Backtracking Intrusions Sam King Peter Chen CoVirt Project,

Backtracking Intrusions Sam King Peter Chen CoVirt Project, University of Michigan Motivation Computer break-ins increasing Computer forensics is important How did they get in

Current Forensic Methods Manual inspection of existing logs System, application logs Not enough information Network log May be encrypted Disk image

Only shows final state Machine level logs No semantic information No way to separate out legitimate actions BackTracker Can we help figure out what was exploited?

Track back to exploited application Record causal dependencies between objects Process File Socket Detection point Fork event Read/write event

Presentation Outline BackTracker design Evaluation Limitations Conclusions BackTracker intrusion occurs

intrusion detected BackTracker runs, shows source of intrusion Online component, log objects and events Offline component to generate graphs

BackTracker Objects Process File Filename Dependency-Forming Events Process / Process fork, clone, vfork

Process / File read, write, mmap, exec Process / Filename open, creat, link, unlink, mkdir, rmdir, stat, chmod, Prioritizing Dependency Graphs

Hide read-only files Eliminate helper processes Filter lowcontrol events proc /bin/bash bash

backdoor /lib/libc Prioritizing Dependency Graphs Hide read-only files Eliminate helper processes

Filter lowcontrol events proc id bash pipe backdoor Prioritizing Dependency

Graphs Hide read-only files Eliminate helper processes Filter lowcontrol events proc login_a

utmp bash backdoor login_b Filtering Low-Control Events

proc login utmp bash backdoor Filtering Low-Control

Events proc login sshd utmp bash

bash backdoor Process File Socket Detection point Fork event Read/write event

Implementation Prototype built on Linux 2.4.18 Both stand-alone and virtual machine Hook system call handler

Inspect state of OS directly Guest Apps Guest OS VMM EventLogger Host OS Host Apps Host OS EventLogger

Virtual Machine Implementation Stand-Alone Implementation Evaluation Determine effectiveness of Backtracker Set up Honeypot virtual machine Intrusion detection using standard tools Attacks evaluated with six default filtering rules

Process File Socket Detection point Fork event Read/write event Process File

Socket Detection point Fork event Read/write event BackTracker Limitations Layer-below attack Use low control events or filtered objects to carry out attack Hidden channels

Create large dependency graph Perform a large number of steps Implicate innocent processes Future Work Department system administrators currently evaluating BackTracker Use different methods of dependency tracking Forward tracking

Conclusions Tracking causality through system calls can backtrack intrusions Dependency tracking Reduce events and objects by 100x Still effective even when same application exploited many times Filtering

Further reduce events and objects