|
surements itself is reasonably small —about 1000 measurements on
<br />a typical Linux system [23], which results in the transfer of about
<br />20KB-30KB data between the phone and the attestor —frequent ex-
<br />ecutions of the protocol (e.g., to ensure continuous integrity mea-
<br />surement) may consume both network bandwidth and battery power.
<br />To be applicable to smart phones, integrity measurement protocols
<br />mast therefore be adapted to be resource efficient.
<br />-based Rootkit Detection
<br />Virtualization offers an alternative approach to implement rootkit
<br />detection. In this approach, the smart phone's operating system
<br />and the monitor execute in separate virtual machines (VM). The
<br />monitor queries the VM that runs the phone s operating system and
<br />extracts the contents of its memory locations to perform rootkit de-
<br />tection [15]. A number of commercial efforts are currently under-
<br />way to build virtual machine monitors for smart phones [4, 8, 16],
<br />with the goal of allowing users to have multiple personalities on a
<br />single physical device. For example, the same phone can be used
<br />with multiple accounts and providers, such as a corporate account
<br />and a personal account. Cox and Chen [13] also provide examples
<br />of several other novel applications that can be enabled by deploying
<br />virtualization on smart phones.
<br />Rootkit detection tools can possibly leverage these virtual ma-
<br />chine monitors to isolate themselves from the smart phone's operat-
<br />ing system. However, most existing rootkit detection tools [10, 11,
<br />18, 21] operate by periodically fetching and scanning kernel mem-
<br />ory snapshots of the operating system being monitored. Such al-
<br />gorithms are CPU intensive and can potentially dram the battery of
<br />the phone. For example, the Gibraltar rootkit detection system [10]
<br />can detect sophisticated rootkits that operate by modifying arbi-
<br />trary kernel data structures. However, it operates by periodically
<br />fetching memory pages from the monitored system, reconstructing
<br />data structures, and checking these data structures against integrity
<br />specifications, each of which is a CPU -intensive operation. Gibral-
<br />tar can potentially be optimized for use on a smart phone by re-
<br />ducing the frequency at which it scans kernel memory for rootkits,
<br />e.g., by enabling rootkit detection only when the phone is being
<br />charged. However, domg so introduces a tradeoff between security
<br />and energy -efficiency. One way to address this tradeoff would be to
<br />adapt Gibraltar to selectively fetch memory pages to be analyzed,
<br />e.g. only pages that were recently modified. To develop a VMM-
<br />based rootkit detector, a smart phone will need to support the in-
<br />stallation of a VMM. Currently, there is no platform that supports
<br />this Further research is therefore needed to make rootkit detection
<br />more -efficient and practical for use on.virtualized smart phones.
<br />5. S ARY
<br />Rootkits evade detection by compromising the operating system,
<br />thereby allowing them to defeat user -space detection tools and op-
<br />erate stealthily for extended periods of time. This paper demon-
<br />strated that kernel -level rootkits can exploit smart phone operating
<br />systems often with serious social consequences. The popularity
<br />of the mobile platform has already attracted attackers, who have
<br />increasingly begun to develop and deploy viruses and worms that
<br />target these platforms. As these threats gain notoriety, so will the
<br />power of tools to detect these threats. We believe that this trend,
<br />combined with the increasing complexity of operating systems on
<br />modern smart phones, will push attackers to employing rootkits to
<br />achieve their malicious goals. Currently, there is no available tech-
<br />nique to detect rootkits on smart phones. We therefore conclude
<br />with a call for research on tools and techniques to effectively and
<br />efficiently detect rootkits on smart phones.
<br />References
<br />[1]
<br />F-secure warns of mobile malware growth. www . vnunet . com/
<br />vnunet/news/2230481/f-secure-launches-mobile.
<br />Google fixes android root -access flaw. www . z dnet a s i a . com/
<br />news/security/O,39044215,62048148,00.htm
<br />Meafee mobile security report 2008. www.mcafee.com/us/
<br />research/mobil e_security report._2008.html.
<br />OKL4 embedded hypervisor: Open kernel labs. www . ok—labs .
<br />com/.
<br />Openmoko Neo FreeRunner. wiki . openmoko . org/wiki /
<br />Neo_FreeRunner.
