Hello rootKitty: A lightweight invariance-enforcing framework
| Autor: | Nick Nikiforakis, Yves Younan, Francesco Gadaleta, Wouter Joosen |
|---|---|
| Přispěvatelé: | Lai, XJ, Zhou, JY, Li, H |
| Jazyk: | angličtina |
| Rok vydání: | 2014 |
| Předmět: |
FOS: Computer and information sciences
Correctness Software_OPERATINGSYSTEMS Computer Science - Cryptography and Security Operating Systems (cs.OS) Computer science business.industry Rootkit Cloud computing Virtualization computer.software_genre Computer Science - Operating Systems Kernel (statistics) Operating system Overhead (computing) Isolation (database systems) business Cryptography and Security (cs.CR) Host (network) computer |
| Zdroj: | Lecture Notes in Computer Science ISBN: 9783642248603 ISC |
| Popis: | In monolithic operating systems, the kernel is the piece of code that executes with the highest privileges and has control over all the software running on a host. A successful attack against an operating system's kernel means a total and complete compromise of the running system. These attacks usually end with the installation of a rootkit, a stealthy piece of software running with kernel privileges. When a rootkit is present, no guarantees can be made about the correctness, privacy or isolation of the operating system. In this paper we present \emph{Hello rootKitty}, an invariance-enforcing framework which takes advantage of current virtualization technology to protect a guest operating system against rootkits. \emph{Hello rootKitty} uses the idea of invariance to detect maliciously modified kernel data structures and restore them to their original legitimate values. Our prototype has negligible performance and memory overhead while effectively protecting commodity operating systems from modern rootkits. 16 pages, ISC Information Security Conference, Xi'an China, 2011, Springer |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|