The Experts below are selected from a list of 66201 Experts worldwide ranked by ideXlab platform
Cliff C Zou - One of the best experts on this subject based on the ideXlab platform.
-
smm rootkit a new breed of os independent malware
Security and Communication Networks, 2013Co-Authors: Shawn Embleton, Sherri Sparks, Cliff C ZouAbstract:The emergence of hardware virtualization technology has led to the development of OS independent malware such as the virtual machine-based rootkits (VMBRs). In this paper, we draw attention to a different but related threat that exists on many commodity Systems in operation today: The System management Mode based rootkit (SMBR). System Management mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control. It has its own private memory space and execution environment which is generally invisible to code running outside (e.g., the Operating System). Furthermore, SMM code is completely non-preemptible, lacks any concept of privilege level, and is immune to memory protection mechanisms. These features make it a potentially attractive home for stealthy rootkits used for high-profile targeted attacks. In this paper, we present our development of a proof of concept SMM rootkit. In it, we explore the potential of System management mode for malicious use by implementing a chipset level keylogger and a network backdoor capable of directly interacting with the network card to send logged keystrokes to a remote machine via UDP and receive remote command packets stealthily. By modifying and reflashing the BIOS, the SMM rootkit can install itself on a computer even if the computer has originally locked its SMM. The rootkit hides its memory footprint and requires no changes to the Existing Operating System. It is compared and contrasted with VMBRs. Finally, techniques to defend against these threats are explored. By taking an offensive perspective we hope to help security researchers better understand the depth and scope of the problems posed by an emerging class of OS independent malware. Copyright © 2009 John Wiley & Sons, Ltd.
-
smm rootkits a new breed of os independent malware
International Workshop on Security, 2008Co-Authors: Shawn Embleton, Sherri Sparks, Cliff C ZouAbstract:The emergence of hardware virtualization technology has led to the development of OS independent malware such as the Virtual Machine based rootkits (VMBRs). In this paper, we draw attention to a different but related threat that exists on many commodity Systems in operation today: The System Management Mode based rootkit (SMBR). System Management Mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control. It has its own private memory space and execution environment which is generally invisible to code running outside (e.g., the Operating System). Furthermore, SMM code is completely non-preemptible, lacks any concept of privilege level, and is immune to memory protection mechanisms. These features make it a potentially attractive home for stealthy rootkits. In this paper, we present our development of a proof of concept SMM rootkit. In it, we explore the potential of System Management Mode for malicious use by implementing a chipset level keylogger and a network backdoor capable of directly interacting with the network card to send logged keystrokes to a remote machine via UDP. The rootkit hides its memory footprint and requires no changes to the Existing Operating System. It is compared and contrasted with VMBRs. Finally, techniques to defend against these threats are explored. By taking an offensive perspective we hope to help security researchers better understand the depth and scope of the problems posed by an emerging class of OS independent malware.
Mendel Rosenblum - One of the best experts on this subject based on the ideXlab platform.
-
cellular disco resource management using virtual clusters on shared memory multiprocessors
ACM Transactions on Computer Systems, 2000Co-Authors: Kinshuk Govil, Dan Teodosiu, Yongqiang Huang, Mendel RosenblumAbstract:Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, System software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the Operating System. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that laverages the Existing Operating System technology. In this paper we present a System called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable Operating System approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the Operating System. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding Operating System scalability bottlenecks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment. In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 System. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial Operating System formost workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.
-
cellular disco resource management using virtual clusters on shared memory multiprocessors
Symposium on Operating Systems Principles, 1999Co-Authors: Kinshuk Govil, Dan Teodosiu, Yongqiang Huang, Mendel RosenblumAbstract:Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, System software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the Operating System. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that leverages the Existing Operating System technology.In this paper we present a System called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable Operating System approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the Operating System. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding Operating System scalability bottle-necks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment.In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 System. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial Operating System for most workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.
Shawn Embleton - One of the best experts on this subject based on the ideXlab platform.
-
smm rootkit a new breed of os independent malware
Security and Communication Networks, 2013Co-Authors: Shawn Embleton, Sherri Sparks, Cliff C ZouAbstract:The emergence of hardware virtualization technology has led to the development of OS independent malware such as the virtual machine-based rootkits (VMBRs). In this paper, we draw attention to a different but related threat that exists on many commodity Systems in operation today: The System management Mode based rootkit (SMBR). System Management mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control. It has its own private memory space and execution environment which is generally invisible to code running outside (e.g., the Operating System). Furthermore, SMM code is completely non-preemptible, lacks any concept of privilege level, and is immune to memory protection mechanisms. These features make it a potentially attractive home for stealthy rootkits used for high-profile targeted attacks. In this paper, we present our development of a proof of concept SMM rootkit. In it, we explore the potential of System management mode for malicious use by implementing a chipset level keylogger and a network backdoor capable of directly interacting with the network card to send logged keystrokes to a remote machine via UDP and receive remote command packets stealthily. By modifying and reflashing the BIOS, the SMM rootkit can install itself on a computer even if the computer has originally locked its SMM. The rootkit hides its memory footprint and requires no changes to the Existing Operating System. It is compared and contrasted with VMBRs. Finally, techniques to defend against these threats are explored. By taking an offensive perspective we hope to help security researchers better understand the depth and scope of the problems posed by an emerging class of OS independent malware. Copyright © 2009 John Wiley & Sons, Ltd.
