1. @ NCSU Zhi Wang @ NCSU @ NCSU Xuxian Jiang @ NCSU @ Microsoft Research Weidong Cui @ Microsoft Research @ NCSU Peng Ning @ NCSU ACM CCS’09

2. Outline Introduction HookSafe Design Implementation Evaluation Related Work & Conclusion 2Advanced Defense Lab @ National Central Univ.

3. Introduction Prior research: Behaviors Symptoms Kernel code integrity Return-oriented rootkits Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms @ Usenix Security ‘09 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms Advanced Defense Lab @ National Central Univ.3

4. Introduction Better solution… Preserve kernel code integrity by preserving the kernel control flow integrity Kernel control data: Return addresses Function pointers Function pointers == kernel hooks (in this paper) Advanced Defense Lab @ National Central Univ.4

5. Introduction Hardware-based page-level protection Limited number of kernel hooks Hooks are not co-located together with frequently modified memory data Advanced Defense Lab @ National Central Univ.5

6. Introduction HookSafe Hypervisor-based Lightweight Protect all kernel hooks Byte-level granularity Advanced Defense Lab @ National Central Univ.6

7. Introduction Advanced Defense Lab @ National Central Univ.7 Distribution of 5881 kernel hooks in a running Ubuntu system

8. HookSafe Design Offline Hook Profiler Profile the guest kernel execution and output a hook access profile for each protected hook Hook Access Points(HAPs) Online Hook Protector Create a shadow copy of all protected hooks Implement HAPs Redirection Advanced Defense Lab @ National Central Univ.8

9. HookSafe Design Advanced Defense Lab @ National Central Univ.9 The HookSafe architecture

10. HookSafe Design Offline Hook Profiling Static analysis More complete; less precise Dynamic analysis More precise QEMU – monitoring every memory access instruction Advanced Defense Lab @ National Central Univ.10

11. HookSafe Design Online Hook Protection Advanced Defense Lab @ National Central Univ.11

12. HookSafe Design Online Hook Protection – Initialization At Boot time Create shadow copy Patch the HAPs(requires the support of the hypervisor) Advanced Defense Lab @ National Central Univ.12

13. HookSafe Design Online Hook Protection – Runtime R/W Indirection Read : read from the shadow copy and return Write : Make a hypercall Validate the request Update the shadow copy if valid Advanced Defense Lab @ National Central Univ.13

14. HookSafe Design Online Hook Protection – Runtime Tracking of Dynamic Allocated Hooks A dynamic allocated hook is embedded in a dynamic kernel object Hypercall while a kernel object containing a hook is allocated Create the shadow copy of the hook Advanced Defense Lab @ National Central Univ.14

15. HookSafe Design Hardware Register Protection GDTR, IDTR, DR 0 -DR 7 Hardware-based page-level protection Advanced Defense Lab @ National Central Univ.15

16. Implementation Offline Hook Profiler QEMU – binary translation If an instruction accesses any kernel hook in the given list, mark it as an HAP and log the value Dynamic allocated kernel hook: Track the creation of the kernel object and locate the location Hook access profile Advanced Defense Lab @ National Central Univ.16

17. Implementation Advanced Defense Lab @ National Central Univ.17 An example access profile related to ext3_dir_operations->readdir kernel hook

18. Implementation Hook Indirection HAP Patching Overwrite the instruction of HAP with a 5-byte jmp instruction Jump to trampoline code > 5 bytes : Fill the space with NOP instructions < 5 bytes : overwrite the subsequent instruction Advanced Defense Lab @ National Central Univ.18

19. Implementation Advanced Defense Lab @ National Central Univ.19 The implementation of hook indirection

20. Implementation Advanced Defense Lab @ National Central Univ.20

21. Implementation Hook Indirection - HAP Patching HAP after HAP The second instruction is a target of jump instruction Advanced Defense Lab @ National Central Univ.21

22. Implementation Read/Write Indirection Detection: Read – compare the original hook with shadow copy Write – update both Advanced Defense Lab @ National Central Univ.22

23. Implementation Runtime LKM and Hook Tracking SLAB interface LKM Virtual machine introspection Memory Protection Shadow page table (SPT) in Xen Advanced Defense Lab @ National Central Univ.23

24. Evaluation Test with 9 real-world rootkits UnixBench and ApacheBench Advanced Defense Lab @ National Central Univ.24

25. Evaluation Advanced Defense Lab @ National Central Univ.25

26. Evaluation Advanced Defense Lab @ National Central Univ.26

27. Evaluation Performance Advanced Defense Lab @ National Central Univ.27

28. Advanced Defense Lab @ National Central Univ.28