Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

Device attestation is an essential feature in many security protocols and applications. The lack of dedicated hardware and the impossibility to physically access devices to be attested, makes attestation of embedded devices, in applications such as Wireless Sensor Networks, a prominent challenge. Several software-based attestation techniques have been proposed that either rely on tight time constraints or on the lack of free space to store malicious code. This paper investigates the shortcomings of existing software-based attestation techniques. We first present two generic attacks, one based on a return-oriented rootkit} and the other on code compression. We further describe specific attacks on two existing proposals, namely SWATT and ICE-based schemes, and argue about the difficulty of fixing them. All attacks presented in this paper were implemented and validated on commodity sensors.

REFERENCES

• 1: Martín Abadi , Mihai Budiu , Úlfar Erlingsson , Jay Ligatti, Control-flow integrity, Proceedings of the 12th ACM conference on Computer and communications security, November 07-11, 2005, Alexandria, VA, USA [doi>10.1145/1102120.1102165]
• 2: Ross Anderson , Markus Kuhn, Tamper resistance: a cautionary note, Proceedings of the 2nd conference on Proceedings of the Second USENIX Workshop on Electronic Commerce, p.1-1, November 18-21, 1996, Oakland, California
• 3: Atmel Corporation. Atmega128 datasheet. http://www.atmel.com/atmel/acrobat/doc2467.pdf.
• 4: Erik Buchanan , Ryan Roemer , Hovav Shacham , Stefan Savage, When good instructions go bad: generalizing return-oriented programming to RISC, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455776]
• 5: Choi, Y.-G., Kang, J., and Nyang, D. Proactive code verification protocol in wireless sensor network. In ICCSA (2007), O. Gervasi and M. L. Gavrilova, Eds., vol. 4706 of Lecture Notes in Computer Science, Springer.
• 6: Nathan Cooprider , Will Archer , Eric Eide , David Gay , John Regehr, Efficient memory safety for TinyOS, Proceedings of the 5th international conference on Embedded networked sensor systems, November 06-09, 2007, Sydney, Australia [doi>10.1145/1322263.1322283]
• 7: Paul England , Butler Lampson , John Manferdelli , Marcus Peinado , Bryan Willman, A Trusted Open Platform, Computer, v.36 n.7, p.55-62, July 2003 [doi>10.1109/MC.2003.1212691]
• 8: Christopher Ferguson , Qijun Gu , Hongchi Shi, Self-healing control flow protection in sensor applications, Proceedings of the second ACM conference on Wireless network security, March 16-19, 2009, Zurich, Switzerland [doi>10.1145/1514274.1514305]
• 9: Aurélien Francillon , Claude Castelluccia, Code injection attacks on harvard-architecture devices, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455775]
• 10: Goodspeed, T. Exploiting wireless sensor networks over 802.15.4. In Texas Instruments Developper Conference (2008).
• 11: Qijun Gu , Rizwan Noorani, Towards self-propagate mal-packets in sensor networks, Proceedings of the first ACM conference on Wireless network security, March 31-April 02, 2008, Alexandria, VA, USA [doi>10.1145/1352533.1352563]
• 12: Greg Hoglund , Jamie Butler, Rootkits: Subverting the Windows Kernel, Addison-Wesley Professional, 2005
• 13: Wen Hu , Peter Corke , Wen Chan Shih , Leslie Overs, secFleck: A Public Key Technology Platform for Wireless Sensor Networks, Proceedings of the 6th European Conference on Wireless Sensor Networks, February 11-13, 2009, Cork, Ireland [doi>10.1007/978-3-642-00224-3_19]
• 14: Huffman, D.A. A method for the constructionof minimum redundancy codes. Proceedings of the IRE 40 (1962).
• 15: Hund, R., Holz, T., and Freiling, F. C. Return-oriented rootkits: Bypassing kernel code integrity protection mechanisms. In Proceedings of the 18th USENIX Security Symposium (August 2009).
