Software Integrity Monitoring Using Hardware Performance Counters Corey Malone

Software Integrity Software that runs as it was originally “designed” or “compiled” At load – verify hash Runtime – Check every jump – Follow the control flow graph

Performance Counters Measure events such as ins retired, cache accesses, etc Already on most processors Give “insight” into processor state  program execution

Simple Model for Integrity Checking Profile application using counters At completion….compare to see if within certain range, to generate a probability of compromise. EXPECTED ACTUAL Instructions Retired Acceptable Range

Whole Program Monitoring NP-Complete, Very hard to do “Insight” into program not fine enough Lots of false positives.. So now what? main() { …… } main() { …… }

foo() { …… } foo() { …… } Function Monitoring Look at a smaller part of a program or kernel Fixed inputs to function lead to less variation Still have other variables, such as program or system status

System Call Monitoring for Rootkit Detection w/Terry Wang System calls commonly modified for rootkits – Hide files – Hide processes – Read files as they opened A VMM could monitor guest system calls to determine if any major variation occurs

Current Status X86 Implementation Complete ARM/Android Platform Research Progress – Sys Calls Guest & VMM – ARM performance counters less mature SmartGrid Proposal in Final Stages

Questions ?