Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

Ronny Chevalier 1, 2 Maugan Villatel 2 David Plaquin 2 Guillaume Hiet 1
1 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
CentraleSupélec, Inria Rennes – Bretagne Atlantique , IRISA_D1 - SYSTÈMES LARGE ÉCHELLE
Abstract : Highly privileged software, such as firmware, is an attractive target for attackers. Thus, BIOS vendors use cryptographic signatures to ensure firmware integrity at boot time. Nevertheless, such protection does not prevent an attacker from exploiting vulnerabilities at runtime. To detect such attacks, we propose an event-based behavior monitoring approach that relies on an isolated co-processor. We instrument the code executed on the main CPU to send information about its behavior to the monitor. This information helps to resolve the semantic gap issue. Our approach does not depend on a specific model of the behavior nor on a specific target. We apply this approach to detect attacks targeting the System Management Mode (SMM), a highly privileged x86 execution mode executing firmware code at runtime. We model the behavior of SMM using invariants of its control-flow and relevant CPU registers (CR3 and SMBASE). We instrument two open-source firmware implementations: EDK II and coreboot. We evaluate the ability of our approach to detect state-of-the-art attacks and its runtime execution overhead by simulating an x86 system coupled with an ARM Cortex A5 co-processor. The results show that our solution detects intrusions from the state of the art, without any false positives, while remaining acceptable in terms of performance overhead in the context of the SMM (i.e., less than the 150 µs threshold defined by Intel).
Type de document :
Communication dans un congrès
Proceedings of the 33rd Annual Computer Security Applications Conference, Dec 2017, Orlando, United States. 2017, pp.13, 2017, 〈https://www.acsac.org/〉. 〈10.1145/3134600.3134622〉
Liste complète des métadonnées

Littérature citée [84 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01634566
Contributeur : Ronny Chevalier <>
Soumis le : mercredi 6 décembre 2017 - 15:40:19
Dernière modification le : lundi 11 décembre 2017 - 09:04:48

Fichiers

Identifiants

Citation

Ronny Chevalier, Maugan Villatel, David Plaquin, Guillaume Hiet. Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode. Proceedings of the 33rd Annual Computer Security Applications Conference, Dec 2017, Orlando, United States. 2017, pp.13, 2017, 〈https://www.acsac.org/〉. 〈10.1145/3134600.3134622〉. 〈hal-01634566〉

Partager

Métriques

Consultations de la notice

227

Téléchargements de fichiers

7