Backtracking Intrusions SOSP 03 Sam King and Peter

Backtracking Intrusions, SOSP '03, Sam King and Peter Chen, UMich Present by JW

Motivation • Computer break-ins increasing • Computer forensics is important – How did they get in

Current Forensic Methods • Manual inspection of existing logs • System, application logs – Not enough information • Network log – May be encrypted • Disk image – Only shows final state • Machine level logs – No semantic information • No way to separate out legitimate actions

Back. Tracker • Can we help figure out what was exploited? • Track back to exploited application • Record causal dependencies between objects

Process File Socket Detection point Fork event Read/write event

Back. Tracker intrusion occurs intrusion detected Back. Tracker runs, shows source of intrusion • Online component, log objects and events • Offline component to generate graphs

Back. Tracker Objects • Process • Filename

Dependency-Forming Events • Process / Process – fork, clone, vfork • Process / File – read, write, mmap, exec • Process / Filename – open, creat, link, unlink, mkdir, rmdir, stat, chmod, …

Constructing Dependency Graph Raw log Complete graph Graph by Graph. Gen

Graph could be still VERY large!

Prioritizing Dependency Graphs • Hide read-only files • Eliminate helper processes • Filter “low-control” events proc /bin/bash backdoor /libc

Prioritizing Dependency Graphs • Hide read-only files • Eliminate helper processes • Filter “low-control” events proc id bash pipe backdoor

Prioritizing Dependency Graphs • Hide read-only files • Eliminate helper processes • Filter “low-control” events proc login_a utmp bash backdoor login_b

Process File Socket Detection point Fork event Read/write event

Implementation • • Prototype built on Linux 2. 4. 18 Both stand-alone and virtual machine Hook system call handler Inspect state of OS directly Guest Apps Guest OS VMM Event. Logger Host OS Virtual Machine Implementation Host Apps Host OS Event. Logger Stand-Alone Implementation

Evaluation • Determine effectiveness of Backtracker • Set up Honeypot virtual machine • Intrusion detection using standard tools – Trip. Wire, Ethereal, Snort • Attacks evaluated with six default filtering rules

Evaluation

Back. Tracker Limitations • Layer-below attack (e. g. VMM) • Use “low control” events or filtered objects to carry out attack • Hidden channels – e. g. steal password and log in next time • Create large dependency graph – Perform a large number of steps – Implicate innocent processes • Single host without network dependency • 1. 2 GB/day/host is too large

Process File Socket Detection point Fork event Read/write event

Process File Socket Detection point Fork event Read/write event

Back. Tracker Limitations • Layer-below attack (e. g. VMM) • Use “low control” events or filtered objects to carry out attack • Hidden channels – e. g. steal password and log in next time • Create large dependency graph – Perform a large number of steps – Implicate innocent processes • Single host without network dependency • 1. 2 GB/day/host is too large

Cross-host multi-hop attacks C A ssh log in Attacker download/replace exes modify some files ls B D Backtracker user detection point /etc/passwd • Backward causal graphs can be used to find which host allowed a multi-hop attack (such as a worm) to enter a local network • Forward causal graphs can be used to find the other hosts that were affected by the multi-hop attack

Enriching intrusion alerts through multihost causality, NDSS’ 05

Back. Tracker Limitations • Layer-below attack (e. g. VMM) • Use “low control” events or filtered objects to carry out attack • Hidden channels – e. g. steal password and log in next time • Create large dependency graph – Perform a large number of steps – Implicate innocent processes • Single host without network dependency • 1. 2 GB/day/host is too large

Dependency explosion

BEEP: High Accuracy Attack Provenance via Binary-based Execution Partition, NDSS’ 13 Insight • The execution of a wide range of applications (both serverside and client-side) is dominated by a small number of loops (with large number of iterations for each loop). • Each iteration of such a loop can be considered a semantically autonomous unit as it often operates on an independent input object. Technique • Reverse engineer such loops from application binaries. • Reverse engineer instructions that could cause workflow between units. • Perform selective logging for unit boundaries and unit dependences (memory dependence).

An example

References • S. T. King and P. M. Chen. Backtracking intrusions. In SOSP 2003. • King, Samuel T. , Zhuoqing Morley Mao, Dominic G. Lucchetti, and Peter M. Chen. "Enriching Intrusion Alerts Through Multi-Host Causality. " In NDSS. 2005. • Lee, Kyu Hyung, Xiangyu Zhang, and Dongyan Xu. "High Accuracy Attack Provenance via Binarybased Execution Partition. " In NDSS 2013.