Sciweavers

Share
CCS
2009
ACM

Countering kernel rootkits with lightweight hook protection

9 years 10 months ago
Countering kernel rootkits with lightweight hook protection
Kernel rootkits have posed serious security threats due to their stealthy manner. To hide their presence and activities, many rootkits hijack control flows by modifying control data or hooks in the kernel space. A critical step towards eliminating rootkits is to protect such hooks from being hijacked. However, it remains a challenge because there exist a large number of widely-scattered kernel hooks and many of them could be dynamically allocated from kernel heap and co-located together with other kernel data. In addition, there is a lack of flexible commodity hardware support, leading to the socalled protection granularity gap – kernel hook protection requires byte-level granularity but commodity hardware only provides pagelevel protection. To address the above challenges, in this paper, we present HookSafe, a hypervisor-based lightweight system that can protect thousands of kernel hooks in a guest OS from being hijacked. One key observation behind our approach is that a kernel h...
Zhi Wang, Xuxian Jiang, Weidong Cui, Peng Ning
Added 19 May 2010
Updated 19 May 2010
Type Conference
Year 2009
Where CCS
Authors Zhi Wang, Xuxian Jiang, Weidong Cui, Peng Ning
Comments (0)
books