DYMO ： Tracking Dynamic Code Identity

DYMO：Tracking Dynamic Code Identity Bob Gilber, Richard Kemmerer, Christopher Kruegel, Giovanni Vigna University of California, Santa Barbara RAID 2011,9 報告者：張逸文

Outline • Introduction • System Overview • System Implementation • Applications for DYMO • Evaluation • Security Analysis • Related Work • Conclusions

Introduction（#1） • Access control：user-based authorization • Code identity • Measurements of a process • DYMO, a system that provides a dynamic code identity primitive • Identity label • Network access

Introduction（#2） • Track the run-time integrity of a process • DYMO • Extending DYMO to label network packets • Experimental results

System Overview（#1） • System requirements • Precise • Secure • Efficient • System Design • Computing cryptographic hash of each code section as the process’ identity • Precise Label computation

System Overview（#2） • Handling Dynamically Generated Code • Don’t hash dynamic code regions directly • dynamically generated code only in certain known parts • Secure Label Computation • runs at a higher privilege • Inside a VMM / as part of the OS • Efficient Label Computation • Modify Windows memory management routines • The label is computed incrementally

System Implementation（#1） • Problems • Load DLLs during run-time • Arbitrary memory regions • DLL reloading • System Initialization • Register for kernel-provided callbacks • Hook the NT kernel system services • Hook the page fault handler • Use Data Execution Prevention(DEP)

System Implementation（#2） • Identity Label Generation • Image hash + region hash = identity label • Image Hashes • Build process profile • Locate the code segment • Modifypageprotection • DEP exception • Page fault handler

System Implementation（#3） • Region Hashes • hook NtAllocateVirtualMemory, NtMapViewOfSection, NtProtectVirtualMemory • checkexecuteaccess • These executable regions are for dynamic code generation • Handling Dynamic Code Generation • Allocator • Writer • Caller regionhash

System Implementation（#4） • Handling the PAGE_EXECUTE_READWRITE protection • PAGE_EXECUTE_READWRITE => PAGE_READWRITE + PAGE_EXECUTE_READ • Establishing Identity • Strict matching policy • Relaxed matching policy

Application for DYMO（#1） • Application-Based Access Control • accesscontrolbased on the identity • global distribution mechanisms • whitelistforallusers • DYMO Network Extension • Inject network packet • Label Size Optimization • Huffman • Split label over multiple packets

Application for DYMO（#2） • The injector：NDIS Intermediate Filter driver • The Broker：TDI Filter driver TCP/IP transport driver Modified packet Network Adapter Modified packet injector Process identity label broker Connection ID

Evaluation（#1） • Label Precision • Three experimentalenvironment • Training database • 93% applications’ labels are precision • Effect of Process Tampering • Tampering by Malware • Tampering by Exploits • Performance Impact

Evaluation（#2）

Evaluation（#3） • PassMarkAppTimer tool < 1 sec.

Security Analysis • Create executable memory regions • Add code to a trusted program • Tamper with the data of a process • Non-control-data attack

Related Work • Local Identification • Patagonix – a hypervisor-based system • Tripwire – static code identity • Remote Identification • Sailerti al. Trusted Platform Module – identify applications for remote attestation

Conclusion • DYMO, a dynamic code identity primitive • Extends DYMO to network packet • An acceptable performance overhead • Future work • Extending DYMO to other platforms • Sophisticated network-level policy enforcement mechanism

DYMO ： Tracking Dynamic Code Identity