ModChecker: Kernel Module Integrity Checking in the Cloud Environment

Abstract

Kernel modules are an integral part of most operating systems (OS) as they provide flexible ways of adding new functionalities (such as file system or hardware support) to the kernel without the need to recompile or reload the entire kernel. Aside from providing an interface between the user and the hardware, these modules maintain system security and reliability. Malicious kernel level exploits (e.g. code injections) provide a gateway to a system's privileged level where the attacker has access to an entire system. Such attacks may be detected by performing code integrity checks. Several commodity operating systems (such as Linux variants and MS Windows) maintain signatures of different pieces of kernel code in a database for code integrity checking purposes. However, it quickly becomes cumbersome and time consuming to maintain a database of legitimate dynamic changes in the code, such as regular module updates. In this paper we present ModChecker, which checks in-memory kernel modules' code integrity in real time without maintaining a database of hashes. Our solution applies to virtual environments that have multiple virtual machines (VMs) running the same version of the operating system, an environment commonly found in large cloud servers. ModChecker compares kernel module among a pool of VMs within a cloud. We thoroughly evaluate the effectiveness and runtime performance of ModChecker and conclude that ModChecker is able to detect any change in a kernel module's headers and executable content with minimal or no impact on the guest operating systems' performance.

Integrity Checking of Function Pointers in Kernel Pools via Virtual Machine Introspection

“…HookLocator works in such a virtualized environment, where it runs in a privileged VM and accesses the physical memory of guest VMs through VMI. We also assume that the kernel code and the well-known kernel data structures inside the guest VMs are protected by PatchGuard or an alternate solution, such as VICE [9], System Virginity Verifier [10], ModChecker [11] and IceSword [12].…”

Extension of Research on Security as a Service for VMs in IaaS Platform

“…e state of a VM can be monitored through some specific Hypervisor APIs, while the retrieved information is limited to the inherent APIs severely without opportunities to expand or customize, such as products of OpenStack Ceilometer and AWS CloudWatch. To make up for that deficiency, the methods based on Virtual Machine Introspection (VMI) have been proposed [18][19][20].…”