KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels

02/20/2018
by   Zhi Zhang, et al.
0

Commodity OS kernels have broad attack surfaces due to the large code base and the numerous features such as device drivers. For a real-world use case (e.g., an Apache Server), many kernel services are unused and only a small amount of kernel code is used. Within the used code, a certain part is invoked only at runtime while the rest are executed at startup and/or shutdown phases in the kernel's lifetime run. In this paper, we propose a reliable and practical system, named KASR, which transparently reduces attack surfaces of commodity OS kernels at runtime without requiring their source code. The KASR system, residing in a trusted hypervisor, achieves the attack surface reduction through a two-step approach: (1) reliably depriving unused code of executable permissions, and (2) transparently segmenting used code and selectively activating them. We implement a prototype of KASR on Xen-4.8.2 hypervisor and evaluate its security effectiveness on Linux kernel-4.4.0-87-generic. Our evaluation shows that KASR reduces the kernel attack surface by 64 off 40 all 6 real-world kernel rootkits. We measure its performance overhead with three benchmark tools (i.e., SPECINT, httperf and bonnie++). The experimental results indicate that KASR imposes less than 1 to an unmodified Xen hypervisor) on all the benchmarks.

READ FULL TEXT
research
02/20/2018

A Reliable and Practical Approach to Kernel Attack Surface Reduction of Commodity OS

Commodity OS kernels are known to have broad attack surfaces due to the ...
research
03/16/2019

MultiK: A Framework for Orchestrating Multiple Specialized Kernels

We present, MultiK, a Linux-based framework 1 that reduces the attack su...
research
01/24/2022

DuVisor: a User-level Hypervisor Through Delegated Virtualization

Today's mainstream virtualization systems comprise of two cooperative co...
research
10/18/2019

A Benchmark Set of Highly-efficient CUDA and OpenCL Kernels and its Dynamic Autotuning with Kernel Tuning Toolkit

Autotuning of performance-relevant source-code parameters allows to auto...
research
08/20/2019

MicroTEE: Designing TEE OS Based on the Microkernel Architecture

ARM TrustZone technology is widely used to provide Trusted Execution Env...
research
10/18/2021

On-the-fly Code Activation for Attack Surface Reduction

Modern code reuse attacks are taking full advantage of bloated software....
research
06/24/2023

HODOR: Shrinking Attack Surface on Node.js via System Call Limitation

Node.js provides Node.js applications with system interaction capabiliti...

Please sign up or login with your details

Forgot password? Click here to reset