Abstract-Targeting the operating system kernel, the core of trust in a system, kernel rootkits are able to compromise the entire system, placing it under malicious control, while eluding detection efforts. Within the realm of kernel rootkits, dynamic data rootkits are particularly elusive due to the fact that they attack only data targets. Dynamic data rootkits avoid code injection and instead use existing kernel code to manipulate kernel data. Because they do not execute any new code, they are able to complete their attacks without violating kernel code integrity. We propose a prevention solution that blocks dynamic data kernel rootkit attacks by monitoring kernel memory access using virtual machine monitor (VMM) policies. Although the VMM is an external monitor, our system preemptively detects changes to monitored kernel data states and enables fine-grained inspection of memory accesses on dynamically changing kernel data. In addition, readable and writable kernel data can be protected by exposing the illegal use of existing code by dynamic data kernel rootkits. We have implemented a prototype of our system using the QEMU VMM. Our experiments show that it successfully defeats synthesized dynamic data kernel rootkits in real-time, demonstrating its effectiveness and practicality. are one of the most technically challenging malware to defend against because of their attack targets: operating system (OS) kernels. The OS kernel is the core of trust in a running system, with every program relying on the information and environment it provides. As such, if the kernel is compromised then there is effectively no trusted component remaining within the victim system. This leaves all the system's software, including security software, vulnerable to being deceived by forged kernel and system states. Rootkits have the goal of taking control of a victim OS while eluding intrusion detection systems. A common technique is to hijack kernel control flow or manipulate kernel states in order to effectively blind the system and prevent detection of the intrusion. Recent attack trends [5] , [6] show that kernel rootkits are increasingly being used to make other malware more effective. This paper focuses on the prevention of kernel dynamic data attacks which may be employed by a rootkit. A traditional kernel rootkit attack involves the injection and execution of malicious code at the kernel level. A dynamic data attack, however, operates by directly modifying dynamically allocated
KernelGuard (KG) REF is a system that prevents DKOM-based kernel rootkits by monitoring and shepherding kernel memory accesses.
Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring
2009 International Conference on Availability, Reliability and Security
2009 International Conference on Availability, Reliability and Security
Computer Science