detailed Design Implementation Evaluation Related Work Summary

Subverting System Authentication With Context-Aware, Reactive Virtual Machine Introspection Yangchun Fu, Zhiqiang Lin, Kevin Hamlen

Department of Computer Science The University of Texas at Dallas

December 12th, 2013

slide-2
SLIDE 2

Background Detailed Design Implementation Evaluation Related Work Summary

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-3
SLIDE 3

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-4
SLIDE 4

Background Detailed Design Implementation Evaluation Related Work Summary

Traditional computer system structure

Hardware Target OS login Vsftpd sshd

slide-5
SLIDE 5

Background Detailed Design Implementation Evaluation Related Work Summary

Traditional computer system structure

Hardware Target OS login Vsftpd sshd

Authentication protection Mechanism Anti-debugging Logic Cryptographic Security Code Obfuscation Self-Checking

Trust?

slide-6
SLIDE 6

Background Detailed Design Implementation Evaluation Related Work Summary

Traditional computer system structure

Hardware Target OS login Vsftpd sshd

Authentication protection Mechanism anti-debugging logic cryptographic security code obfuscation self-checking

Trust?

slide-7
SLIDE 7

Background Detailed Design Implementation Evaluation Related Work Summary

Virtualization

Hardware Target OS login Vsftpd sshd VMM Target OS login Vsftpd sshd Hardware

slide-8
SLIDE 8

Background Detailed Design Implementation Evaluation Related Work Summary

Motivations

VMM Target OS login Vsftpd sshd Hardware

Adding a virtualization layer VMM runs at higher privilege than guest OS Great isolation, more stealthy A full control of guest OS A grand view of the entire state of guest OS.

slide-9
SLIDE 9

Background Detailed Design Implementation Evaluation Related Work Summary

Malicious VMM

Goal Subverting authentication(e.g., login) with Context-Aware, Reactive Virtual Machine Introspection(VMI) Attackers can gain fun and profit: Accessing sensitive data in a computer (e.g., a laptop, or a VM)

slide-10
SLIDE 10

Background Detailed Design Implementation Evaluation Related Work Summary

Malicious VMM

Goal Subverting authentication(e.g., login) with Context-Aware, Reactive Virtual Machine Introspection(VMI) Attackers can gain fun and profit: Accessing sensitive data in a computer (e.g., a laptop, or a VM) Assumptions Assume physical access (lost of laptop, VMs running in a cloud) Possible attackers/users

Malicious cloud providers (cloud being compromised) Law enforcement (accessing criminal’s computer, note that a physical machine can be virtualized)

slide-11
SLIDE 11

Background Detailed Design Implementation Evaluation Related Work Summary

Running a machine inside a malicious VMM

slide-12
SLIDE 12

Background Detailed Design Implementation Evaluation Related Work Summary

Running a machine inside a malicious VMM

Inception Attack Changing your idea using a dream Dream can be inside a dream

slide-13
SLIDE 13

Background Detailed Design Implementation Evaluation Related Work Summary

Running a machine inside a malicious VMM

Inception Attack Changing your idea using a dream Dream can be inside a dream Malicious Virtualization Monitor Running a machine inside a virtual machine We change the guest OS state from the malicious virtual machine without the awareness from any insider programs

slide-14
SLIDE 14

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

slide-15
SLIDE 15

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

slide-16
SLIDE 16

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

slide-17
SLIDE 17

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

slide-18
SLIDE 18

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

(X86) Hardware Malicious Virtual Machine Monitor

slide-19
SLIDE 19

Background Detailed Design Implementation Evaluation Related Work Summary

How it works

(X86) Hardware Malicious Virtual Machine Monitor

slide-20
SLIDE 20

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-21
SLIDE 21

Background Detailed Design Implementation Evaluation Related Work Summary

Overview

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

slide-22
SLIDE 22

Background Detailed Design Implementation Evaluation Related Work Summary

Using Hardware Virtualization

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

Hardware) Virtualiza6on)(Xen/ KVM))

slide-23
SLIDE 23

Background Detailed Design Implementation Evaluation Related Work Summary

Using Software Virtualization

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

SoJware) Virtualiza6on)(QEMU))

slide-24
SLIDE 24

Background Detailed Design Implementation Evaluation Related Work Summary

Working Example: from instructions perspective

if (pw_auth (user_passwd, username, reason, (char *) 0) == 0) { 804a868: a1 0c 62 05 08 mov 0x805620c,%eax 804a86d: c7 44 24 0c 00 00 00 movl $0x0,0xc(%esp) 804a874: 00 804a875: 89 3c 24 mov %edi,(%esp) 804a878: 89 44 24 08 mov %eax,0x8(%esp) 804a87c: a1 48 65 05 08 mov 0x8056548,%eax 804a881: 89 44 24 04 mov %eax,0x4(%esp) 804a885: e8 86 87 00 00 call 8053010<pw_auth> 804a88a: 85 c0 test %eax,%eax 804a88c: 0f 84 6d fd ff ff je 804a5ff<main+0x64f> goto auth_ok; }

