Upload File

custos: practical tamper-evident auditing of …...privilege escalation 5. log tampering 10 if the...

  • Home
  • Documents
  • Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident
58
Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan, Adam Bates, Christopher W. Fletcher, Andrew Miller, Dave Tian

Upload: others

Post on 01-Aug-2020

9 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Custos: Practical Tamper-Evident Auditing of Operating Systems

Using Trusted Execution

Riccardo Paccagnella, Pubali Datta, Wajih Ul Hassan,Adam Bates, Christopher W. Fletcher, Andrew Miller, Dave Tian

Page 2: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Logs Are Useful

2Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 3: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Logs Are Useful

3

• 75% of incident response specialists said logs are the most valuable artifact during an investigation.1

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Carbon Black Quarterly Incident Response Threat Report April 2019

Page 4: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Logs Are Useful

4

• 75% of incident response specialists said logs are the most valuable artifact during an investigation.1

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Carbon Black Quarterly Incident Response Threat Report April 2019

Page 5: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

5Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 6: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

6Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 7: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack Model

7Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Attack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering

Page 8: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering

8Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs about the compromise are crucial for forensics!

Page 9: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering

9

Logs about the compromise are crucial for forensics!

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

If the attacker does nottamper with them, we can detect the attack.

Page 10: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering

10

If the attacker tampers with them, we can’t detect the attack.

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

If the attacker does nottamper with them, we can detect the attack.

Logs about the compromise are crucial for forensics!

Page 11: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering

11Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 12: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering6. Lateral Movement

12Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 13: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering6. Lateral Movement

13Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Central Server?

Page 14: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Attack ModelAttack pattern:

1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log Tampering6. Lateral Movement

14Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logs

Integrity proofs

Page 15: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Design Overview

15Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 16: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Design Overview

1) TAMPER-EVIDENT LOGGING

16Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 17: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Design Overview

1) TAMPER-EVIDENT LOGGING

2) AUDITING

17Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 18: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

18

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 19: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

19

sk // secret key

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

Page 20: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

20

sk // secret keyc // counterH // current hash

Logging:H.Update(mi)

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

Page 21: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

21

sk // secret keyc // counterH // current hash

Logging:H.Update(m1)

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

ENCLAVE

Page 22: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

22

sk // secret keyc // counterH // current hash

Logging:H.Update(m2)

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

ENCLAVE

Page 23: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

23

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

mh

…

ENCLAVE

Page 24: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

24

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

mh

…

ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

Page 25: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

25

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

mh

…Auditor

ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

Page 26: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

26

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

Commitment:H.Update(c)𝜎 = Sigsk(H)H.Init()c++

m1

Logger

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

m2

mh

…Auditor

ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

Page 27: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Auditing

27Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1) CENTRALIZED AUDITING

Page 28: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Auditing

28Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1) CENTRALIZED AUDITING

2) DECENTRALIZED AUDITING

Page 29: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

29Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Logger+Auditor

Logger+Auditor

Logger+Auditor

Logger+Auditor

Decentralized Auditing

Page 30: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

30Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z

Logger v ENCLAVE

pkv -> public key of v

Page 31: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

31Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z

Logger v ENCLAVE

audit challenge1

pkv -> public key of v

Page 32: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

32Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z

Logger v ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌𝒗 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

audit challenge1

pkv -> public key of v

Page 33: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

33Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Auditor z

Logger v ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌𝒗 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

audit challenge

logs and 𝜎

1

2

pkv -> public key of v

Page 34: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

34Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Verification (𝜎, m1 , …, mh , c):H = Hash(m1 || … || mh || c)result = Verpk_v(𝜎, H)

Auditor z

Logger v ENCLAVE

𝝈 = 𝑺𝒊𝒈𝒔𝒌𝒗 (𝑯𝒂𝒔𝒉( 𝒎𝟏|| … || 𝒎𝒉||𝒄))

audit challenge

logs and 𝜎

1

2

pkv -> public key of v

Page 35: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

35

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 36: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

