Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms

[Nytro]

Return-Oriented Rootkits:

Bypassing Kernel Code Integrity Protection Mechanisms

Abstract

Protecting the kernel of an operating system against attacks,

especially injection of malicious code, is an important

factor for implementing secure operating systems.

Several kernel integrity protection mechanism were proposed

recently that all have a particular shortcoming:

They cannot protect against attacks in which the attacker

re-uses existing code within the kernel to perform malicious

computations. In this paper, we present the design

and implementation of a system that fully automates the

process of constructing instruction sequences that can be

used by an attacker for malicious computations. We evaluate

the system on different commodity operating systems

and show the portability and universality of our

approach. Finally, we describe the implementation of a

practical attack that can bypass existing kernel integrity

protection mechanisms.

1 Introduction

Motivation. Since it is hard to prevent users from running

arbitrary programs within their own account, all

modern operating systems implement protection concepts

that protect the realm of one user from another.

Furthermore, it is necessary to protect the kernel itself

from attacks. The basis for such mechanisms is usually

called reference monitor [2]. A reference monitor

controls all accesses to system resources and only grants

them if they are allowed. While reference monitors are

an integral part of any of today’s mainstream operating

systems, they are of limited use: because of the sheer

size of a mainstream kernel, the probability that some

system call, kernel driver or kernel module contains a

vulnerability rises. Such vulnerabilities can be exploited

to subvert the operating system in arbitrary ways, giving

rise to so called rootkits, malicious software running

without the user’s notice.

Download:

https://www.usenix.org/legacy/event/sec09/tech/full_papers/hund.pdf