Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms

[Nytro]

Return-Oriented Rootkits:

Bypassing Kernel Code Integrity Protection Mechanisms

Ralf Hund Thorsten Holz Felix C. Freiling

Laboratory for Dependable Distributed Systems

University of Mannheim, Germany

hund@uni-mannheim.de, fholz,freilingg@informatik.uni-mannheim.de

Abstract

Protecting the kernel of an operating system against attacks, especially injection of malicious code, is an important factor for implementing secure operating systems.

Several kernel integrity protection mechanism were proposed recently that all have a particular shortcoming:

They cannot protect against attacks in which the attacker

re-uses existing code within the kernel to perform malicious computations. In this paper, we present the design

and implementation of a system that fully automates the

process of constructing instruction sequences that can be

used by an attacker for malicious computations. We evaluate the system on different commodity operating systems and show the portability and universality of our

approach. Finally, we describe the implementation of a

practical attack that can bypass existing kernel integrity

protection mechanisms.

Download:

http://www.usenix.org/event/sec09/tech/full_papers/hund.pdf