Panorama: capturing system-wide information flow for malware detection and analysis

ABSTRACT

Malicious programs spy on users' behavior and compromise their privacy. Even software from reputable vendors, such as Google Desktop and Sony DRM media player, may perform undesirable actions. Unfortunately, existing techniques for detecting malware and analyzing unknown code samples are insufficient and have significant shortcomings. We observe that malicious information access and processing behavior is the fundamental trait of numerous malware categories breaching users' privacy (including keyloggers, password thieves, network sniffers, stealth backdoors, spyware and rootkits), which separates these malicious applications from benign software. We propose a system, Panorama, to detect and analyze malware by capturing this fundamental trait. In our extensive experiments, Panorama successfully detected all the malware samples and had very few false positives. Furthermore, by using Google Desktop as a case study, we show that our system can accurately capture its information access and processing behavior, and we can confirm that it does send back sensitive information to remote servers in certain settings. We believe that a system such as Panorama will offer indispensable assistance to code analysts and malware researchers by enabling them to quickly comprehend the behavior and innerworkings of an unknown sample.

REFERENCES

• 1: AutoHotkey. http://www.autohotkey.com/.
• 2: Doug Beck , Binh Vo , Chad Verbowski, Detecting Stealth Software with Strider GhostBuster, Proceedings of the 2005 International Conference on Dependable Systems and Networks, p.368-377, June 28-July 01, 2005 [doi>10.1109/DSN.2005.39]
• 3: Fabrice Bellard, QEMU, a fast and portable dynamic translator, Proceedings of the annual conference on USENIX Annual Technical Conference, p.41-41, April 10-15, 2005, Anaheim, CA
• 4: Blacklight. http://www.europe.f-secure.com/exclude/blacklight/.
• 5: Bochs: The open source IA-32 emulation project. http://bochs.sourceforge.net/.
• 6: D. Brumley, C. Hartwig, M. G. Kang, Z. Liang, J. Newsome, D. Song, and H. Yin. BitScope: Automatically dissecting malicious binaries. Technical Report CMU-CS-07-133, School of Computer Science, Carnegie Mellon University, March 2007.
• 7: D. Brumley, C. Hartwig, Z. Liang, J. Newsome, D. Song, and H. Yin. Botnet Analysis, chapter Automatically Identifying Trigger-based Behavior in Malware. 2007.
• 8: J. Butler and G. Hoglund. VICE - catch the hookers! In Black Hat USA, July 2004. http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-butler/bh-us-04-butler.pdf.
• 9: J. Butler and S. Sparks. Shadow walker: Raising the bar for windows rootkit detection. In Phrack 63, July 2005.
• 10: Jim Chow , Ben Pfaff , Tal Garfinkel , Kevin Christopher , Mendel Rosenblum, Understanding data lifetime via whole system simulation, Proceedings of the 13th conference on USENIX Security Symposium, p.22-22, August 09-13, 2004, San Diego, CA
• 11: Mihai Christodorescu , Somesh Jha , Sanjit A. Seshia , Dawn Song , Randal E. Bryant, Semantics-Aware Malware Detection, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.32-46, May 08-11, 2005 [doi>10.1109/SP.2005.20]
• 12: Manuel Costa , Jon Crowcroft , Miguel Castro , Antony Rowstron , Lidong Zhou , Lintao Zhang , Paul Barham, Vigilante: end-to-end containment of internet worms, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom
• 13: Jedidiah R. Crandall , Frederic T. Chong, Minos: Control Data Attack Prevention Orthogonal to Memory Model, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.221-232, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.26]
• 14: Manuel Egele , Christopher Kruegel , Engin Kirda , Heng Yin , Dawn Song, Dynamic spyware analysis, 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference, p.1-14, June 17-22, 2007, Santa Clara, CA
• 15: P. Ferrie. Attacks on virtual machine emulators. Symantec Security Response, December 2006.
• 16: GINA spy. http://www.codeproject.com/useritems/GINA_SPY.Asp.
• 17: Ashvin Goel , Kenneth Po , Kamran Farhadi , Zheng Li , Eyal de Lara, The taser intrusion recovery system, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom
