Slashdot Mirror
Scientists Unveil Lightweight Rootkit Protection
DangerFace writes "Scientists are set to unveil a lightweight system they say makes an operating system significantly more resistant to rootkits without degrading its performance. The hypervisor-based system is dubbed HookSafe, and it works by relocating kernel hooks in a guest OS to a dedicated page-aligned memory space that's tightly locked down. The team installed HookSafe on a machine running Ubuntu 8.04, and found the system successfully prevented nine real-world rootkits targeting that platform from installing or hiding themselves. The program was able to achieve that protection with only a 6 percent reduction in performance benchmarks."
I would gladly give up 6% of the performance of my machine if I could be safe from rootkits. Now queue the "those who would give up system performance for system security deserve neither" posts.
"I'm just here to regulate funkiness."
But does it run... oh, right.
There's actually nine rootkits out there for Linux? Anyone run into these or have any recommendations of good detection software? I've always been curious if an clamav run from a live CD will pick them up.
So the synopsis starts by saying it doesn't degrade performance and ends with "it only causes a 6% drop in performance." Now, I might be nieve but why can't these memory aligning tricks be done in the kernel naively?
Yes Francis, the world has gone crazy.
I'd like to know the 9 rootkits used. I know Ubuntu 8.04 is a generation behind the current stable version but I don't think there were any rootkits capable of installing. I'm assuming the people doing the test didn't install the kernel source on the box. It isn't installed by default and AFAIK you have to be able to build the kit using the kernel source. Anyone know of a rootkit that can be installed without creating modules from the kernel source? Maybe I'm just way out of the loop on owning a Linux box.
Having to work for a living is the root of all evil.
Surely this problem was addressed in the 1960s or 1970s in the mainframe world, yet I've not heard much in the way of lessons we can apply to today's PC-type OSes.
Anyone? Anyone? Bueller?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So this thing acts as a hypervisor and loads its own hooks into the kernel. Sounds like something a root kit would do.
It reminds me of one approach to avoid a terrorist attack when flying. Carry your own bomb onto the plane. After all, what are the chances that there would be two bombs on the plane?
Give me Classic Slashdot or give me death!
... it being partly a microsoft research project and all. They wouldn't be trying to imply anything about Linux would they , or perish the thought , be unwilling to embarras themselves if Windows could *still* be rooted even after this solution was installed?
Anti Virus programs are effectively rootkits - at least for Windows - as they bury themselves deep in the OS and redirect various kernel hooks to themselves. I can see potential problems if this type of solution ever becomes common though I suppose you could argue that you shouldn't need anti virus protection if you have this hypervisor. And with both Linux and Windows how would it take into account someone attempting to load a driver/module from userland?
You cannot protect against root kits, all you can do is make it harder to get true root. How is this more effective than making key binaries immutable then removing the kernel ability to remove immutability during boot (performance cost 0%)?
IranAir Flight 655 never forget!
Anyone run into these or have any recommendations of good detection software?
Rootkit Hunter
Reply to That ||
I think you had a little typo there, but I fixed it.
Ze Atomic Device! It iz Ztolen!
I can see potential problems if this type of solution ever becomes common though I suppose you could argue that you shouldn't need anti virus protection if you have this hypervisor.
Hah! Well I see a potential problem there. :)
But others (the bad kind) probably see only the potential...
A root kit is just a sandbox that someone else has set up for you on what is now his or her computer.
Inheritance is the sincerest form of nepotism.
Probably more likely it's easier to test the theory on a kernel you can hack the source of quite easily than recompile Windows every time.. even if you have the souce license (which they may not have done even though they're funded by microsoft).
6% of my mobile phone? Or 6% of the RoadRunner with its 1 petaflop?
I think a proper rootkit protection is a passive one. One that only takes resources, if there is actually something to do. How about that?
Sorry, 6% might sound small, but when you add it all together, rootkit-protection, anti-virus, anti-malware, intrusion detection system, honeypot, etc, etc, etc... and end up with only 6% of your cpu work actually being used for real work... you might start thinking about designing your OS in a proper way in the first place!
I don't like doing it wrong, and then patching it up. Or else I'd use Windows ME.
Just my two cents.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Since when has a distro qualified as a platform?
I know Ubuntu is popular, but this sycophancy is going a bit too far.
If I were insane with security, I'd still prefer booting a live distro from CD to booting an OS from disk, as any infection would be removed when powering down. But I suppose that this rootkit protection might add to the security of such a CD ...
