Detecting Peripheral-based Attacks on the Host Memory

Abstract

Ich versichere von Eides statt, dass ich diese Dissertation selbständig verfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum i/ix Abstract Adversaries can deploy rootkit techniques on the target platform to persistently attack computer systems in a stealthy manner. Industrial and political espionage, surveillance of users as well as conducting cybercrime require stealthy attacks on computer systems. Utilizing a rootkit technique means, that a part of the implemented attack code is responsible for concealing the attack. Attack code that is loaded into peripherals such as the network interface card or special micro-controllers currently are the peak of the evolution of rootkits. This work examines such stealthy peripheral-based attacks on the host computer. Peripherals have a dedicated processor and dedicated runtime memory to handle their tasks. This means that these peripherals are essentially a separate system. Attackers benefit from this kind of isolation. Peripherals generally communicate with the host via the host main memory. Attackers exploit this fact. All host runtime data is present in the main memory. This includes cryptographic keys, passwords, opened files, and other sensitive data. The attacker only needs to locate such data. Subsequently, attackers can read and modify the data unbeknownst by utilizing the direct memory access mechanism of the peripheral. This allows for circumventing security software such as state-of-the-art anti-virus software and modern hardened operating system kernels. Detecting such attacks is the goal of this work. Stealthy malicious software (malware) that is based on an isolated micro-controller is implemented to conduct an attack analysis. The malware proof of concept is called DAGGER, which is derived from Direct memory Access based keystroke code loGGER. The development and analysis of this malware reveals important properties of peripheral-based mal-ware. The results of the analysis are the basis for the development of a novel runtime detector. The detector is called BARM-Bus Agent Runtime Monitor. This detector reveals stealthy peripheral-based attacks on the host main memory by exploiting certain hardware properties. A permanent and resource-efficient measurement strategy ensures that the detector is also capable of detecting transient attacks. Such transient attacks are possible when the applied measurement strategy only measures at certain points in time. The attacker exploits this measurement strategy by attacking the system in between two measurements and by destroying all attack traces before the system is measured. The detector represents an alternative solution for previously proposed preventive protection approaches, i. e., input/output memory management units. Previously proposed approaches are not necessarily effective due to practical issues. This fact as well as the threat posed by peripheral-based mal-ware demand the alternative detector solution that is presented in this work. The detector does not only reveal an attack, but al...

Understanding The Security of Discrete GPUs

“…Firmware attacks. There are several firmware-based attacks that target diverse devices [1,3,10,41,47,51]. Similar to the microcode attack in this paper, these attacks embed malicious code into the firmware to circumvent the platform's security while evading detection.…”

A rest stop on the unending road to provable security

“…We envision a verifier device to be attached to the main system bus via a DMA interface, similar in spirit to that of Intel's Manageability Engine or AMD's Platform Security Processor, but without flaws that would enable an attacker to plant malware in it [52]. These processors can operate independently of all other system components; e.g., even when all other components are powered down [67]. The external verifier could also run on a co-processor connected to the main system bus, similar in spirit to Ki-Mon ARM [41].…”

“…System components that are not directly addressable by CPU instructions or by trusted hardware modules enable malware to survive in non-volatile memories despite repeated power cycles, secure-and trusted-boot operations [56]; i.e., malware becomes persistent. For example, persistent malware has been found in the firmware of peripheral controllers [15], [43], [67], network interface cards [16], [17], disk controllers [5], [48], [60], [77], USB controllers [2], as well as routers and firewalls [5]. Naturally, persistent malware can infect the rest of the system state, and thus a remote adversary can retain long-term undetected control of a user's local system.…”

A PUF-based cryptographic security solution for IoT systems on chip

“…Compared to the existing work, our implementation proposal covers the hardware vulnerabilities which can be exploited by software applications or physical investigations of an IoT integrated circuit-more precisely attacks such as: snooping the bus; accessing the sensitive data stored in memories; memory inspection using DMA [20]; copying critical data using DMA reads [20,21]; hardware Trojans. All these attacks could be achieved with malicious programs gaining access to sensitive data, by exploiting hardware vulnerabilities.…”