Security (part 1) CPS210 Spring 2006

Current Forensic Methods  Manual inspection of existing logs  System, application logs  Not enough information  Network log  May be encrypted  Disk image  Only shows final state  Machine level logs (ReVirt)  No semantic information

Fixing the vulnerability  Logs contain other traffic  Disks have other updates  No way to separate out legitimate actions  How do I rollback?  Remove the effects of the attack  Leave any real work

Process File Socket Detection point Fork event Read/write event

BackTracker  Online component, log objects and events  Offline component to generate graphs BackTracker runs, shows source of intrusion intrusion detected intrusion occurs

BackTracker Objects  Process  File  Filename

Dependency-Forming Events  Process / Process  fork, clone, vfork  Process / File  read, write, mmap, exec  Process / Filename  open, creat, link, unlink, mkdir, rmdir, stat, chmod, …

Prioritizing Dependency Graphs  Hide read-only files  Eliminate helper processes  Filter “low- control” events /bin/bash /lib/libc bash proc backdoor

Prioritizing Dependency Graphs id pipe  Hide read-only files  Eliminate helper processes  Filter “low- control” events bash proc backdoor

Prioritizing Dependency Graphs bash proc login_a utmp login_b backdoor  Hide read-only files  Eliminate helper processes  Filter “low- control” events

Process File Socket Detection point Fork event Read/write event

Implementation  Prototype built on Linux  Both stand-alone and virtual machine  Hook system call handler  Inspect state of OS directly Guest OS Host OS VMMEventLogger Guest Apps Host OS EventLogger Host Apps Virtual Machine Implementation Stand-Alone Implementation

Evaluation  Determine effectiveness of Backtracker  Set up Honeypot virtual machine  Intrusion detection using standard tools  Six default filtering rules

Process File Socket Detection point Fork event Read/write event

Process File Socket Detection point Fork event Read/write event

BackTracker Limitations  Layer-below attack  Use of filtered objects for attack  Hidden channels  Create large dependency graph  Perform a large number of steps  Implicate innocent processes