On-demand Inter-process Information Flow Tracking Yang Ji, Sangho - PowerPoint PPT Presentation

RAIN: Refinable Attack Investigation with On-demand Inter-process Information Flow Tracking Yang Ji, Sangho Lee, Evan Downing, Weiren Wang, Mattia Fazzini, Taesoo Kim, Alessandro Orso, and Wenke Lee ACM CCS 2017 Oct 31, 2017

More and more data breaches 2

More and more data breaches DATA BREACHES (SOURCE: BREACH LEVEL INDEX BY GEMALTO) Number of data breaches Number of breached records (mil) 3000 2500 2459 2000 1901 1594 1500 1155 1029 1000 924 918 853 819 815 721 665 658 558 500 513 428 427 316 0 2013-H12013-H22014-H12014-H22015-H12015-H22016-H12016-H22017-H1 2

Is attack investigation accurate? 3

Is attack investigation accurate? A B C 3

Is attack investigation accurate? read A B C 3

Is attack investigation accurate? read A read B C 3

Is attack investigation accurate? read A read B read C 3

Is attack investigation accurate? read A read “Hmm, I only want C !” B read C 3

Is attack investigation accurate? read A read send “Hmm, I only want C !” send B send read send C 3

Is attack investigation accurate? A, B, or C ? read A read send “Hmm, I only want C !” send B send read send C 3

Is attack investigation accurate? Dependency confusion! A, B, or C ? read A read send “Hmm, I only want C !” send B send read send C 3

File archive 4

File archive recv write 4

File archive recv write “Let me change the offer price.” 4

File archive recv write “Let me change the offer price.” 4

File archive write write recv write “Let me change read write the offer price.” 4

File archive ? Is this file affected ? write ? write recv write “Let me change read write the offer price.” ? 4

File archive ? Dependency confusion! Is this file affected ? write ? write recv write “Let me change read write the offer price.” ? 4

Related work Accuracy Runtime Analysis Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi Runtime Analysis Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi Runtime Analysis Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi • Dynamic Information Flow Tracking (DIFT) • Panorama, Dtracker Runtime Analysis Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi • Dynamic Information Flow Tracking (DIFT) • Panorama, Dtracker Runtime Analysis Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi • Dynamic Information Flow Tracking (DIFT) • Panorama, Dtracker • DIFT + Record replay Runtime Analysis • Arnold Efficiency Efficiency 4

Related work • System-call-based Accuracy • DTrace, Protracer, LSM, Hi-Fi • Dynamic Information Flow Tracking (DIFT) • Panorama, Dtracker • DIFT + Record replay Runtime Analysis • Arnold Efficiency Efficiency 4

RAIN Accuracy Analysis Runtime Efficiency Efficiency 5

RAIN • We use Accuracy • Record replay • Graph-based pruning • Selective DIFT Analysis Runtime Efficiency Efficiency 5

RAIN • We use Accuracy • Record replay • Graph-based pruning • Selective DIFT • We achieve • High accuracy • Runtime efficiency Analysis Runtime • Highly improved analysis efficiency Efficiency Efficiency RAIN 5

Threat model • Trusts the OS • RAIN tracks user-level attacks. • Tracks explicit channels • Side or covert channel is out of scope. • Records all attacks from their inception • Hardware trojans or OS backdoor is out of scope. 8

Architecture Analysis host Target host 9

Architecture Analysis host Target host RAIN Customized Kernel 9

Architecture Analysis host Target host Customized libc RAIN Customized Kernel 9

Architecture Analysis host Target host Customized Logs libc RAIN Customized Kernel 9

Architecture Analysis host Provenance Target host graph builder Customized Logs libc RAIN Customized Kernel Coarse-level graph 9

Architecture Analysis host Provenance Target host graph builder Triggering, Customized reachability Logs libc analysis RAIN Customized Kernel Coarse-level graph Pruned sub-graph Prune 9

Architecture Analysis host Provenance Target host graph builder Triggering, Customized reachability Logs libc analysis RAIN Replay and Customized selective DIFT Kernel Refined sub-graph Coarse-level graph Pruned sub-graph Refine Prune 9