<br />Qtopia software stack (Qtextended.org). qtopia . n
<br />Smartphones will soon turn computing on its head.
<br />com/8301-13579_3-9906697-37.html.
<br />VMware mobile virtualization platform www .
<br />technology/mobile/.
<br />Rootkits, part 1 of 3: A growing threat, April 2006. MacAfee AVERT
<br />Labs Whitepaper
<br />A. Baliga, V Ganapathy, and L. Iftode. Automatic inference and en-
<br />forcement of kernel data structure invariants. In Pmc. Annual Com-
<br />puter Security and Applications Conference, 2008.
<br />A. Baliga, L. Iftode, and X. Chen. Automated containment of rootkit
<br />attacks. Computers & Security, 27(7-8):323 — 334, 2008.
<br />[12] A Baliga, P. Kamat, and L. Iftode. Lurking in the shadows: Identi-
<br />fying systemic threats to kernel data. In Proc. 2007 IEEE Symposium
<br />on Secunty and Privacy, 2007
<br />[13] L. Cox and P. M. Chen Pocket hypervisors: Challenges and opportu-
<br />nities. In Pmc HotMobile, 2007.
<br />[14] W Enck, P. Traynor, P. Mcdaniel, and T. La Porta. Exploiting open
<br />functionality in sms-capable cellular networks. In Pmc. ACM Confer-
<br />ence on Computer and Communication Security, 2005.
<br />[15] T. Garfinkel and M. Rosenblum. A virtual machine introspection
<br />based architecture for intrusion detection. In Proc. Network and Dis-
<br />tributed Systems Security Symposium, 2003.
<br />[16] J. Hwang, S. Suh, S. Heo, C. Park, J. Ryu, S Park, and C. Kim. Xen
<br />on ARM: System virtualization using Xen hypervisor for ARM -based
<br />secure mobile phones. In IEEE CCNC, 2008.
<br />[17] M. Hypponen. The state of cell phone malware in 2007. www .
<br />usenix.org/events/sec07/tech/hypponen.pdf
<br />[18] N. L. Petroni Jr., T. Fraser, J. Molina, and W. A. Arbaugh. Copilot - a
<br />coprocessor -based kernel runtime integrity monitor In Proc. USENIX
<br />Security Symposium, 2004.
<br />[19] AiAA Martin. FireWire memory dump of a Windows XP com-
<br />puter: A forensic approach, 2007. whit epapers . zdnet . com/
<br />abstract .aspx?docid=38780.
<br />[20] Bank of America Mobile Banking. One millionth mobile banker logs
<br />on to Bank of America. tinyurl . com/yb72f4e.
<br />[21] N. L. Petroni and M. Hicks. Automated detection of persistent ker-
<br />nel control -flow attacks. In Proc. ACM Conference on Computer and
<br />Communications Security, 2007.
<br />[22] R. Racic, D. Ma, , and H. Chen. Exploiting MMS Vulnerabilities to
<br />Stealthily Exhaust Mobile Phone's Battery. In Proc. 2nd International
<br />Conference on Security and Privacy in Communication Networks, Au-
<br />gust 2006.
<br />[23] R. Sailer, X. Zhang, T. Jaeger, and L. van Doom. Design and imple-
<br />mentation of a tcg-based integrity measurement architecture. In Proc.
<br />UJSENIX Security Symposium, August 2004.
<br />TCG. Trusted computing group: Mobile trusted computing
<br />platform. https://www.trustedcomputinggroup.org/
<br />groups/mobile.
<br />G. Xu, C. Borcea, and L. Mode. Satem: Trusted service code across
<br />transactions In 25th Symposium on Reliable Distributed Systems, Oct
<br />2006.
<br />[26] X Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer. Secure
<br />coprocessor -based intrusion detection. In Proc. 10th workshop on
<br />ACM SIGOPS European workshop: beyond the PC, 2002.
<br />All URLs were last verified on January 10, 2010.
<br />[2]
<br />[3]
<br />[4]
<br />[5]
<br />[6]
<br />[7]
<br />[24]
<br />[25]
<br />et.
<br />news .cnet.
<br />vmware.com/
<br />6
<br />
|