Hiding Kernel Level Rootkits Using Buffer Overflow and Return Oriented Programming

摘要

Kernel Level Rootkits are malwares that can be installed and hidden on a user's computer without revealing their existence. The goal of all rootkits is to carry out malicious execution while being hidden as long as possible on the user's system. We have developed and demonstrated, such a hiding technique for kernel level rootkits from static detection mechanisms. The hiding mechanism uses Return Oriented Programming, which allows the user to execute malicious code in the presence of certain inbuilt security defenses and detection tools. In this technique, an attacker diverts the control flow without injecting any new code in the program overflowing the buffer. We chain together short instruction sequences already present in a program's address space, each of which ends in a "return" instruction. This implemented hiding technique was tested using a custom detection tool which performs static analysis, for specified malicious behavior patterns along with other techniques. We have also examined it with other detection techniques. Experimental results indicate that our prototype was effective in hiding kernel level rootkits.