Multi-aspect profiling of kernel rootkit behavior

ABSTRACT

Kernel rootkits, malicious software designed to compromise a running operating system kernel, are difficult to analyze and profile due to their elusive nature, the variety and complexity of their behavior, and the privilege level at which they run. However, a comprehensive kernel rootkit profile that reveals key aspects of the rootkit's behavior is helpful in aiding a detailed manual analysis by a human expert. In this paper we present PoKeR, a kernel rootkit profiler capable of producing multi-aspect rootkit profiles which include the revelation of rootkit hooking behavior, the exposure of targeted kernel objects (both static and dynamic), assessment of user-level impacts, as well as the extraction of kernel rootkit code. The system is designed to be deployed in scenarios which can tolerate high overheads, such as honeypots. Our evaluation results with a number of real-world kernel rootkits show that PoKeR is able to accurately profile a variety of rootkits ranging from traditional ones with system call hooking to more advanced ones with direct kernel object manipulation. The obtained profiles lead to unique insights into the rootkits' characteristics and demonstrate PoKeR's usefulness as a tool for rootkit investigators.

REFERENCES

• 1: Martín Abadi , Mihai Budiu , Úlfar Erlingsson , Jay Ligatti, Control-flow integrity, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102165]
• 2: Fabrice Bellard, QEMU, a fast and portable dynamic translator, Proceedings of the annual conference on USENIX Annual Technical Conference, p.41-41, April 10-15, 2005, Anaheim, CA
• 3: Hans-Juergen Boehm , Mark Weiser, Garbage collection in an uncooperative environment, Software—Practice & Experience, v.18 n.9, p.807-820, September 1988 [doi>10.1002/spe.4380180902]
• 4: Erik Buchanan , Ryan Roemer , Hovav Shacham , Stefan Savage, When good instructions go bad: generalizing return-oriented programming to RISC, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455776]
• 5: Lorenzo Cavallaro , Prateek Saxena , R. Sekar, On the Limits of Information Flow Techniques for Malware Analysis and Containment, Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment, July 10-11, 2008, Paris, France [doi>10.1007/978-3-540-70542-0_8]
• 6: Anthony Cozzie, Frank Stratton, Hui Xue, and Samuel T. King. Digging for data structures. In OSDI, pages 255--266, 2008.
• 7: Free Software Foundation. GDB: The GNU Project Debugger. http://www.gnu.org/software/gdb/. Last accessed October 2008.
• 8: Tal Garfinkel , Keith Adams , Andrew Warfield , Jason Franklin, Compatibility is not transparency: VMM detection myths and realities, Proceedings of the 11th USENIX workshop on Hot topics in operating systems, p.1-6, May 07-09, 2007, San Diego, CA
• 9: Tal Garfinkel and Mendel Rosenblum. A Virtual Machine Introspection Based Architecture for Intrusion Detection. In Proc. Network and Distributed Systems Security Symposium (NDSS 2003), February 2003.
• 10: Greg Hoglund. Kernel object hooking rootkits (KOH rootkits). http://www.rootkit.com/newsread.php?newsid=501, 2006. Last accessed November 2008.
• 11: Innotek. Virtualbox. http://www.virtualbox.org/. Last accessed January 2009.
• 12: Xuxian Jiang , Xinyuan Wang , Dongyan Xu, Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315262]
• 13: Christopher Kruegel , William Robertson , Giovanni Vigna, Detecting Kernel-Level Rootkits Through Binary Analysis, Proceedings of the 20th Annual Computer Security Applications Conference, p.91-100, December 06-10, 2004 [doi>10.1109/CSAC.2004.19]
• 14: Andrea Lanzi, Monirul Sharif, and Wenke Lee. K-Tracer: A System for Extracting Kernel Malware Behavior. In Network and Distributed System Security Symposium, February 2009.
• 15: libdisasm. x86 Disassembler Library. http://bastard.sourceforge.net/libdisasm.html. Last accessed September 2008.
• 16: Microsoft. Driver Signing for Windows. http://technet.microsoft.com/en-us/library/cc784714.aspx. Last accessed November 2008.
• 17: Andreas Moser , Christopher Kruegel , Engin Kirda, Exploring Multiple Execution Paths for Malware Analysis, Proceedings of the 2007 IEEE Symposium on Security and Privacy, p.231-245, May 20-23, 2007 [doi>10.1109/SP.2007.17]
• 18: Bryan D. Payne, Martim Carbone, and Wenke Lee. Secure and flexible monitoring of virtual machines. In Proceedings of the 23rd Annual Computer Security Applications Conference (ACSAC 2007), December 2007.
• 19: Nick L. Petroni, Jr. , Timothy Fraser , Jesus Molina , William A. Arbaugh, Copilot - a coprocessor-based kernel runtime integrity monitor, Proceedings of the 13th conference on USENIX Security Symposium, p.13-13, August 09-13, 2004, San Diego, CA
• 20: Nick L. Petroni, Jr. , Timothy Fraser , AAron Walters , William A. Arbaugh, An architecture for specification-based detection of semantic integrity violations in kernel dynamic data, Proceedings of the 15th conference on USENIX Security Symposium, July 31-August 04, 2006, Vancouver, B.C., Canada
• 21: Nick L. Petroni, Jr. , Michael Hicks, Automated detection of persistent kernel control-flow attacks, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315260]
• 22: Georgios Portokalidis , Herbert Bos, Eudaemon: involuntary and on-demand emulation against zero-day exploits, Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008, April 01-04, 2008, Glasgow, Scotland UK
• 23: Ryan Riley , Xuxian Jiang , Dongyan Xu, Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing, Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection, September 15-17, 2008, Cambridge, MA, USA [doi>10.1007/978-3-540-87403-4_1]
• 24: Arvind Seshadri , Mark Luk , Ning Qu , Adrian Perrig, SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes, Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, October 14-17, 2007, Stevenson, Washington, USA
• 25: Hovav Shacham, The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86), Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315313]
• 26: Peter Silberman and C.H.A.O.S. FUTo. Uninformed, 2006. http://uninformed.org/?v=3&a=7&t=sumry.
• 27: VMware. Vmware workstation, multiple operating systems including linux on windows. http://www.vmware.com/products/ws/. Last accessed January 2009.
• 28: Doug Beck , Binh Vo , Chad Verbowski, Detecting Stealth Software with Strider GhostBuster, Proceedings of the 2005 International Conference on Dependable Systems and Networks, p.368-377, June 28-July 01, 2005 [doi>10.1109/DSN.2005.39]
• 29: Zhi Wang , Xuxian Jiang , Weidong Cui , Xinyuan Wang, Countering Persistent Kernel Rootkits through Systematic Hook Discovery, Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection, September 15-17, 2008, Cambridge, MA, USA [doi>10.1007/978-3-540-87403-4_2]
• 30: Jeffrey Wilhelm and Tzi-cker Chiueh. A Forced Sampled Execution Approach to Kernel Rootkit Identification. In Proc. Recent Advances in Intrusion Detection (RAID 2007), pages 219--235, September 2007.
• 31: Heng Yin , Dawn Song , Manuel Egele , Christopher Kruegel , Engin Kirda, Panorama: capturing system-wide information flow for malware detection and analysis, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315261]
• 32: Heng Yin, Zhenkai Liang, and Dawn Song. HookFinder: Identifying and understanding malware hooking behaviors. In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), February 2008.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Security

Keywords:
kernel rootkit, malware, profiling