Figure : Binary Code Snippet of the login Program.

slide-25
SLIDE 25

Background Detailed Design Implementation Evaluation Related Work Summary

Insight-I

Instruction Execution Tampering Tampering with Instruction Opcode

804a88c:0f 84 (je) → 0f 85 (jne)

Tampering with Instruction Operand

804a88a:test %eax,%eax → Tampering w/ eax/EFLAGS

Tampering with both Opcode and Operand

804a885:call 8053010 → mov $0,%eax

slide-26
SLIDE 26

Background Detailed Design Implementation Evaluation Related Work Summary

Working Example: from system call perspective

1 execve("/bin/login", ["login"], [/* 16 vars */]) = 0 2 uname({sys="Linux", node="ubuntu", ...}) = 0 ... 409 open("/etc/passwd", O_RDONLY) = 4 410 fcntl64(4, F_GETFD) = 0 411 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 412 _llseek(4, 0, [0], SEEK_CUR) = 0 413 fstat64(4, {st_mode=S_IFREG|0644, st_size=952, ...}) = 0 414 mmap2(NULL, 952, PROT_READ, MAP_SHARED, 4, 0) = 0x4021a000 415 _llseek(4, 952, [952], SEEK_SET) = 0 416 munmap(0x4021a000, 952) = 0 417 close(4) = 0 418 open("/etc/shadow", O_RDONLY) = 4 419 fcntl64(4, F_GETFD) = 0 420 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 421 _llseek(4, 0, [0], SEEK_CUR) = 0 422 fstat64(4, {st_mode=S_IFREG|0640, st_size=657, ...}) = 0 423 mmap2(NULL, 657, PROT_READ, MAP_SHARED, 4, 0) = 0x4021a000 424 _llseek(4, 657, [657], SEEK_SET) = 0 425 munmap(0x4021a000, 657) = 0 426 close(4) = 0 ...

Figure : System Call Trace Snippet of the login Program.

slide-27
SLIDE 27

Background Detailed Design Implementation Evaluation Related Work Summary

Insight-II

System Call Execution Tampering Tampering with Disk-IO Syscall

Replacing /etc/shadow file when it loads to the memory. Essentially a man-in-the-middle Attack. We can hijack the file open syscall and provide an attacker controlled password file

Tampering with Memory-Map Syscall

Tampering with mmap2 syscall by replacing the memory contents mapped by this syscall (immediately after it finishes) with the password hash values we control.

slide-28
SLIDE 28

Background Detailed Design Implementation Evaluation Related Work Summary

Insight-II

System Call Execution Tampering Tampering with Disk-IO Syscall

Replacing /etc/shadow file when it loads to the memory. Essentially a man-in-the-middle Attack. We can hijack the file open syscall and provide an attacker controlled password file

Tampering with Memory-Map Syscall

Tampering with mmap2 syscall by replacing the memory contents mapped by this syscall (immediately after it finishes) with the password hash values we control.

Advantages Transparent, can work for many other login types of programs No binary code reverse engineering

slide-29
SLIDE 29

Background Detailed Design Implementation Evaluation Related Work Summary

Challenges

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

slide-30
SLIDE 30

Background Detailed Design Implementation Evaluation Related Work Summary

Challenges

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

Identifying the “dreaming” context at the VMM layer (C1) a particular process execution; (C2) a particular syscall in C1; (C3) a particular instruction in C1; (C4) a particular instruction in C1 under a particular call stack.

slide-31
SLIDE 31

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

slide-32
SLIDE 32

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

Context-Aware, reactive introspection Introspection: a variant of Virtual Machine Introspection [Garfinkel et al, NDSS’03] Reactive: not a passive, read-only introspection, it is reactive Context-Aware: context ranges from C1 to C4

slide-33
SLIDE 33

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with Xen/KVM (SYSVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) Hardware) Virtualiza6on)(Xen/ KVM))

slide-34
SLIDE 34

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with Xen/KVM (SYSVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) Hardware) Virtualiza6on)(Xen/ KVM))

Execution Context Identification (C1) – process context: CR3 and code hash of login (C2) – syscall in C1: sysenter/sysret,int 0x80/iret

slide-35
SLIDE 35

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with Xen/KVM (SYSVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) Hardware) Virtualiza6on)(Xen/ KVM))

Execution Context Identification (C1) – process context: CR3 and code hash of login (C2) – syscall in C1: sysenter/sysret,int 0x80/iret Attack Strategies A1: Tampering with Instruction Code. A2: Tampering with Syscall Arguments and Return Values A3: Tampering with Syscall Produced Data A4: Using IO Virtualization

slide-36
SLIDE 36

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with QEMU (INSTVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) SoJware) Virtualiza6on)(QEMU))

slide-37
SLIDE 37

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with QEMU (INSTVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) SoJware) Virtualiza6on)(QEMU))

Execution Context Identification (C3) – instruction execution: Program Counter (PC) (C4) – call stack: instrumenting call/ret

slide-38
SLIDE 38

Background Detailed Design Implementation Evaluation Related Work Summary

Solutions: Designing with QEMU (INSTVMI)

