1. Security (part 1) CPS210 Spring 2006

2. Current Forensic Methods  Manual inspection of existing logs  System, application logs  Not enough information  Network log  May be encrypted  Disk image  Only shows final state  Machine level logs (ReVirt)  No semantic information

3. Fixing the vulnerability  Logs contain other traffic  Disks have other updates  No way to separate out legitimate actions  How do I rollback?  Remove the effects of the attack  Leave any real work

4. Process File Socket Detection point Fork event Read/write event

5. BackTracker  Online component, log objects and events  Offline component to generate graphs BackTracker runs, shows source of intrusion intrusion detected intrusion occurs

6. BackTracker Objects  Process  File  Filename

7. Dependency-Forming Events  Process / Process  fork, clone, vfork  Process / File  read, write, mmap, exec  Process / Filename  open, creat, link, unlink, mkdir, rmdir, stat, chmod, …

9. Prioritizing Dependency Graphs  Hide read-only files  Eliminate helper processes  Filter “low- control” events /bin/bash /lib/libc bash proc backdoor

10. Prioritizing Dependency Graphs id pipe  Hide read-only files  Eliminate helper processes  Filter “low- control” events bash proc backdoor

11. Prioritizing Dependency Graphs bash proc login_a utmp login_b backdoor  Hide read-only files  Eliminate helper processes  Filter “low- control” events

13. Process File Socket Detection point Fork event Read/write event

14. Implementation  Prototype built on Linux 2.4.18  Both stand-alone and virtual machine  Hook system call handler  Inspect state of OS directly Guest OS Host OS VMMEventLogger Guest Apps Host OS EventLogger Host Apps Virtual Machine Implementation Stand-Alone Implementation

15. Evaluation  Determine effectiveness of Backtracker  Set up Honeypot virtual machine  Intrusion detection using standard tools  Six default filtering rules

16. Process File Socket Detection point Fork event Read/write event

17. Process File Socket Detection point Fork event Read/write event

18. BackTracker Limitations  Layer-below attack  Use of filtered objects for attack  Hidden channels  Create large dependency graph  Perform a large number of steps  Implicate innocent processes