Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM
Recent rootkit-attack mitigation work neglected to address the integrity of the mitigation tool itself. Both detection and prevention arms of current rootkit-attack mitigation solutions can be given credit for the advancement of multiple methodologies for rootkit defense but if the defense system it...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Universiti Putra Malaysia
2013
|
| Online Access: | http://psasir.upm.edu.my/id/eprint/30621/1/Rootkit%20Guard%20%28RG%29%20-%20An%20Architecture%20for%20Rootkit%20Resistant%20File-System%20Implementation%20Based%20on%20TPM.pdf |
| _version_ | 1796971777943928832 |
|---|---|
| author | Yew, Teh Jia Samsudin, Khairulmizam Udzir, Nur Izura Hashim, Shaiful Jahari |
| author_facet | Yew, Teh Jia Samsudin, Khairulmizam Udzir, Nur Izura Hashim, Shaiful Jahari |
| author_sort | Yew, Teh Jia |
| collection | UPM |
| description | Recent rootkit-attack mitigation work neglected to address the integrity of the mitigation tool itself. Both detection and prevention arms of current rootkit-attack mitigation solutions can be given credit for the advancement of multiple methodologies for rootkit defense but if the defense system itself is compromised, how is the defense system to be trusted? Another deficiency not addressed is how platform integrity can be preserved without availability of current RIDS or RIPS solutions, which operate only upon the loading of the kernel i.e. without availability of a trusted boot environment. To address these deficiencies, we present our architecture for solving rootkit persistence – Rootkit Guard (RG). RG is a marriage between TrustedGRUB (providing trusted boot), IMA (Integrity Measurement Architecture) (serves as RIDS) and SELinux (serves as RIPS). TPM hardware is utilised to provide total integrity of our platform via storage of the aggregate of the clean snapshot of our platform OS kernel into TPM hardware registers (i.e. the PCR) – of which no software attacks have been demonstrated to date. RG solves rootkit persistence by leveraging on one vital but simple strategy: the mounting of rootkit defense via prevention of the execution of configuration binaries or build initialisation scripts. We adopted the technique of rootkit persistence prevention via thwarting the initialisation of a rootkit’s installation procedure; if the rootkit is successfully installed, proper deployment via thwarting of the rootkit’s configuration is prevented. We had subjected the RG to 8 real world Linux 2.6 rootkits and the RG was successful in solving rootkit persistence in all 8 evaluated rootkits. In terms of performance, the RG introduced a maximum of 11% overhead and an average of 4% overhead, hence permitting deployment in production environments. |
| first_indexed | 2024-03-06T08:18:07Z |
| format | Article |
| id | upm.eprints-30621 |
| institution | Universiti Putra Malaysia |
| language | English |
| last_indexed | 2024-03-06T08:18:07Z |
| publishDate | 2013 |
| publisher | Universiti Putra Malaysia |
| record_format | dspace |
| spelling | upm.eprints-306212015-09-18T01:32:17Z http://psasir.upm.edu.my/id/eprint/30621/ Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM Yew, Teh Jia Samsudin, Khairulmizam Udzir, Nur Izura Hashim, Shaiful Jahari Recent rootkit-attack mitigation work neglected to address the integrity of the mitigation tool itself. Both detection and prevention arms of current rootkit-attack mitigation solutions can be given credit for the advancement of multiple methodologies for rootkit defense but if the defense system itself is compromised, how is the defense system to be trusted? Another deficiency not addressed is how platform integrity can be preserved without availability of current RIDS or RIPS solutions, which operate only upon the loading of the kernel i.e. without availability of a trusted boot environment. To address these deficiencies, we present our architecture for solving rootkit persistence – Rootkit Guard (RG). RG is a marriage between TrustedGRUB (providing trusted boot), IMA (Integrity Measurement Architecture) (serves as RIDS) and SELinux (serves as RIPS). TPM hardware is utilised to provide total integrity of our platform via storage of the aggregate of the clean snapshot of our platform OS kernel into TPM hardware registers (i.e. the PCR) – of which no software attacks have been demonstrated to date. RG solves rootkit persistence by leveraging on one vital but simple strategy: the mounting of rootkit defense via prevention of the execution of configuration binaries or build initialisation scripts. We adopted the technique of rootkit persistence prevention via thwarting the initialisation of a rootkit’s installation procedure; if the rootkit is successfully installed, proper deployment via thwarting of the rootkit’s configuration is prevented. We had subjected the RG to 8 real world Linux 2.6 rootkits and the RG was successful in solving rootkit persistence in all 8 evaluated rootkits. In terms of performance, the RG introduced a maximum of 11% overhead and an average of 4% overhead, hence permitting deployment in production environments. Universiti Putra Malaysia 2013 Article PeerReviewed application/pdf en http://psasir.upm.edu.my/id/eprint/30621/1/Rootkit%20Guard%20%28RG%29%20-%20An%20Architecture%20for%20Rootkit%20Resistant%20File-System%20Implementation%20Based%20on%20TPM.pdf Yew, Teh Jia and Samsudin, Khairulmizam and Udzir, Nur Izura and Hashim, Shaiful Jahari (2013) Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM. Pertanika Journal of Science & Technology, 21 (2). pp. 507-520. ISSN 0128-7680; ESSN: 2231-8526 http://www.pertanika.upm.edu.my/Pertanika%20PAPERS/JST%20Vol.%2021%20%282%29%20Jul.%202013/17%20Page%20507-520.pdf |
| spellingShingle | Yew, Teh Jia Samsudin, Khairulmizam Udzir, Nur Izura Hashim, Shaiful Jahari Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title | Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title_full | Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title_fullStr | Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title_full_unstemmed | Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title_short | Rootkit Guard (RG) - an architecture for rootkit resistant file-system implementation based on TPM |
| title_sort | rootkit guard rg an architecture for rootkit resistant file system implementation based on tpm |
| url | http://psasir.upm.edu.my/id/eprint/30621/1/Rootkit%20Guard%20%28RG%29%20-%20An%20Architecture%20for%20Rootkit%20Resistant%20File-System%20Implementation%20Based%20on%20TPM.pdf |
| work_keys_str_mv | AT yewtehjia rootkitguardrganarchitectureforrootkitresistantfilesystemimplementationbasedontpm AT samsudinkhairulmizam rootkitguardrganarchitectureforrootkitresistantfilesystemimplementationbasedontpm AT udzirnurizura rootkitguardrganarchitectureforrootkitresistantfilesystemimplementationbasedontpm AT hashimshaifuljahari rootkitguardrganarchitectureforrootkitresistantfilesystemimplementationbasedontpm |