.png){kind=icon}
Return
Toward a general defense against kernel queue hooking attacks
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2011.12.007.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Kernel queue hooking (KQH) attacks achieve stealthy malicious function execution by embedding malicious hooks in dynamic kernel schedulable queues (K-Queues). Because they keep kernel code and persistent hooks intact, they can evade detection of state-of-the-art kernel integrity monitors. Moreover, they have been used by advanced malware such as the Rustock spam bot to achieve malicious goals. In this paper, we present a systematic defense against such novel attacks. We propose the Precise Lookahead Checking of function Pointers approach that checks the legitimacy of pending K-Queue callback requests by proactively checking function pointers that may be invoked by the callback function. To facilitate the derivation of specifications for any K-Queue, we build a unified static analysis framework and a toolset that can derive from kernel source code properties of legitimate K-Queue requests and turn them into source code for the runtime checker. We implement proof-of-concept runtime checkers for four K-Queues in Linux and perform a comprehensive experimental evaluation of these checkers, which shows that our defense is effective against KQH attacks. (c) 2011 Published by Elsevier Ltd.
Keywords:
Control flow integrity
Kernel queue hooking
Rootkits
Runtime defense
Static analysis
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
ShareSaveShareSaveIn vitro evaluation of the cellular effect of indium tin oxide nanoparticles using the human lung adenocarcinoma A549 cells.png)
Metallomics
OAAI
MetallomicsIF0
OAAIShareSaveShareSave
View more