Hi-Fi: Collecting High-Fidelity Whole-System Provenance

Annual Computer Security Applications Conference (ACSAC) 2012 Hi-Fi: Collecting High-Fidelity Whole-System Provenance Devin J.Pohly1, Stephen McLaughlin1, Patrick McDaniel1, Kevin Butler2 1Pennsylvania State University 2University of Oregon 左昌國 12/11, 2012, Seminar @ ADLab, NCU

Outline • Introduction • Design • System-Level Object Model • Implementation • Evaluation • Conclusion

Introduction • Data provenance • A record of the origin and evolution of data in a system • Useful for forensic analysis • Current approaches • System call interception • Lineage File System • PASSv2 • Forensix • Insufficient fidelity • VFS handling • Story Book provenance system • FUSE API • Insufficient breadth

Introduction • Linux Security Modules (link) • LSM is a framework which was originally designed for integrating custom access control mechanisms into the Linux kernel • “Security fields” in kernel data structures • Ex: inode • “Hooks” in kernel code • Ex: inode_permission in SELinux • The hook placement has been repeatedly analyzed and refined in literature to ensure that every access is mediated

Introduction

Design • Provenance collector • Provenance log • Provenance handler

Design • Threat Model • Any userspace compromise • Kernel-level compromise • Isolated disk-level versioning system • Write-once read-many storage system

Design – Provenance Collector • Read/write file descriptor • File operation • IPC • Network communication • Program execution • Creation/deletion of credential obj • User transition

System-Level Object Model • provid • A small integer which is reserved for an object until it is destroyed

System-Level Object Model: System, Processes, and Threads • UUID • A random UUID is created at boot time • cred structure (ex: in task_struct) • Process fork • New credential • A provid for each created cred structure

System-Level Object Model • Files and Filesystems • UUID + inode number • Pipes and Message Queues • Pipe • The data queue is modeled as an file • Message Queue • A provid for each message

System-Level Object Model - Sockets • UUID + counter • The sender chooses an identifier for the remote receive queue and transmit it along with the first data packet

Implementation Details • Efficient Data Transfer • relay • A kernel ring buffer made up of a set of preallocatedsub-buffer • Represented as a regular file in user space • Early Boot Provenance • LSM is initialized as early as possible • The provenance is stored in a small temporary buffer before the VFS (for relay) is initialized • Operating System Integration • /etc/inittab • Shutdown: Terminate other processes before handler

Implementation Details • Provenance-Opaque Flag • The handler calls “read” • trigger file_permission hook • adding another action in log, handler calls “read” • loop • A flag “security.hifi” is set in the handler process

Evaluation A(attacker) C compromise B spread

Evaluation • Persistence and Stealth

Evaluation • Remote Control Open shell Exfiltration Write a file

Evaluation • Spread

Evaluation • Performance • Microbenchmark • Macrobenchmark • 2.8% time overhead (build a kernel)

Conclusion • This paper presents a high-fidelity provenance record • This record can be used to observe the behavior of malware • Low-overhead

Hi-Fi: Collecting High-Fidelity Whole-System Provenance