Operating system interface obfuscation and the revealing of hidden operations

摘要: Many software security solutions--including malware analyzers, information flow tracking systems, auditing utilities, and host-based intrusion detectors--rely on knowledge of standard system call interfaces to reason about process execution behavior. In this work, we show how a rootkit can obfuscate commodity kernel's degrade the effectiveness these tools. Our attack, called Illusion, allows user-level invoke privileged kernel operations without requiring actual calls corresponding operations. The Illusion interface hides from user-, kernel-, hypervisor-level monitors mediating conventional system-call interface. alters neither static code nor read-only dispatch tables, remaining elusive tools protecting memory. We then consider problem attacks augment data with kernel-level expose hidden present Xen-based monitoring system, Sherlock, that adds watchpoints stream calls. Sherlock automatically adapts its sensitivity based requirements remain performant desktop systems: in normal execution, it 1% 10% overhead variety workloads.