• 16: Rick Kennell , Leah H. Jamieson, Establishing the genuinity of remote computer systems, Proceedings of the 12th conference on USENIX Security Symposium, p.21-21, August 04-08, 2003, Washington, DC
• 17: Klimov, A., and Shamir, A. New cryptographic primitives based on multiword t-functions. In Fast Software Encryption, 11th International Workshop, FSE 2004 (2004).
• 18: Krahmer, S. x86-64 buffer overflow exploits and the borrowed code chunks exploitation technique. Tech. rep., suse, September 2005. available at http://www.suse.de/ krahmer/no-nx.pdf.
• 19: Cynthia Kuo , Mark Luk , Rohit Negi , Adrian Perrig, Message-in-a-bottle: user-friendly and secure key deployment for sensor nodes, Proceedings of the 5th international conference on Embedded networked sensor systems, November 06-09, 2007, Sydney, Australia [doi>10.1145/1322263.1322286]
• 20: Nergal. The advanced return-into-lib(c) exploits (pax case study). Phrack Magazine 58, 4 (2001). http://www.phrack.org/issues.html?issue=58&id=4http://www.phrack.or%g/issues.html?issue=58&id=4.
• 21: Taejoon Park , Kang G. Shin, Soft Tamper-Proofing via Program Integrity Verification in Wireless Sensor Networks, IEEE Transactions on Mobile Computing, v.4 n.3, p.297-309, May 2005 [doi>10.1109/TMC.2005.44]
• 22: Arvind Seshadri , Mark Luk , Adrian Perrig, SAKE: Software Attestation for Key Establishment in Sensor Networks, Proceedings of the 4th IEEE international conference on Distributed Computing in Sensor Systems, June 11-14, 2008, Santorini Island, Greece [doi>10.1007/978-3-540-69170-9_25]
• 23: Arvind Seshadri , Mark Luk , Adrian Perrig , Leendert van Doorn , Pradeep Khosla, SCUBA: Secure Code Update By Attestation in sensor networks, Proceedings of the 5th ACM workshop on Wireless security, September 29-29, 2006, Los Angeles, California [doi>10.1145/1161289.1161306]
• 24: Arvind Seshadri , Mark Luk , Elaine Shi , Adrian Perrig , Leendert van Doorn , Pradeep Khosla, Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom
• 25: Seshadri, A., Perrig, A., van Doorn, L., and Khosla, P. Using SWATT for verifying embedded systems in cars. In Proceedings of Embedded Security in Cars Workshop (ESCAR 2004) (Nov. 2004).
• 26: Seshadri, A., Perrig, A., van Doorn, L., and Khosla, P. K. SWATT: SoftWare-based ATTestation for embedded devices. In IEEE Symposium on Security and Privacy (2004), IEEE Computer Society.
• 27: Hovav Shacham, The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86), Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315313]
• 28: Shaneck, M., Mahadevan, K., Kher, V., and Kim, Y. Remote software-based attestation for wireless sensors. In ESAS (2005).
• 29: Umesh Shankar , Monica Chew , J. D. Tygar, Side effects are not sufficient to authenticate software, Proceedings of the 13th conference on USENIX Security Symposium, p.7-7, August 09-13, 2004, San Diego, CA
• 30: Solar Designer. return-to-libc attack. Bugtraq mailing list, August 1997.
• 31: Texas Instruments. Msp430 f1611 datasheet.
• 32: Xuejun Yang , Nathan Cooprider , John Regehr, Eliminating the call stack to save RAM, Proceedings of the 2009 ACM SIGPLAN/SIGBED conference on Languages, compilers, and tools for embedded systems, June 19-20, 2009, Dublin, Ireland
• 33: Yi Yang , Xinran Wang , Sencun Zhu , Guohong Cao, Distributed Software-based Attestation for Node Compromise Detection in Sensor Networks, Proceedings of the 26th IEEE International Symposium on Reliable Distributed Systems, p.219-230, October 10-12, 2007

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Invasive software (e.g., viruses, worms, Trojan horses)

General Terms:
Experimentation, Security

Keywords:
code compression, embedded systems, indisputable code execution, return-oriented programming, software-based attestation, swatt, wireless sensor networks