Custos: Practical Tamper-Evident Auditing of Operating Systems - PowerPoint PPT Presentation

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, Dave Tian

Logs Are Useful 2 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs Are Useful • 75% of incident response specialists said logs are the most valuable artifact during an investigation. 1 1 Carbon Black Quarterly Incident Response Threat Report April 2019 3 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs Are Useful • 75% of incident response specialists said logs are the most valuable artifact during an investigation. 1 1 Carbon Black Quarterly Incident Response Threat Report April 2019 4 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

5 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

6 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 7 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access 2. Establish Foothold Logs about the compromise 3. Download Exploit are crucial for forensics! 4. Privilege Escalation 5. Log Tampering 8 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: If the attacker does not tamper with them, we can detect the attack. 1. Initial Access 2. Establish Foothold Logs about the compromise 3. Download Exploit are crucial for forensics! 4. Privilege Escalation 5. Log Tampering 9 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: If the attacker does not tamper with them, we can detect the attack. 1. Initial Access 2. Establish Foothold Logs about the compromise 3. Download Exploit are crucial for forensics! 4. Privilege Escalation If the attacker tampers 5. Log Tampering with them, we can’t detect the attack. 10 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 11 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation 5. Log Tampering 6. Lateral Movement 12 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation Central Server? 5. Log Tampering 6. Lateral Movement 13 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack Model Attack pattern: 1. Initial Access Logs 2. Establish Foothold 3. Download Exploit 4. Privilege Escalation Integrity proofs 5. Log Tampering 6. Lateral Movement 14 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Design Overview 15 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Design Overview 1) TAMPER-EVIDENT LOGGING 16 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Design Overview 1) TAMPER-EVIDENT 2) AUDITING LOGGING 17 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logger 18 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret key Logger ENCLAVE 19 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m i ) ENCLAVE 20 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m 1 ) m 1 ENCLAVE 21 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m 2 ) m 1 m 2 ENCLAVE 22 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m h ) m 1 m 2 … m h ENCLAVE 23 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m h ) m 1 m 2 … m h ENCLAVE 24 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ()*&+( , - || … || , + ||0)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m h ) m 1 Auditor m 2 … m h ENCLAVE 25 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

" = $%& '( (*+',( - . || … || - , ||1)) sk // secret key c // counter Logger H // current hash Logging: H .Update( m h ) m 1 Commitment: Auditor m 2 H .Update(c) … ! = Sig sk ( H ) m h H .Init() c ++ ENCLAVE 26 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditing 1) CENTRALIZED AUDITING 27 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditing 1) CENTRALIZED 2) DECENTRALIZED AUDITING AUDITING 28 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Decentralized Auditing Logger+Auditor Logger+Auditor Logger+Auditor Logger+Auditor 29 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z Logger v ENCLAVE pk v -> public key of v 30 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z audit challenge 1 Logger v ENCLAVE pk v -> public key of v 31 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ( (*+&,( - . || … || - , ||1)) Auditor z audit challenge 1 Logger v ENCLAVE pk v -> public key of v 32 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

! = #$% &' ( (*+&,( - . || … || - , ||1)) Auditor z audit challenge 1 logs and 3 2 Logger v ENCLAVE pk v -> public key of v 33 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

" = $%& '( ) (+,'-( . / || … || . - ||2)) Verification ( ! , m 1 , …, m h , c): Auditor z audit challenge 1 H = Hash ( m 1 || … || m h || c ) result = Ver pk_v ( ! , H ) logs and ! 2 Logger v ENCLAVE pk v -> public key of v 34 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Security Analysis 35 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Security Analysis sk // secret key Logger v c // counter H // current hash Logging: H .Update( m i ) ENCLAVE 36 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Security Analysis sk // secret key Logger v c // counter H // current hash Logging: H .Update( m h ) m 1 Attack pattern: m 2 1. Initial Access … 2. Establish Foothold m h 3. Download Exploit 4. Privilege Escalation ENCLAVE 37 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Security Analysis sk // secret key Logger v c // counter H // current hash Logging: H .Update( m h ) m 1 m’ 1 Attack pattern: m 2 m’ 2 1. Initial Access … … 2. Establish Foothold m h m’ k 3. Download Exploit 4. Privilege Escalation 5. Log tampering ENCLAVE 38 Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella