Robust signatures for kernel data structures

Brendan Dolan-Gavitt, Abhinav Srivastava, Patrick Traynor, Jonathon Giffin

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Kernel-mode rootkits hide objects such as processes and threads using a technique known as Direct Kernel Object Manipulation (DKOM). Many forensic analysis tools attempt to detect these hidden objects by scanning kernel memory with handmade signatures; however, such signatures are brittle and rely on non-essential features of these data structures, making them easy to evade. In this paper, we present an automated mechanism for generating signatures for kernel data structures and show that these signatures are robust: attempts to evade the signature by modifying the structure contents will cause the OS to consider the object invalid. Using dynamic analysis, we profile the target data structure to determine commonly used fields, and we then fuzz those fields to determine which are essential to the correct operation of the OS. These fields form the basis of a signature for the data structure. In our experiments, our new signature matched the accuracy of existing scanners for traditional malware and found processes hidden with our prototype rootkit that all current signatures missed. Our techniques significantly increase the difficulty of hiding objects from signature scanning.

    Original languageEnglish (US)
    Title of host publicationCCS'09 - Proceedings of the 16th ACM Conference on Computer and Communications Security
    Pages566-577
    Number of pages12
    DOIs
    StatePublished - 2009
    Event16th ACM Conference on Computer and Communications Security, CCS'09 - Chicago, IL, United States
    Duration: Nov 9 2009Nov 13 2009

    Publication series

    NameProceedings of the ACM Conference on Computer and Communications Security
    ISSN (Print)1543-7221

    Other

    Other16th ACM Conference on Computer and Communications Security, CCS'09
    CountryUnited States
    CityChicago, IL
    Period11/9/0911/13/09

    Keywords

    • Data structures
    • Memory analysis
    • Security

    ASJC Scopus subject areas

    • Software
    • Computer Networks and Communications

    Fingerprint Dive into the research topics of 'Robust signatures for kernel data structures'. Together they form a unique fingerprint.

    Cite this