Sciweavers

Share
IACR
2016

Process Table Covert Channels: Exploitation and Countermeasures

5 years 6 months ago
Process Table Covert Channels: Exploitation and Countermeasures
How to securely run untrusted software? A typical answer is to try to isolate the actual effects this software might have. Such counter-measures can take the form of memory segmentation, sandboxing or virtualisation. Besides controlling potential damage this software might do, such methods try to prevent programs from peering into other running programs’ operation and memory. As programs, no matter how many layers of indirection in place, are really being run, they consume resources. Should this resource usage be precisely monitored, malicious programs might be able to communicate in spite of software protections. We demonstrate the existence of such a covert channel bypassing isolations techniques and IPC policies. This covert channel that works over all major consumer OSes (Windows, Linux, MacOS) and relies on exploitation of the process table. We measure the bandwidth of this channel and suggest countermeasures.
Jean-Michel Cioranesco, Houda Ferradi, Rémi
Added 03 Apr 2016
Updated 03 Apr 2016
Type Journal
Year 2016
Where IACR
Authors Jean-Michel Cioranesco, Houda Ferradi, Rémi Géraud, David Naccache
Comments (0)
books