Kernel rootkits often hide associated malicious processes by altering reported task struct information to upper layers and applications such as ps and top. Virtualized settings offer a unique opportunity to mitigate this behavior using dynamic virtual machine introspection (VMI). For known kernels, VMI can be deployed to search for kernel objects and identify them by using unique data structure "signatures". In existing work, VMI-detected data structure signatures are based on values and structural features which must be (often exactly) present in memory snapshots taken, for accurate detection. This features a certain brittleness and rootkits can escape detection by simply temporarily "un-tangling" the corresponding structures when not running. Here we introduce a new paradigm, that defeats such behavior by training for and observing signatures of timing access patterns to any and all kernel-mapped data regions, including objects that are not directly linked in the "official" list of tasks. The use of timing information in training detection signatures renders the defenses resistant to attacks that try to evade detection by removing their corresponding malicious processes before scans. KXRay successfully detected processes hidden by four traditional rootkits.
[1]
Zhilei Xu,et al.
Tracking Rootkit Footprints with a Practical Memory Analysis System
,
2012,
USENIX Security Symposium.
[2]
References
,
1971
.
[3]
Xuxian Jiang,et al.
SigGraph: Brute Force Scanning of Kernel Data Structure Instances Using Graph-based Signatures
,
2011,
NDSS.
[4]
Emmett Witchel,et al.
Ensuring operating system kernel integrity with OSck
,
2011,
ASPLOS XVI.
[5]
Chao Wu,et al.
Discovering Semantic Data of Interest from Un-mappable Memory with Confidence
,
2012,
NDSS.
[6]
Xuxian Jiang,et al.
Mapping kernel objects to enable systematic integrity checking
,
2009,
CCS.
[7]
Tal Garfinkel,et al.
A Virtual Machine Introspection Based Architecture for Intrusion Detection
,
2003,
NDSS.
[8]
Abhinav Srivastava,et al.
Robust signatures for kernel data structures
,
2009,
CCS.
[9]
David Lie,et al.
Hypervisor Support for Identifying Covertly Executing Binaries
,
2008,
USENIX Security Symposium.