DMCA
Defeating returnoriented rootkits with return-less kernels
| Venue: | in Proceedings of the 5th European conference on Computer systems |
| Citations: | 53 - 5 self |
BibTeX
@INPROCEEDINGS{Li_defeatingreturnoriented,
author = {Jinku Li and Zhi Wang and Xuxian Jiang and Mike Grace and Sina Bahram},
title = {Defeating returnoriented rootkits with return-less kernels},
booktitle = {in Proceedings of the 5th European conference on Computer systems},
year = {},
pages = {195--208}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Targeting the operating system (OS) kernels, kernel rootkits pose a formidable threat to computer systems and their users. Recent efforts have made significant progress in blocking them from injecting malicious code into the OS kernel for execution. Unfortunately, they cannot block the emerging so-called return-oriented rootkits (RORs). Without the need of injecting their own malicious code, these rootkits can dis-cover and chain together “return-oriented gadgets ” (that con-sist of only legitimate kernel code) for rootkit computation. In this paper, we propose a compiler-based approach to defeat these return-oriented rootkits. Our approach recog-nizes the hallmark of return-oriented rootkits, i.e., the ret instruction, and accordingly aims to completely remove them in a running OS kernel. Specifically, one key technique named return indirection is to replace the return address in a stack frame into a return index and disallow a ROR from us-ing their own return addresses to locate and assemble return-oriented gadgets. Further, to prevent legitimate instructions that happen to contain return opcodes from being misused, we also propose two other techniques, register allocation and peephole optimization, to avoid introducing them in the first place. We have developed a LLVM-based prototype and used it to generate a return-less FreeBSD kernel. Our evalu-ation results indicate that the proposed approach is generic, effective, and can be implemented on commodity hardware with a low performance overhead.
Keyphrases
return-less kernel malicious code return-oriented rootkits return address legitimate instruction so-called return-oriented rootkits recent effort return-oriented gadget low performance overhead llvm-based prototype key technique rootkit computation register allocation computer system o kernel operating system peephole optimization return index evalu-ation result legitimate kernel code first place assemble return-oriented gadget return opcodes stack frame return indirection significant progress compiler-based approach running o kernel formidable threat return-less freebsd kernel ret instruction commodity hardware
