1. Kenfe-Mickael Laventure Laurent Malvert Macquarie University 2008-09-19 LEMONA Linux Enhanced Monitoring Architecture Linux zest for security

2. Lemona – Linux Enhanced Monitoring Architecture22008-09-19Laventure / Malvert Outline Security and Forensics –Forensics –Computer Security –Computer Forensics Related Work Lemona –Project –Overview –Architecture References

3. Lemona – Linux Enhanced Monitoring Architecture32008-09-19Laventure / Malvert Forensics Short for “Forensic Science” Aims at: –Collecting Evidence –Providing Legal Proof (used in court) Concerned with Computers / Networks

4. Lemona – Linux Enhanced Monitoring Architecture42008-09-19Laventure / Malvert Confidentiality AvailabilityIntegrity Computer Security

5. Lemona – Linux Enhanced Monitoring Architecture52008-09-19Laventure / Malvert eaves- dropping tamperingimpersonationrepudiation denial of service illegal access Computer Security

6. Lemona – Linux Enhanced Monitoring Architecture62008-09-19Laventure / Malvert Computer Forensics Memory Analysis… –Volatile Memory (i.e. RAM) –Optical Drives (i.e. CD-ROM) –Magnetic Drives (i.e. HDD, Floppies) … but also Logs Analysis –Network –System

7. Lemona – Linux Enhanced Monitoring Architecture72008-09-19Laventure / Malvert Computer Forensics Incomplete –Logs are not activated by default –Not everything is logged –Not all applications generate logs Unreliable –Generated in User Land –Editable by an Attacker

8. Lemona – Linux Enhanced Monitoring Architecture82008-09-19Laventure / Malvert Outline Security and Forensics –Forensics –Computer Security –Computer Forensics Related Work Lemona –Project –Overview –Architecture References

9. Lemona – Linux Enhanced Monitoring Architecture92008-09-19Laventure / Malvert Related Work Forensix + System Calls Interception + Attack Reconstruction Sarmoria + Memory Mapped Monitoring - Not State Aware Kprobe / DjProbe + Dynamic Kernel Probing + Built in Kernel (but inactive) ReVirt + Sandboxing

10. Lemona – Linux Enhanced Monitoring Architecture102008-09-19Laventure / Malvert Outline Security and Forensics –Forensics –Computer Security –Computer Forensics Related Work Lemona –Project –Overview –Architecture References

11. Lemona – Linux Enhanced Monitoring Architecture112008-09-19Laventure / Malvert Lemona > Project Open Architecture –Open Protocols –Open Source Implementation Decentralized –Local Tracing Components –Remote Monitoring Components Prevention, Detection, Forensics, Recovery –Possible…?

12. Lemona – Linux Enhanced Monitoring Architecture122008-09-19Laventure / Malvert Lemona > Overview Exhaustiveness –Kernel Land Tracer  100% User Land Coverage Integrity –Harder to bypass  Would require Kernel Level code –Integrity Checks Flexible –Variable Granularity Levels –Selectable Hooks

13. Lemona – Linux Enhanced Monitoring Architecture132008-09-19Laventure / Malvert Lemona > Architecture User Application SysCallEntryExecutionReturn Memory Mapped File Open Read/Write Page Fault Close Inside Attackers Outside Attackers Target Storage Point Forensics Tools Lemona traces transmission Architecture > ^ Workflow / Hooks

14. Lemona – Linux Enhanced Monitoring Architecture142008-09-19Laventure / Malvert Outline Security and Forensics –Forensics –Computer Security –Computer Forensics Related Work Lemona –Project –Overview –Architecture References

15. Lemona – Linux Enhanced Monitoring Architecture152008-09-19Laventure / Malvert References > Lemona [home]http://lemona.googlecode.com/http://lemona.googlecode.com/ [blog]http://lemona-project.blogspot.com/http://lemona-project.blogspot.com/ [wiki]http://lemona.googlecode.com/wiki/http://lemona.googlecode.com/wiki/ [SCM]http://lemona.googlecode.com/svn/http://lemona.googlecode.com/svn/ [group]http://groups.google.com/group/lemona/http://groups.google.com/group/lemona/

16. Lemona – Linux Enhanced Monitoring Architecture162008-09-19Laventure / Malvert References > Related –SARMORIA, C. G. & CHAPIN, S. J. (2005) Monitoring access to shared memory-mapped files. Proc. of the 2005 Digital Forensics Research Workshop (DFRWS). New Orleans. –GOEL, A., FENG, W. C., MAIER, D. & WALPOLE, J. (2005) Forensix: a robust, high-performance reconstruction system. Distributed Computing Systems Workshops, 2005. 25th IEEE International Conference on, 155-162. –KRISHNAKUMAR, R. (2005) Kernel korner: kprobes-a kernel debugger. Linux Journal, 2005.