Shadow-Box v2:
The Practical and Omnipotent Sandbox for ARM
Seunghun Han, Jun-Hyeok Park
(hanseunghun || parkparkqw)@nsr.re.kr
Wook Shin, Junghwan Kang, HyoungChun Kim(wshin || ultract || khche)@nsr.re.kr

Who Are We?
- Senior security researcher at NSR (National Security ResearchInstitute of South Korea)- Speaker at Black Hat Asia 2017 and HITBSecConf 2016/2017- Author of the book series titled “64-bit multi-core OS principles
and structure, Vol.1&2”- a.k.a kkamagui, @kkamagui1- Senior security researcher at NSR- Embedded system engineer- Interested in firmware security and IoT security- a.k.a davepark, @davepark312

Last Year We Presented…

We introduced Shadow-box v1

Goal of This Year is…
LinuxLinux

Shadow-Box for x86

Shadow-Box for ARM

VT-x, VT-d

TrustZone(Virtualization Technology)(Virtualization Technology)

IMAX86

We will introduce Shadow-box v2

Background
DesignImplementation

Demo. and Conclusion(with Black Hat Sound Bytes)

REMIND:

Linux Kernel is Everywhere!

REMIND:

Security Threats of Linux Kernel- The Linux kernel suffers from rootkits and securityvulnerabilities- Rootkits: EnyeLKM, Adore-ng, Sebek, suckit, kbeast, and so many

descendants- Vulnerabilities: CVE-2014-3153, CVE-2015-3636, CVE-2016-4557,

CVE-2017-6074, etc.

Devices that use Linux kernel

share security threats

REMIND:

Melee Combats at the Kernel-level- Kernel-level (Ring 0) protections are not enough- Lots of rootkits and exploits work in the Ring 0 level- Protections against them are often easily bypassed and neutralized- Kernel Object Hooking (KOH)- Direct Kernel Object Manipulation (DKOM)

Protections needan even lower level (Ring -1)

REMIND:

Taking the Higher Ground- Leveraging virtualization technology (VT)- VT separates a machine into a host (secure world) and a guest(normal world)- The host in Ring -1 can freely access/control the guest in Ring 0(the converse doesn’t hold)- VT-equipped HW: Intel VT-x, AMD AMD-v, ARM TrustZone

Shadow-Box v2 focuses on
ARM TrustZone!

ARM TrustZone andTrusted Execution Environment- ARM TrustZone- is a security extension of ARM processor and hardware-basedsecurity- separates a machine into the secure world and normal world- Trusted Execution Environment (TEE)- is a secure area of ARM processor- protects integrity and confidentiality of data in memory and storageLords of the TEE

OH, NO…

TEE of KNOXQSEERED OCEAN…

Restrictions on Lords of the TEE (1)- TEEs are proprietary- Their source codes are not published- Use of the source code is restricted- TEEs are not portable- They are designed for their own processors- So, they are not applicable in different processors

Restrictions on Lords of the TEE (2)- To wrap it up, their TEEs are not suitable for various
ARM-based devices- There are so many ARM processor vendors such as Broadcom,NXP, MediaTek, Allwinner, etc.
- Manufacturers choose low-cost ARM SoC for their products- The types and vendors of ARM SoC in products are different
depending on manufacturing date

We needan open source and portable TEE!

OP-TEE: Open Portable TEE (1)- OP-TEE is an open source TEE- You can change everything that you want
- Linaro supports and maintains OP-TEE- Linaro is an association of ARM, Freescale, IBM, Samsung, ST, TI- OP-TEE supports many kinds of SoCs and devices- OP-TEE supports more than fourteen devices including Raspberry
Pi 3 and QEMU
- OP-TEE has well-defined architecture, so you can port OP-TEE toyour device easily

OP-TEE: Open Portable TEE (2)- OP-TEE follows GlobalPlatform specifications- GloabalPlatform makes Trusted Execution Environment (TEE)
specifications- GlobalPlatform is an association of Samsung, Qualcomm, AMD,APPLE, Trustonic, NXP- Many companies follow the specifications, so you can port yourtrusted application to other TEE

