Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections Abhinav Srivastava and Jonathon Giffin School of Computer Science Georgia Institute of Technology
Attacks Victim System Bot Strange processes Strange connections Backdoor Spyware Worm Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 2
Goals Detect and block outbound malicious network connections Detect and prevent remote attackers from connecting to local malware Remain tamper-resistant from direct attacks Victim System Bot Spyware Backdoor Worm Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 3
Network Firewall Internet Victim System Firewall Block Firewall Coarse policies Incomplete view Network App Tamper resistant Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 4
Host Firewall Internet Fine grained policies Complete view Victim System Network App Firewall Not tamper resistant Firewall Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 5
Virtualization-based Firewall Security VM Fine grained policies Complete view Victim VM Network App Driver Firewall Bridge Tamper resistant Driver Backend Shared Memory Driver Frontend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 6
Challenges Correlate IP/port and corresponding process in guest VM Solution: Virtual Machine Introspection (VMI) Extract semantic information from raw memory Solution: OS knowledge to parse data structures Impose low overhead Solution: Selective introspection Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 7
Threat Model Hypervisor & security VM are secure Both user and kernel-level attacks are possible Expect to find the data structures at known places Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 8
Prototype System: Security VM User-space Kernel-space User Component Firewall Kernel Component Tamper resistance Independence Lightweight verification Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 9
Kernel Module Architecture Security VM User-space Kernel-space User Component Firewall Kernel Component Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 10
Kernel Module Architecture Security VM User-space Kernel-space Kernel Component Firewall Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 11
Kernel Module Architecture User-space Security VM Kernel-space Kernel Component Rule Table Packet Queue P1 P2 Driver Bridge Driver Backend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 12
User Agent Architecture User-space Security VM Kernel-space Kernel Component Rule Table Packet Queue P1 P2 Driver Bridge Driver Backend Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 13
User Agent Architecture Security VM User Agent User-space Kernel-space Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 14
User Agent Architecture Security VM Victim VM System. map Whitelist User-space Kernel-space User Agent CR3 Page Directory Page Table User-space Kernel-space Kernel Data Structure Xen Physical Hardware Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 15
Kernel Data Structures Traversal Ports: Process: inet_hashinfo task_struct Linked list iteration hlist_head hlist_head hlist_head hlist_head Array iteration Linked list iteration task_struct hlist_node files_struct fdtable file file file sock Match Array Iteration hlist_node Return: Process information from task_struct Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 16
Security Evaluation Name Type Connection Type Result Blackhole Backdoor Inbound Blocked Gummo Backdoor Inbound Blocked Bdoor Backdoor Inbound Blocked Ovas0n Backdoor Inbound Blocked Cheetah Backdoor Inbound Blocked Apache-ssl Worm Blocked Apache-linux Worm Blocked Backdoor-Rev.b Worm Blocked Q8 Bot Blocked Kaiten Bot Blocked Coromputer Dunno Bot Blocked Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 17
Legitimate Connections Name rcp rsh yum rlogin ssh scp wget tcp client thttpd tcp server sshd Connection Type Inbound Inbound Inbound Result Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Allowed Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 18
Performance Evaluation Directions Inbound Connection to Victim VM Connection from Victim VM TCP Introspection Time (µs) 251 1080 UDP Introspection Time (µs) 438 445 Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 19
Performance Evaluation Directions Without Time (s) With Time (s) Overhead File Transfer from Security VM to Victim VM 1.105 1.179 7% File Transfer from Victim VM to Security VM 1.133 1.140 1% Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 20
Performance Evaluation Directions Without Time (µs) With Time (µs) Overhead Time(µs) Connection from Security VM to Victim VM 197 465 268 Connection from Victim VM to Security VM 143 1266 1123 Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 21
Security Analysis Kernel data structures modification attacks Semantic kernel integrity [Petroni et al. Usenix Security 2006] Process renaming attacks Tripwire or disk introspection Code injection attacks DoS attacks Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 22
Conclusions provides tamper-resistant firewalling framework Combines both host and network level views Provides fine grained application-level filtering Imposes low overhead Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 23
Questions?. or send us email: Abhinav Srivastava Jonathon Giffin abhinav@cc.gatech.edu giffin@cc.gatech.edu Thanks to: Steve Dawson (SRI International) Monirul Sharif (Georgia Tech) Bryan D. Payne (Georgia Tech) Andrea Lanzi (Georgia Tech) Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 24
Related Work Distributed Firewalling [Bellovin] Centralized Policy Design Distributed Enforcement of Policy Implementation of Distributed Firewalling [Ioannidis CCS 2000] Flexible OS Support Infrastructure [Garfinkel HotOS 2006] Virtual Machines for supporting distributed firewalling Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 25
Performance Evaluation Directions Without Time (µs) With Time (µs) Overhead Inbound Initiated 434 815 381 Initiated 271 848 577 Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections 26