OS-level record replay 1.Records external inputs 2.Captures the thread switching from the pthread interface, not the produced internal data 3.Records system-wide executions 10

OS-level record replay 1.Records external inputs Thread 1 2.Captures the thread switching from the pthread interface, not the produced internal data 3.Records system-wide executions 10

OS-level record replay 1.Records external inputs Thread 1 2.Captures the thread Socket External switching from the inputs pthread interface, not the produced internal data 3.Records system-wide executions 10

OS-level record replay 1.Records external inputs Thread 1 2.Captures the thread Socket External switching from the inputs pthread interface, not the produced internal data File 3.Records system-wide executions 10

OS-level record replay 1.Records external inputs Thread 1 2.Captures the thread Socket External switching from the inputs pthread interface, not the produced internal data File 3.Records system-wide executions Randomness 10

OS-level record replay Process group 1.Records external inputs Thread 1 2.Captures the thread Socket External switching from the inputs pthread interface, not the produced internal data File 3.Records system-wide executions Randomness 10

OS-level record replay Process group 1.Records external inputs Thread 2 Thread 1 2.Captures the thread Socket External switching from the inputs pthread interface, not the produced internal data File 3.Records system-wide executions Randomness 10

OS-level record replay Process group 1.Records external inputs Thread 2 Thread 1 2.Captures the thread Socket External IPC switching from the inputs pthread interface, not the Internal data produced internal data File 3.Records system-wide executions Thread switching Randomness (via Pthread) 10

OS-level record replay Process group 1.Records external inputs Thread 2 Thread 1 2.Captures the thread Socket External IPC switching from the inputs pthread interface, not the Internal data produced internal data File 3.Records system-wide executions Thread switching Randomness (via Pthread) 10

Coarse-level logging and graph building • Keeps logging system-call events • Constructs a graph to represent: A: Attacker site • the processes, files, and sockets as nodes B: /docs/report.doc • the events as causality edges C: /tmp/errors.zip P1: /usr/bin/firefox 11

Coarse-level logging and graph building • Keeps logging system-call events • Constructs a graph to represent: A: Attacker site • the processes, files, and sockets as nodes B: /docs/report.doc • the events as causality edges C: /tmp/errors.zip P1: /usr/bin/firefox P1 11

Coarse-level logging and graph building • Keeps logging system-call events • Constructs a graph to represent: A: Attacker site • the processes, files, and sockets as nodes B: /docs/report.doc • the events as causality edges C: /tmp/errors.zip B Read P1: /usr/bin/firefox P1 11

Coarse-level logging and graph building • Keeps logging system-call events • Constructs a graph to represent: A: Attacker site • the processes, files, and sockets as nodes B: /docs/report.doc • the events as causality edges C: /tmp/errors.zip B Read P1: /usr/bin/firefox P1 Read C 11

Coarse-level logging and graph building • Keeps logging system-call events • Constructs a graph to represent: A: Attacker site • the processes, files, and sockets as nodes B: /docs/report.doc • the events as causality edges C: /tmp/errors.zip B Read P1: /usr/bin/firefox P1 Send Read C A 11

• Does every recorded execution need replay and DIFT? 12

• Does every recorded execution need replay and DIFT? No! 12

Pruning • Does every recorded execution need replay and DIFT? No! • Prunes the data in the graph based on trigger analysis results • Upstream • Downstream • Point-to-point • Interference 12

A: Attacker site Upstream B: /docs/report.doc C: /tmp/errors.zip D: /docs/ctct1.csv E: /docs/ctct2.pdf F: /docs/loss.csv P1: /usr/bin/firefox P2: /usr/bin/TextEditor P3: /bin/gzip 13

A: Attacker site Upstream B: /docs/report.doc C: /tmp/errors.zip D: /docs/ctct1.csv E: /docs/ctct2.pdf F: /docs/loss.csv P1: /usr/bin/firefox P2: /usr/bin/TextEditor P3: /bin/gzip A 13