Architecture of OP-TEE
Secure World
Dynamic Trusted
Application

UserKernel

Normal World
Teesupplicant

ClientApplication

TEE Internal APIsTEE Client API

StaticTrusted Application

OP-TEE Driver

OP-TEE
Trusted KernelLinux Kernel

Background
DesignImplementation

Demo. and Conclusion(with Black Hat Sound Bytes)

REMIND:

Security Architecture in Shadow Play

Activities in OS

Ring -1 Monitoring Mechanism

Security Monitor(Shadow-Watcher)(Light-Box)

REMIND:

Security Architecture in Shadow PlayWe named this architecture“Shadow-box”

Activities in OS

Ring -1 Monitoring Mechanism

Security Monitor(Shadow-Watcher)(Light-Box)

Architecture of Shadow-Box for x86
Host (Ring -1)

ShadowWatcher(Monitor)

Guest (Ring 0~3)

Monitor, control

User(Read/WritePermission)

User
Shared Kernel(Read/WritePermission)
Shared Kernel Only

SharedArea

Shared Kernel(Read-onlyPermission)
Shared Kernel and User

Light-Box (Lightweight Hypervisor)

Architecture of Shadow-Box for ARM
Secure World (Ring -1)

Normal World (Ring 0~3)

ShadowWatcher(Trusted App.)

User
Application

MonitorShadowWatcher Client

TrustedKernel

SMC callIMA
NormalKernelLight-Box (Trusted App. and Trusted Kernel)

Integrity Measurement Architecture- Integrity Measurement Architecture (IMA)- Can check hashes or signatures of files and prevent the systemfrom unauthorized executable files- Can store measurement value in Trusted Platform Module (TPM)- Is included Linux Kernel since 2.6.30!

- IMA needs to manage hashes or signatures- You need to make hashes or signatures of good executable files- IMA is hard to be used for general purpose environment, but it isgood for special purpose environment such as embedded systems

What can Shadow-Box v2 Do?
- Shadow-box v2 (for ARM) protects Linux kernel from- Unauthorized executable file attacks- IMA in kernel verifies signatures of executable files- Static kernel object attacks- Static kernel object = immutable at runtime- Code modification and system table modification attacks- Dynamic kernel object attacks (x86 only and future work!)- Dynamic kernel object = mutable at runtime- Process hiding and module hiding, function pointer modification attacks

Static Kernel Object Protection (1)Secure World

Normal World

Shadow-Box
Trusted App.

Shadow-Watcher
ClientKeysMeasuredResultsPageHashes

Remote Attestation

3. Compare Hashes

1. Request

Periodic Kernel
Integrity Monitor

Integrity Checker
4. Return the Result
2. Calculate Page Hashes

Light-Box Trusted App.

OP-TEE Driver

OP-TEE
Trusted KernelLinux Kernel

Static Kernel Object Protection (2)- Page hash-based integrity monitor- Is a simple and intuitive mechanism which is widely used!
- But, the attacker can guess when the page is measured and do

transient attack!
- Needs a mechanism to randomize the measurement timing- So, Shadow-Box randomizes page order- Shadow-watcher trust application shuffles pages after

integrity measurement is completed

Workload-Concerned
Kernel Monitoring- Adaptive mechanism- Changes check period for measurement depending on system

workload- Increases the period to keep performance as workload increases
Check Period(time)

Maximum Check Period(Check Infrequently)

Minimum Check Period(Check Frequently)
CPU Workload

Remote Attestation
Secure World

Normal World

Shadow-Box
Trusted App.

Shadow-Watcher
ClientRemoteKeys
Server

1. Request
with Encrypted NonceKeys

MeasuredResultsPageHashes

Periodic Kernel
Integrity Monitor

3. Get Encrypted Results of Measurement

5. Bypass the Results

2. Send the Request

Integrity Checker

Remote Attestation
4. Return the Encrypted
ResultLight-Box Trusted App.

OP-TEE Driver

OP-TEE
Trusted KernelLinux KernelExecutable File Verification with IMA
Secure World

Normal World

Shadow-Box
Trusted App.