• 18: Google's desktop search red flag. http://www.internetnews.com/xSP/article.php/3584131.
• 19: Google Desktop - Privacy Policy. http://desktop.google.com/en/privacypolicy.html.
• 20: Alex Ho , Michael Fetterman , Christopher Clark , Andrew Warfield , Steven Hand, Practical taint-based protection using demand emulation, Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006, April 18-21, 2006, Leuven, Belgium
• 21: Francis Hsu , Hao Chen , Thomas Ristenpart , Jason Li , Zhendong Su, Back to the Future: A Framework for Automatic Malware Removal and System Repair, Proceedings of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference, p.257-268, December 11-15, 2006 [doi>10.1109/ACSAC.2006.16]
• 22: The IDA Pro Disassembler and Debugger. http://www.datarescue.com/idabase/.
• 23: Samuel T. King , Peter M. Chen, Backtracking intrusions, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 24: Andreas Moser , Christopher Kruegel , Engin Kirda, Exploring Multiple Execution Paths for Malware Analysis, Proceedings of the 2007 IEEE Symposium on Security and Privacy, p.231-245, May 20-23, 2007 [doi>10.1109/SP.2007.17]
• 25: A. Moshchuk, T. Bragin, S. D. Gribble, and H. M. Levy. A crawler-based study of spyware in the web. In Proceeding of the 13th Network and Distributed System Security (NDSS '06), February 2006.
• 26: J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS '05), February 2005.
• 27: T. Ormandy. An Empirical Study into the Security Exposure to Host of Hostile Virtualized Environments. http://taviso.decsystem.org/virtsec.pdf.
• 28: Georgios Portokalidis , Asia Slowinska , Herbert Bos, Argos: an emulator for fingerprinting zero-day attacks for advertised honeypots with automatic signature generation, Proceedings of the 1st ACM SIGOPS/EuroSys European Conference on Computer Systems 2006, April 18-21, 2006, Leuven, Belgium
• 29: Qemu. http://fabrice.bellard.free.fr/qemu/.
• 30: Feng Qin , Shan Lu , Yuanyuan Zhou, SafeMem: Exploiting ECC-Memory for Detecting Memory Leaks and Memory Corruption During Production Runs, Proceedings of the 11th International Symposium on High-Performance Computer Architecture, p.291-302, February 12-16, 2005 [doi>10.1109/HPCA.2005.29]
• 31: Feng Qin , Cheng Wang , Zhenmin Li , Ho-seop Kim , Yuanyuan Zhou , Youfeng Wu, LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks, Proceedings of the 39th Annual IEEE/ACM International Symposium on Microarchitecture, p.135-148, December 09-13, 2006 [doi>10.1109/MICRO.2006.29]
• 32: Rootkit revealer. http://www.sysinternals.com/Files/RootkitRevealer.zip.
• 33: J. Rutkowska. System virginity verifier: Defining the roadmap for malware detection on windows systems. In Hack In The Box Security Conference, September 2005. http://www.invisiblethings.org/papers/hitb05_virginity_verifier.ppt.
• 34: Sony's DRM Rootkit: The Real Story. http://www.schneier.com/blog/archives/2005/11/sonys_drm_rootk.html.
• 35: G. Edward Suh , Jae W. Lee , David Zhang , Srinivas Devadas, Secure program execution via dynamic information flow tracking, Proceedings of the 11th international conference on Architectural support for programming languages and operating systems, October 07-13, 2004, Boston, MA, USA
• 36: The Sleuth Kit (TSK). http://www.sleuthkit.org/sleuthkit/.
• 37: Amit Vasudevan , Ramesh Yerraballi, Cobra: Fine-grained Malware Analysis using Stealth Localized-executions, Proceedings of the 2006 IEEE Symposium on Security and Privacy, p.264-279, May 21-24, 2006 [doi>10.1109/SP.2006.9]
• 38: P. Vogt, F. Nentwich, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. In Proceeding of the Network and Distributed System Security Symposium (NDSS '07), February 2007.
• 39: Yi-Min Wang , Roussi Roussev , Chad Verbowski , Aaron Johnson , Ming-Wei Wu , Yennun Huang , Sy-Yen Kuo, Gatekeeper: Monitoring Auto-Start Extensibility Points (ASEPs) for Spyware Management, Proceedings of the 18th USENIX conference on System administration, November 14-19, 2004, Atlanta, GA

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Security

Keywords:
dynamic taint analysis, malware analysis, malware detection, spyware