NDLI: Defeating return-oriented rootkits with "Return-Less" kernels

Please wait, while we are loading the content...

Using transparent compression to improve SSD-based I/O caches

Evaluation of AMD's advanced synchronization facility within a complete transactional memory stack

Self-tuning schedulers for legacy real-time applications

Barricade: defending systems against operator mistakes

Bias scheduling in heterogeneous multi-core architectures

Reverse engineering of binary device drivers with RevNIC

Boom analytics: exploring data-centric, declarative programming for the cloud

Residue objects: a challenge to web browser security

Kivati: fast detection and prevention of atomicity violations

Dr. multicast: Rx for data center communication scalability

Differential RAID: rethinking RAID for SSD reliability

Transactional memory support for scalable and transparent parallelization of multiplayer games

High-level programming of embedded hard real-time devices

Splitter: a proxy-based approach for post-migration testing of web applications

A comprehensive scheduler for asymmetric multicore systems

Otherworld: giving applications a chance to survive OS kernel crashes

Q-clouds: managing performance interference effects for QoS-aware clouds

Policy-based access control for weakly consistent replication

Execution synthesis: a technique for automated software debugging

The next 700 BFT protocols

Fingerprinting the datacenter: automated classification of performance crises

Resource-conscious scheduling for energy efficiency on multicore processors

Defeating return-oriented rootkits with "Return-Less" kernels

HadoopToSQL: a mapReduce query optimizer

Locating cache performance bottlenecks using data profiling

NOVA: a microhypervisor-based secure virtualization architecture

Delay scheduling: a simple technique for achieving locality and fairness in cluster scheduling

Defeating return-oriented rootkits with "Return-Less" kernels

Content Provider	ACM Digital Library
Author	Li, Jinku Bahram, Sina Wang, Zhi Jiang, Xuxian Grace, Michael
Abstract	Targeting the operating system (OS) kernel, kernel rootkits pose a formidable threat to computer systems and their users. Recent efforts have made significant progress in blocking them from injecting malicious code into the OS kernel for execution. Unfortunately, they cannot block the emerging so-called return-oriented rootkits (RORs). Without the need of injecting their own malicious code, these rootkits can discover and chain together "return-oriented gadgets" (that consist of only legitimate kernel code) for rootkit computation. In this paper, we propose a compiler-based approach to defeat these return-oriented rootkits. Our approach recognizes the hallmark of return-oriented rootkits, i.e., the ret instruction, and accordingly aims to completely remove them in a running OS kernel. Specifically, one key technique named return indirection is to replace the return address in a stack frame into a return index and disallow a ROR from using their own return addresses to locate and assemble return-oriented gadgets. Further, to prevent legitimate instructions that happen to contain return opcodes from being misused,we also propose two other techniques, register allocation and peephole optimization, to avoid introducing them in the first place. We have developed a LLVM-based prototype and used it to generate a return-less FreeBSD kernel. Our evaluation results indicate that the proposed approach is generic, effective, and can be implemented on commodity hardware with a low performance overhead.
Starting Page	195
Ending Page	208
Page Count	14
File Format	PDF
ISBN	9781605585772
DOI	10.1145/1755913.1755934
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-04-13
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Return-less kernel Return-oriented rootkits Defense
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Defeating returnoriented rootkits with return-less kernels

G-Free: defeating return-oriented programming through gadget-less binaries

USENIX Security Symposium ’09 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms (2009)

University of mannheim, germany laboratory for dependable distributed systems return-oriented rootkits: bypassing kernel code integrity protection mechanisms (2009).

Defeating Dynamic Data Kernel Rootkit Attacks via VMMBased Guest-Transparent Monitoring (2009)

Countering kernel rootkits with lightweight hook protection

Proactive Detection of Kernel-Mode Rootkits

Kernel rootkits implement and detection

Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring

Defeating return-oriented rootkits with "Return-Less" kernels

Similar Documents

Defeating returnoriented rootkits with return-less kernels

G-Free: defeating return-oriented programming through gadget-less binaries

USENIX Security Symposium ’09 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms (2009)

University of mannheim, germany laboratory for dependable distributed systems return-oriented rootkits: bypassing kernel code integrity protection mechanisms (2009).

Defeating Dynamic Data Kernel Rootkit Attacks via VMMBased Guest-Transparent Monitoring (2009)

Countering kernel rootkits with lightweight hook protection

Proactive Detection of Kernel-Mode Rootkits

Kernel rootkits implement and detection

Defeating Dynamic Data Kernel Rootkit Attacks via VMM-Based Guest-Transparent Monitoring

Defeating return-oriented rootkits with "Return-Less" kernels