Multi-aspect profiling of kernel rootkit behavior

Abstract

Kernel rootkits, malicious software designed to compromise a running operating system kernel, are difficult to analyze and profile due to their elusive nature, the variety and complexity of their behavior, and the privilege level at which they run. However, a comprehensive kernel rootkit profile that reveals key aspects of the rootkit's behavior is helpful in aiding a detailed manual analysis by a human expert. In this paper we present PoKeR, a kernel rootkit profiler capable of producing multi-aspect rootkit profiles which include the revelation of rootkit hooking behavior, the exposure of targeted kernel objects (both static and dynamic), assessment of userlevel impacts, as well as the extraction of kernel rootkit code. The system is designed to be deployed in scenarios which can tolerate high overheads, such as honeypots. Our evaluation results with a number of real-world kernel rootkits show that PoKeR is able to accurately profile a variety of rootkits ranging from traditional ones with system call hooking to more advanced ones with direct kernel object manipulation. The obtained profiles lead to unique insights into the rootkits' characteristics and demonstrate PoKeR's usefulness as a tool for rootkit investigators.

Implementing rootkits to address operating system vulnerabilities

“…We propose that all future malware architectures should be based on the architecture presented in figure 2 below. This architecture is very similar to current ongoing research in [11] [13] [10] [38] that propose the use of hypervisors and virtualization techniques to deal with rootkits. Such an architecture would significantly reduce the chance that malware would be able to disable or compromise the antimalware program because the anti-malware program would be, at all times, executing at a higher privilege level than the malware.…”

“…Rootkits are designed to fundamentally subvert the OS kernel and are capable of obtaining and maintaining unrestricted control and access within the compromised system without even being detected by antimalware software [14]. Rootkits can also hide other malicious software or activities such as open network connections, running processes and files on disk [10][11] [12]. Long life time rootkits are most likely to attempt to hide [11].…”

Towards Automated Malware Behavioral Analysis and Profiling for Digital Forensic Investigation Purposes

“…invoked system calls and its arguments. Other methods, such as those proposed in [21,22] not only observe objects interactions, but also, profile the interaction patterns such as evolving pattern of a malicious object's data structure in dynamic kernel memory. Profiled patterns are further used to derive a malware detection signature.…”

Time-Traveling Forensic Analysis of VM-Based High-Interaction Honeypots

“…In our implementation, we further perform execution profiling of the identified malicious code. For example, in our experiments with kernel rootkits (Section 4.2), we leverage it and apply the combat tracking technique described in PoKeR [34] to profile rootkit execution within a given time window ([ST, EN]). In particular, for a subset of instructions identified thus, all memory reads and writes and their contents, are recorded in a log on the host OS.…”