Multi-Aspect Profiling of Kernel Rootkit Behavior

Size: px

Start display at page:

Download "Multi-Aspect Profiling of Kernel Rootkit Behavior"

Vernon Bailey
5 years ago
Views:

1 Multi-Aspect Profiling of Kernel Rootkit Behavior Ryan Riley, Xuxian Jiang, Dongyan Xu Purdue University, North Carolina State University EuroSys 2009 Nürnberg, Germany

2 Rootkits Stealthy malware Hide attacker Modifying the OS kernel in memory Injecting new code Threat model: Root privileges Full memory access 2

3 In the news 3

4 Rootkit techniques 4

5 Rootkit techniques adore-ng Linux 2.4/2.6 Kernel module Adds custom functions 5

6 Rootkit techniques adore-ng hp Linux 2.4/2.6 Kernel module Adds custom functions Linux 2.4 Kernel module Modifies kernel objects 6

7 Profiling a rootkit? Quickly reveal behavior Tool for malware investigators Honeypot environment This is hard, rootkits are highly privileged! 7

8 Profiling: Determining behavior 1. What code does it run? 2. What kernel objects does it modify? 3. How does it modify control flow? 4. What system calls are affected at userlevel? 8

9 PoKeR: Architecture Virtual Machine User-level Applications Right-Before Detection Guest Kernel Logging and Context Tracking Virtual Machine Monitor Log Kernel Symbols & Kernel Object Types Kernel Object Interpretation Profile 9

10 PoKeR: Architecture Right-Before Detection Logging and Context Tracking 10

11 Right before detection? Applications VM Guest OS VMM NICKLE Module Standard Shadow 11

12 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Standard Shadow 12

13 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Guest Kernel Instruction Fetch Standard Shadow 13

14 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Standard Shadow 14

15 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Other Memory Access Standard Shadow 15

16 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Standard Shadow 16

17 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Other Memory Access Guest Kernel Instruction Fetch Standard Shadow 17

18 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Memory Access Standard Shadow 18

19 Right before detection? Applications VM Guest OS Memory Access VMM NICKLE Module Memory Access Standard Compare Shadow 19

20 What code does it run? Compare standard and shadow memories Extract code as you go 20

21 PoKeR: Architecture Virtual Machine User-level Applications Right-Before Detection Guest Kernel Logging and Context Tracking Virtual Machine Monitor Log Kernel Symbols & Kernel Object Types Kernel Object Interpretation Profile 21

22 Kernel Symbols & Kernel Object Types Logging and Context Tracking Log Kernel Object Interpretation 22

23 Logging and context tracking Logging rootkit code Execution Reads Writes 23

24 What kernel objects does it modify? We have memory writes from rootkit code Use static analysis to build a map Kernel with debug symbols 24

25 What about dynamic allocation? Some objects are allocated dynamically 25

26 What about dynamic allocation? Some objects are allocated dynamically Static Objects Dynamic Objects init_task 0xc xc11c

27 Simple observation #1 Static Objects Dynamic Objects 27

28 Simple observation #1 Static Objects Dynamic Objects 28

29 Simple observation #2 The rootkit is just as ignorant as we are It will find dynamic objects by starting at static ones 29

30 Combat tracking Track rootkit reads Build a map of dynamic memory Reverse VMI 30

31 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 31

32 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 32

33 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 33

34 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 34

35 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 35

36 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 36

37 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 37

38 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 38

39 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 39

40 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 40

41 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 41

42 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 42

43 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 43

44 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output 44

45 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output Write to 0xc11b

46 Combat tracking example Static Objects Dynamic Objects init_task 0xc xc11c0000 Memory Map 0xc Output Write to 0xc11b0056 ->euid 46

47 How does it modify control flow? Kernel hooks Function pointers Part of existing data objects Could be statically or dynamically allocated This is a subset of the previous point 47

48 Results adore Name Code Kernel Objects Modified adore instr sys_call_table[2,4,5,6,18,37,39,84,106] sys_call_table[107,120,141,195,196,220] adore 733 instr sys_call_table[1,2,6,26,37,39,120,141,220] 0.53 proc_net->subdir->next->(...)->next->get_info proc_root_inode_operations->lookup adore-ng instr proc_net->subdir->next->(...)->next->get_info proc_root_inode_operations->lookup proc_root_operations->readdir ext3_dir_operations->readdir ext3_file_operations->write unix_dgram_ops->recvmsg 48

49 Results hp rootkit Action Value Kernel Object R 0xc677c000 hash[600] R 0x a hash[600]-> R 0xc76d8000 hash[600]-> R 0xc hash[600]->prev_task W 0xc hash[600]->->prev_task W 0xc76d8000 hash[600]->prev_task-> 49

50 Performance Normalized Slo ow-down QEMU PoKeR not profiling PoKeR profiling UnixBench Kernel Compile 50

51 Limitations Lack of formal completeness Cannot reveal the reason for modifications Combat tracking evasion Assume VMM isolation Kernel rootkits only 51

52 Related work Panorama CCS 07 HookFinder NDSS 08 HookMap RAID 08 K-Tracer NDSS 09 52

53 Your three take aways PoKeR: Virtualization based rootkit profiler Combat Tracking allows us to track dynamic data objects Tells what a rootkit does in order to help an expert determine why it does it 53

Defeating Return-Oriented Rootkits with Return-less Kernels

5 th ACM SIGOPS EuroSys Conference, Paris, France April 15 th, 2010 Defeating Return-Oriented Rootkits with Return-less Kernels Jinku Li, Zhi Wang, Xuxian Jiang, Mike Grace, Sina Bahram Department of Computer