Securing Modern Storage Stacks

Abstract

Modern storage stacks implement persistent memory which is a core component of computing systems. This dissertation considers threats that affect the storage stack, discussing solutions to analyze and reduce the resulting attack surface in pre- and post-compromise scenarios. On the attack surface analysis front, we first identified and studied a new class of advanced attacks based on a timing side channel (pre-compromise scenario). The latter originates from the filesystem deduplication feature of modern filesystems like ZFS and Btrfs. We showed how an attacker can abuse the side channel to leak sensitive data at the byte or block granularity, bypassing traditional filesystem access controls. We proposed a mitigation where the read and write operations exhibit the same behavior in the time domain, regardless of the presence of the data on storage. To explore the post-compromise attack surface, we introduced lightweight instrumentation to track low-level storage operations, observing any malicious interactions with the storage stack. This was helpful to study an important class of persistent malware (bootkits) for a large period of time. As a result, we derived its storage-related characteristics and proposed mitigations for it. On the attack surface reduction front, we first studied and proposed a generic intrusion detection system for the virtualized storage stack with low overhead (pre- compromise scenario). Next, we proposed a post-compromise solution for intrusion recovery, which is operating system agnostic and uses heavyweight instrumentation to precisely track malicious data through the system at the byte granularity. In the process, we addressed important challenges such as reducing the semantic gap to have a more precise recovery granularity and hiding the instrumentation overhead by means of a decoupled security model.