Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections

Transcription

1 Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections Abhinav Srivastava and Jonathon Giffin School of Computer Science Georgia Institute of Technology

2 Attacks Victim System Bot Strange processes Strange connections Backdoor Spyware Worm Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 2

3 Goals Detect and block outbound malicious network connections Detect and prevent remote attackers from connecting to local malware Remain tamper-resistant from direct attacks Victim System Bot Spyware Backdoor Worm Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 3

4 Network Firewall Internet Victim System Firewall Block Firewall Coarse policies Incomplete view Network App Tamper resistant Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 4

5 Host Firewall Internet Fine grained policies Complete view Victim System Network App Firewall Not tamper resistant Firewall Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 5

6 Virtualization-based Firewall Security VM Fine grained policies Complete view Victim VM Network App Driver Firewall Bridge Tamper resistant Driver Backend Shared Memory Driver Frontend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 6

7 Challenges Correlate IP/port and corresponding process in guest VM Solution: Virtual Machine Introspection (VMI) Extract semantic information from raw memory Solution: OS knowledge to parse data structures Impose low overhead Solution: Selective introspection Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 7

8 Threat Model Hypervisor & security VM are secure Both user and kernel-level attacks are possible Expect to find the data structures at known places Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 8

9 Prototype System: Security VM User-space Kernel-space User Component Firewall Kernel Component Tamper resistance Independence Lightweight verification Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 9

10 Kernel Module Architecture Security VM User-space Kernel-space User Component Firewall Kernel Component Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 10

11 Kernel Module Architecture Security VM User-space Kernel-space Kernel Component Firewall Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 11

12 Kernel Module Architecture User-space Security VM Kernel-space Kernel Component Rule Table Packet Queue P1 P2 Driver Bridge Driver Backend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 12

13 User Agent Architecture User-space Security VM Kernel-space Kernel Component Rule Table Packet Queue P1 P2 Driver Bridge Driver Backend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 13

14 User Agent Architecture Security VM User Agent User-space Kernel-space Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 14

15 User Agent Architecture Security VM Victim VM System. map Whitelist User-space Kernel-space User Agent CR3 Page Directory Page Table User-space Kernel-space Kernel Data Structure Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 15

16 Kernel Data Structures Traversal Ports: Process: inet_hashinfo task_struct Linked list iteration hlist_head hlist_head hlist_head hlist_head Array iteration Linked list iteration task_struct hlist_node files_struct fdtable file file file sock Match Array Iteration hlist_node Return: Process information from task_struct Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 16

17 Security Evaluation Name Type Connection Type Result Blackhole Backdoor Inbound Blocked Gummo Backdoor Inbound Blocked Bdoor Backdoor Inbound Blocked Ovas0n Backdoor Inbound Blocked Cheetah Backdoor Inbound Blocked Apache-ssl Worm Blocked Apache-linux Worm Blocked Backdoor-Rev.b Worm Blocked Q8 Bot Blocked Kaiten Bot Blocked Coromputer Dunno Bot Blocked Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 17

18 Legitimate Connections Name rcp rsh yum rlogin ssh scp wget tcp client thttpd tcp server sshd Connection Type Inbound Inbound Inbound Result Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 18

19 Performance Evaluation Directions Inbound Connection to Victim VM Connection from Victim VM TCP Introspection Time (µs) UDP Introspection Time (µs) Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 19

20 Performance Evaluation Directions Without Time (s) With Time (s) Overhead File Transfer from Security VM to Victim VM % File Transfer from Victim VM to Security VM % Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 20

21 Performance Evaluation Directions Without Time (µs) With Time (µs) Overhead Time(µs) Connection from Security VM to Victim VM Connection from Victim VM to Security VM Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 21

22 Security Analysis Kernel data structures modification attacks Semantic kernel integrity [Petroni et al. Usenix Security 2006] Process renaming attacks Tripwire or disk introspection Code injection attacks DoS attacks Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 22

23 Conclusions provides tamper-resistant firewalling framework Combines both host and network level views Provides fine grained application-level filtering Imposes low overhead Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 23

24 Questions?. or send us Abhinav Srivastava Jonathon Giffin Thanks to: Steve Dawson (SRI International) Monirul Sharif (Georgia Tech) Bryan D. Payne (Georgia Tech) Andrea Lanzi (Georgia Tech) Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 24

25 Related Work Distributed Firewalling [Bellovin] Centralized Policy Design Distributed Enforcement of Policy Implementation of Distributed Firewalling [Ioannidis CCS 2000] Flexible OS Support Infrastructure [Garfinkel HotOS 2006] Virtual Machines for supporting distributed firewalling Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 25

26 Performance Evaluation Directions Without Time (µs) With Time (µs) Overhead Inbound Initiated Initiated Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 26