Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems

ABSTRACT

We propose a primitive, called Pioneer, as a first step towards verifiable code execution on untrusted legacy hosts. Pioneer does not require any hardware support such as secure co-processors or CPU-architecture extensions. We implement Pioneer on an Intel Pentium IV Xeon processor. Pioneer can be used as a basic building block to build security systems. We demonstrate this by building a kernel rootkit detector.

REFERENCES

• 1: Tripwire. http://sourceforge.net/projects/tripwire/.
• 2: VMware. http://www.vmware.com/.
• 3: AMD platform for trustworthy computing. In WinHEC, September 2003.
• 4: Secure virtual machine architecture reference manual. AMD Corp., May 2005.
• 5: Network Appliance. Postmark: A new file system benchmark. Available at http://www.netapp.com/techlibrary/3022.html, 2004.
• 6: W. Arbaugh. Personal communication, May 2005.
• 7: D. Boggs, A. Baktha, J. Hawkins, D. Marr, J. Miller, P. Roussel, R. Singhal, B. Toll, and K.S. Venkatraman. The microarchitecture of the Intel Pentium 4 processor on 90nm technology. Intel Technology Journal, 8(01), February 2004.
• 8: B. Chen and R. Morris. Certifying program execution with secure procesors. In Proceedings of HotOS IX, 2003.
• 9: A. Chuvakin. Ups and downs of unix/linux host-based security solutions. ;login: The Magazine of USENIX and SAGE, 28(2), April 2003.
• 10: Free Software Foundation. superopt - finds the shortest instruction sequence for a given function. http://www.gnu.org/directory/devel/compilers/superopt.html.
• 11: Tal Garfinkel , Ben Pfaff , Jim Chow , Mendel Rosenblum , Dan Boneh, Terra: a virtual machine-based platform for trusted computing, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 12: Intel Corp. LaGrande Technology Architectural Overview, September 2003.
• 13: Intel Corporation. IA32 Intel Architecture Software Developer's Manual Vol.1.
• 14: K. J. Jones. Loadable Kernel Modules. ;login: The Magazine of USENIX and SAGE, 26(7), November 2001.
• 15: Rajeev Joshi , Greg Nelson , Keith Randall, Denali: a goal-directed superoptimizer, Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation, June 17-19, 2002, Berlin, Germany
• 16: R. Kennell and L. Jamieson. Establishing the genuinity of remote computer systems. In Proceedings of USENIX Security Symposium, August 2003.
• 17: Samuel T. King , Peter M. Chen, Backtracking intrusions, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 18: Alexander Klimov , Adi Shamir, A New Class of Invertible Mappings, Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems, p.470-483, August 13-15, 2002
• 19: N. Petroni, T. Fraser, J. Molina, and W. Arbaugh. Copilot - a coprocessor-based kernel runtime integrity monitor. In Proceedings of USENIX Security Symposium, pages 179--194, 2004.
• 20: R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In Proceedings of USENIX Security Symposium, pages 223--238, 2004.
• 21: A. Seshadri, A. Perrig, L. van Doorn, and P. Khosla. SWATT: Software-based attestation for embedded devices. In Proceedings of IEEE Symposium on Security and Privacy, May 2004.
• 22: U. Shankar, M. Chew, and J. D. Tygar. Side effects are not sufficient to authenticate software. In Proceedings of USENIX Security Symposium, pages 89--101, August 2004.
• 23: Elaine Shi , Adrian Perrig , Leendert Van Doorn, BIND: A Fine-Grained Attestation Service for Secure Distributed Systems, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.154-168, May 08-11, 2005 [doi>10.1109/SP.2005.4]
• 24: Trusted Computing Group (TCG). https://www.trustedcomputinggroup.org/, 2003.
• 25: Xiaoyun Wang, Yiqun Yin, and Hongbo Yu. Finding collisions in the full sha-1. In Proceedings of Crypto, August 2005.
• 26: Y. Wang, R. Roussev, C. Verbowski, A. Johnson, and D. Ladd. AskStrider: What has changed on my machine lately? Technical Report MSR-TR-2004-03, Microsoft Research, 2004.
• 27: Y. Wang, B. Vo, R. Roussev, C. Verbowski, and A. Johnson. Strider GhostBuster: Why it's a bad idea for stealth software to hide files. Technical Report MSR-TR-2004-71, Microsoft Research, 2004.
• 28: Glenn Wurster , P. C. van Oorschot , Anil Somayaji, A Generic Attack on Checksumming-Based Software Tamper Resistance, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.127-138, May 08-11, 2005 [doi>10.1109/SP.2005.2]
• 29: D. Zovi. Kernel rootkits. http://www.cs.unm.edu/~ghandi/lkr.pdf.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.4 Software/Program Verification

General Terms:
Security

Keywords:
dynamic root of trust, rootkit detection, self-check-summing code, software-based code attestation, verifiable code execution