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) SoJware) Virtualiza6on)(QEMU))

Execution Context Identification (C3) – instruction execution: Program Counter (PC) (C4) – call stack: instrumenting call/ret Attack Strategies A5: Tampering with Instruction Code at PC Level A6: Tampering with Instruction Operand A7: Tampering with Function Call Arguments and Return Values

slide-39
SLIDE 39

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-40
SLIDE 40

Background Detailed Design Implementation Evaluation Related Work Summary

Implementation

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) Hardware) Virtualiza6on)(Xen/ KVM))

SYSVMI: Using Xen-4.12 Malicious-VMM w/ C1∼C2 A1 A2 A3 A4 Total Xen-4.12 1,748 17 10 75 45 1,895 Implementing A1 to A4 with only 1,895 LOC in total (a very low cost for attacker).

slide-41
SLIDE 41

Background Detailed Design Implementation Evaluation Related Work Summary

Implementation

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data) SoJware) Virtualiza6on)(QEMU))

INSTVMI: Using QEMU-1.01

Malicious-VMM w/ C1 ∼ C4 A5 A6 A7 Total QEMU-1.01 3,513 35 34 25 3,607 INSTVMIa ported the SYSVMI implementation (C1 and C2, and A1 – A4) to a most recent QEMU-1.01 INSTVMIb implemented the new attacks unique to the software virtualization (A5 – A7) with fine-grained execution context identification (C3 and C4)

slide-42
SLIDE 42

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-43
SLIDE 43

Background Detailed Design Implementation Evaluation Related Work Summary

Overall Result

SYSVMI INSTVMIa INSTVMIb Target A1 A2,A3 A4 A1 A2,A3 A4 A5 A6 A7 login

  • sshd
  • vsftpd
  • telnetd
  • Table : Effectiveness of our virtual machine inception attack against

the authentication program. Each symbols denotes a successful way of incepting the victim software.

slide-44
SLIDE 44

Background Detailed Design Implementation Evaluation Related Work Summary

Performance Overhead

20 40 60 80 100

Kbuild Apache Memcached Bzip2 % of full speed

Plain Xen-SYSVMI Qemu-INSTVMIa Qemu-INSTVMIb

Figure : Macro-benchmark Evaluation of the Performance Overhead

  • f Our VMI
slide-45
SLIDE 45

Background Detailed Design Implementation Evaluation Related Work Summary

Performance Overhead

20 40 60 80 100 % of full speed

Plain Xen-SYSVMI Qemu-INSTVMIa Qemu-INSTVMIb

Figure : Micro-benchmark Evaluation of the Performance Overhead

  • f Our VMI
slide-46
SLIDE 46

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-47
SLIDE 47

Background Detailed Design Implementation Evaluation Related Work Summary

Hardware Virtualization Rootkits

Blue Pill The codename for a rootkit based on x86

  • virtualization. [J. Rutkowska, Blackhat’06]

Trapping a running instance of the OS by starting a thin hypervisor and virtualizing the rest of the machine under it. Vitriol [D. Zov, Blackhat’06] is also a hardware virtualization rootkit Key Differences Thin vs. Thick Hypervisor Bluepill aims to compromise other’s virtualization Our attack owns the virtualization and has rich features

slide-48
SLIDE 48

Background Detailed Design Implementation Evaluation Related Work Summary

Subvert, SubXen

Hardware Target OS App1 App2 Before Infection Hardware Target OS App1 App2 VMM Attack system After Infection

Key Differences Subvert [King et al., Oakland’06], a virtualization rootkit Thin vs. Thick Hypervisor Subvert also aims to infect other’s virtualization (to be thin to avoid large footprints) Our attack owns the virtualization and has rich features

slide-49
SLIDE 49

Outline

1

Background

2

Detailed Design

3

Implementation

4

Evaluation

5

Related Work

6

Summary

slide-50
SLIDE 50

Background Detailed Design Implementation Evaluation Related Work Summary

Summary

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

slide-51
SLIDE 51

Background Detailed Design Implementation Evaluation Related Work Summary

Summary

(X86)&Hardware& Context2aware,) Reac6ve)Introspec6on) EAX& EBX& ECX& EDX& ESP& EBP& ESI& EDI& EIP& …& Malicious)Virtual)Machine)Monitor) Opera8ng&Systems&(Linux/Windows)& login Process& Instruc6on)Execu6on) Tampering) Syscall)Execu6on) Tampering) Vic6m) Process)Code) Vic6m) Process)Data)

We design and implement a context-aware, reactive virtual machine to break authentication mechanism. Our result indicates that the approach is practical against real-world authentication programs. It is useful for both malicious attack and forensics analysis of virtualized systems and software.

slide-52
SLIDE 52

Background Detailed Design Implementation Evaluation Related Work Summary

Thank you

Questions?

To contact us: {yangchun.fu,zhiqiang.lin,hamlen}@utdallas.edu