-
smm rootkits a new breed of os independent malware
International Workshop on Security, 2008Co-Authors: Shawn Embleton, Sherri Sparks, Cliff C ZouAbstract:The emergence of hardware virtualization technology has led to the development of OS independent malware such as the Virtual Machine based rootkits (VMBRs). In this paper, we draw attention to a different but related threat that exists on many commodity Systems in operation today: The System Management Mode based rootkit (SMBR). System Management Mode (SMM) is a relatively obscure mode on Intel processors used for low-level hardware control. It has its own private memory space and execution environment which is generally invisible to code running outside (e.g., the Operating System). Furthermore, SMM code is completely non-preemptible, lacks any concept of privilege level, and is immune to memory protection mechanisms. These features make it a potentially attractive home for stealthy rootkits. In this paper, we present our development of a proof of concept SMM rootkit. In it, we explore the potential of System Management Mode for malicious use by implementing a chipset level keylogger and a network backdoor capable of directly interacting with the network card to send logged keystrokes to a remote machine via UDP. The rootkit hides its memory footprint and requires no changes to the Existing Operating System. It is compared and contrasted with VMBRs. Finally, techniques to defend against these threats are explored. By taking an offensive perspective we hope to help security researchers better understand the depth and scope of the problems posed by an emerging class of OS independent malware.
Peter M Chen - One of the best experts on this subject based on the ideXlab platform.
-
subvirt implementing malware with virtual machines
IEEE Symposium on Security and Privacy, 2006Co-Authors: Samuel T. King, Peter M ChenAbstract:Attackers and defenders of computer Systems both strive to gain complete control over the System. To maximize their control, both attackers and defenders have migrated to low-level, Operating System code. In this paper, we assume the perspective of the attacker, who is trying to run malicious software and avoid detection. By assuming this perspective, we hope to help defenders understand and defend against the threat posed by a new class of rootkits. We evaluate a new type of malicious software that gains qualitatively more control over a System. This new type of malware, which we call a virtual-machine based rootkit (VMBR), installs a virtual-machine monitor underneath an Existing Operating System and hoists the original Operating System into a virtual machine. Virtual-machine based rootkits are hard to detect and remove because their state cannot be accessed by software running in the target System. Further, VMBRs support general-purpose malicious services by allowing such services to run in a separate Operating System that is protected from the target System. We evaluate this new threat by implementing two proof-of-concept VMBRs. We use our proof-of-concept VMBRs to subvert Windows XP and Linux target Systems, and we implement four example malicious services using the VMBR platform. Last, we use what we learn from our proof-of-concept VMBRs to explore ways to defend against this new threat. We discuss possible ways to detect and prevent VMBRs, and we implement a defense strategy suitable for protecting Systems against this threat.
-
Operating System support for virtual machines
USENIX Annual Technical Conference, 2003Co-Authors: Samuel T. King, George W Dunlap, Peter M ChenAbstract:A virtual-machine monitor (VMM) is a useful technique for adding functionality below Existing Operating System and application software. One class of VMMs (called Type II VMMs) builds on the abstractions provided by a host Operating System. Type II VMMs are elegant and convenient, but their performance is currently an order of magnitude slower than that achieved when running outside a virtual machine (a standalone System). In this paper, we examine the reasons for this large overhead for Type II VMMs. We find that a few simple extensions to a host Operating System can make it a much faster platform for running a VMM. Taking advantage of these extensions reduces virtualization overhead for a Type II VMM to 14-35% overhead, even for workloads that exercise the virtual machine intensively.
Kinshuk Govil - One of the best experts on this subject based on the ideXlab platform.
-
cellular disco resource management using virtual clusters on shared memory multiprocessors
ACM Transactions on Computer Systems, 2000Co-Authors: Kinshuk Govil, Dan Teodosiu, Yongqiang Huang, Mendel RosenblumAbstract:Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, System software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the Operating System. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that laverages the Existing Operating System technology. In this paper we present a System called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable Operating System approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the Operating System. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding Operating System scalability bottlenecks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment. In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 System. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial Operating System formost workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.
-
cellular disco resource management using virtual clusters on shared memory multiprocessors
Symposium on Operating Systems Principles, 1999Co-Authors: Kinshuk Govil, Dan Teodosiu, Yongqiang Huang, Mendel RosenblumAbstract:Despite the fact that large-scale shared-memory multiprocessors have been commercially available for several years, System software that fully utilizes all their features is still not available, mostly due to the complexity and cost of making the required changes to the Operating System. A recently proposed approach, called Disco, substantially reduces this development cost by using a virtual machine monitor that leverages the Existing Operating System technology.In this paper we present a System called Cellular Disco that extends the Disco work to provide all the advantages of the hardware partitioning and scalable Operating System approaches. We argue that Cellular Disco can achieve these benefits at only a small fraction of the development cost of modifying the Operating System. Cellular Disco effectively turns a large-scale shared-memory multiprocessor into a virtual cluster that supports fault containment and heterogeneity, while avoiding Operating System scalability bottle-necks. Yet at the same time, Cellular Disco preserves the benefits of a shared-memory multiprocessor by implementing dynamic, fine-grained resource sharing, and by allowing users to overcommit resources such as processors and memory. This hybrid approach requires a scalable resource manager that makes local decisions with limited information while still providing good global performance and fault containment.In this paper we describe our experience with a Cellular Disco prototype on a 32-processor SGI Origin 2000 System. We show that the execution time penalty for this approach is low, typically within 10% of the best available commercial Operating System for most workloads, and that it can manage the CPU and memory resources of the machine significantly better than the hardware partitioning approach.