Together with Rkhunter (mentionned in another post bellow) Chkrootkit are both nice tools to use in helping preventing a linux machine being rooter.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Its an unfair kneejerk reaction everytime I hear the word "scientist" and "security" spouted in the same sentance the first thing that pops into my mind is yet another stupid idea from someone peddling ignorance from well outside their domain.
If you don't want viruses to be able to hook the kernel of your favorite operating system...for crying out loud don't login as a user with those privledges.
Having hooksafe pimps relocate kernel hookers will not prevent your system from contracting an STD. Most people don't even care about their OS. They care about their work and crap thats on the computer itself.
But I don't want lightweight protection. I want a lot of steel and guns. And armed drones with packet sniffers. And K-9 units with dowsing rods.
That quote from Franklin is about politcal climate and government. You could just as easily defame the quote by applying it to specific technology, such as a car or computer. However, they are very different things and don't change the importance of the original quote.
I just don't want this all important principal to be lost, is all:
They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.
I believe liveCDs work because they create ramdisks which are modifiable in memory so that they could technically be exploited in memory until switched off. Unless of course they are read only ram disks.
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
I think IBM invented hypervisors to allow running multiple OS's on the same hardware back in the 1960s...
Yep: http://en.wikipedia.org/wiki/Hypervisor#Mainframe_origins
The paper: http://discovery.csc.ncsu.edu/pubs/ccs09-HookSafe.pdf
And the required Schneier blog post: http://www.schneier.com/blog/archives/2009/11/protecting_oss.html
Natural != (nontoxic || beneficial)
He was also a polymath.
And a poly-woman, for sure.
This is my sig.
It's not even lightweight. 6% is not lightweight. How about a lightweight tax raise? Only 6%!
Microsoft Research is for all intents and purposes academia without having to beg for funding from random organizations.
The team installed HookSafe on a machine running Ubuntu 8.04, and found the system successfully prevented nine real-world rootkits targeting that platform from installing or hiding themselves.
Of course they didn't detect any rootkits installing themselves, that's exactly what an installed rootkit would prevent them from seeing.
Mucking with page alignment and/or addressing would effectively prevent Nvidia/fglrx drivers from working (which is more or less why they don't work in HVM or the L4 microkernels, which implement Linux at a lower layer; they expect to be at specific addresses in a specific way, however you make it 'not that address', it doesn't work), nevermind wine, and it'd presumably be hard pressed to get a rootkit onto a well maintained Linux server in the first place, since nobody'd be running with root priveleges except a remote admin that logs in once in a while, with or without 'security modules' or Stack Smashing Protection on top to limit the scope and possibility of any intrusions or privilege escalation.
So, this appears useless for desktops, useless for servers, what's left? It's good that money is being spent on research like this...
"A Goddess rarely smiles for she is forced by others to be an island unto herself." - Zephiris
The Moon is Earth's only natural satellite and the fifth largest satellite in the Solar System
I think you made a typo on pretty much every one of your letters, but I fixed them all.
http://discovery.csc.ncsu.edu/pubs/ccs09-HookSafe.pdf
[Via Schneier]
That may be true, but having encountered tied actions from purportedly independent MS funded groups before, I'm going to remain a bit dubious. I don't know what their agenda is, and I'll accept that it *MIGHT* be academic research. But it's going to take a bushel and a half of proof before I'll consider that a reasonable default assumption.
I think we've pushed this "anyone can grow up to be president" thing too far.
No. No. No. You should tackle it like a philosophy alchemist would:
If you bring a bomb, and a terrorist brings a bomb, they will clearly mate as they do in the wild. Therefore, you will not have two bombs, but three: two adults and one child. Therefore it is not very likely you will have two bombs for long!
However if only you bring a bomb, and no terrorist shows up to bring a bomb, the bomb will have no mate, and thereby will not be able to produce a child.
**ahem** ... Dr. Livingstone, if I may interject here, if there is only one bomb, then one could postulate that it would wish to reproduce? Yes? Therefore, I say a lone bomb would produce pheromones to attract other bombs, and so many bombs would "show up to the party" as it were, they would mate, and you would indeed have a great number of bombs.
One can suppose from this it is not only highly unlikely to have two bombs upon a plane, but it is also highly unlikely to have only one as well, and in fact there would be a great many bombs upon this great plane, yet I see none.
My end postulate is this: bombs are just a figment of your imagination, and if you continue to claim you see them, I will be required to assign you to the looney bin, post haste.