Keys

Measured
Results

Page
Hashes

ShadowWatcher
ClientSignedApp.

UnsignedApp.

ModifiedApp.

Integrity Checker
Verify and Execute
MonitorLight-Box Trusted App.

OP-TEE
Trusted Kernel

IMA

OP-TEE
DriverLinux Kernel

Background
DesignImplementation

Demo. and Conclusion(with Black Hat Sound Bytes)

Target Board: Raspberry Pi 3
- Raspberry Pi board- Is the most famous embedded hardware- Supports many kinds of OS such as

Raspbian, Ubuntu, and Windows 10 core

- Raspberry Pi 3 model B specification- Quad Core 1.2GHz Broadcom BCM2837- 1GB RAM and HDMI
- BCM43438 wireless LAN and bluetooth- 40-pin extended GPIO

Limitation of Raspberry Pi 3
- Raspberry Pi is the best board for a prototype, but…
- CPU supports ARM TrustZone feature only
- DRAM and flash controller do not support it- Raspberry Pi does not have secure boot feature- The secure world is not really secure and just for a prototype!

- If you want a fully-featured board, choose another board!
- OP-TEE supports many kinds of embedded boards such as Junoboard, HiKey board, ATSAMA5D2-XULT board, and i.MX7Dual
SabreSD Board

How to Integrate Shadow-Box withRaspberry Pi

Raspbian OS- Raspbian’s Kernel+ OP-TEE’s Kernel with IMA Patch+ OP-TEE’s Secure Kernel+ Shadow-Box= Secure Pi

How to Integrate Shadow-Box withisRaspberry Pi?

Secure Pi
Raspbian OSan OPEN SOURCE project!
- Raspbian’s Kernel
OP-TEE’sKernel
with IMAyour
Patch+Wealways
welcome+ OP-TEE’s Secure Kernel
CONTRIBUTIONS!
+ Shadow-Box= Secure Pi

https://github.com/kkamagui/shadow-box-for-arm

Background
DesignImplementation

Demo. and Conclusion(with Black Hat Sound Bytes)

Porting x86 Rootkits to ARM (1)- Rootkits need to patch kernel codeand read-only data
- They usually hide themselves by patchingkernel code or function pointers- But, kernel has page protection mechanism- In x86 case, they disable page write
protection in the CR3 register!
- In ARM case, they also need to disablepage protection, too!

Porting x86 Rootkits to ARM (2)- Do we really need to know about the page protection
mechanism for patching kernel?
- Paging mechanism is too much complicated- ARM processors have various paging mechanism- Use live kernel patch functions instead!
- Linux kernel has kernel patch functions for a live patch- x86: text_poke(void *addr, const void *opcode, size_t len)
- ARM: patch_text(void *addr, unsigned int insn)- You do not worry about the paging mechanism anymore!

Porting x86 Rootkits to ARM (2)OH, THIS IS- Do we really need to know about the page protection

mechanism for patching kernel?
- Paging mechanism is too much complicated- ARM processors have various paging mechanism- Use live kernel patch functions instead!

EXACTLY WHAT I WANT!

- Linux kernel has kernel patch functions for a live patch- x86: text_poke(void *addr, const void *opcode, size_t len)
- ARM: patch_text(void *addr, unsigned int insn)- You do not worry about the paging mechanism anymore!

DEMO

Conclusion andBlack Hat Sound Bytes- Kernel-level (ring 0) threats should be protected ina more privileged level (ring -1)- Rootkits can neutralize kernel-level (ring 0) protection- We create a ring -1 level protection mechanism with ARM TrustZone- Shadow-box v2 is practical and portable- Shadow-box v2 protects the kernel from rootkits using IMA andOP-TEE- We made a reference implementation with Raspberry Pi 3
- We named it “Secure Pi” and opened as an open source projectQuestions ?

CONTRIBUTION!
Project : https://github.com/kkamagui/shadow-box-for-arm
Contact: hanseunghun@nsr.re.kr, @kkamagui1
parkparkqw@nsr.re.kr, @DavePark312