36

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mi)

Logger v

ENCLAVE

Page 37: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

37

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

m1

Logger v

m2

mh

…

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation

Page 38: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

38

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

m1

Logger v

m2

mh

…

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Page 39: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

39

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

m1

Logger v

m2

mh

…

ENCLAVE

Auditor

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Page 40: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

40

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

Commitment:H.Update(c)𝜎 = Sigsk(H)H.Init()c++

m1

Logger v

m2

mh

…

ENCLAVE

Auditor

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Page 41: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

41

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

Commitment:H.Update(c)𝜎 = Sigsk(H)H.Init()c++

m1

Logger v

m2

mh

…

ENCLAVE

Verification (𝜎, m’1 , …, m’k , c):H = Hash(m’1 || … || m’k || c)result = Verpk_v(𝜎, H)

Auditor

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Page 42: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

42

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

Commitment:H.Update(c)𝜎 = Sigsk(H)H.Init()c++

m1

Logger v

m2

mh

…

ENCLAVE

Verification (𝜎, m’1 , …, m’k , c):H = Hash(m’1 || … || m’k || c)result = Verpk_v(𝜎, H)

Auditor

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Page 43: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

43

Security Analysis

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mh)

Commitment:H.Update(c)𝜎 = Sigsk(H)H.Init()c++

m1

Logger v

m2

mh

…

ENCLAVE

Verification (𝜎, m’1 , …, m’k , c):H = Hash(m’1 || … || m’k || c)result = Verpk_v(𝜎, H)

Auditor

ENCLAVE

Attack pattern:1. Initial Access2. Establish Foothold3. Download Exploit4. Privilege Escalation5. Log tampering

m’2m’1

m’k…

Full security analysis on the paper!

Page 44: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

44

Microbenchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 45: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

45

Microbenchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1 Karande et al. ”SGX-log: Securing System Logs With SGX." ASIACCS 2017.2 Hartung et al. “Practical and Robust Secure Logging from Fault-Tolerant Sequential Aggregate Signatures”, ProvSec 2017

0.001 0.01 0.1 1 10 100 1000 10000 100000

Custos

SGX-Log

BGLS

Logging Latency (μs)

1

2

Page 46: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

46

Application Benchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 47: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

47

Application Benchmarks

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

00.10.20.30.40.50.60.70.80.9

11.11.2

nginx apache2 redis blast blast-multicore

Nor

mal

ized

Runt

ime

Insecure Custos

Page 48: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

48

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 49: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

49

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

• Deploy Custos on 100 nodes.

Page 50: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

50

Realistic Case Study

Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

• Deploy Custos on 100 nodes.

• Replay attack from DARPA Transparent Computing engagement:– Professional red-team emulating a nation state attacker.

Page 51: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

10:52

51Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1. Failed Compromise Attempt (Exploit of

Firefox 54.0.1) 2. Initial Access(Exploit of Firefox 54.0.1)3. Unprivileged Shell

11:42

Complete the attack

11:46

Page 52: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

10:52

52Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

1. Failed Compromise Attempt (Exploit of

Firefox 54.0.1) 2. Initial Access(Exploit of Firefox 54.0.1)3. Unprivileged Shell

11:42

Complete the attack

11:46

Page 53: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

11:46:17

53Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

4. Download Drakon

5. Privilege Escalation (through Drakon binary)6. Log Tampering

11:46:44

11:46:47Custos’ auditingdiscovered log

tampering!

10:5211:42

11:46

Page 54: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Conclusion

54Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 55: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Conclusion• Log integrity is important.

55Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

Page 56: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Conclusion• Log integrity is important.

• Custos is a practical solutionfor log integrity.

56Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mi)m

Logger

ENCLAVE

Page 57: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Conclusion• Log integrity is important.

• Custos is a practical solutionfor log integrity.

• Custos can discover log tampering in near real-time.

57Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mi)m

Logger

ENCLAVE

Page 58: Custos: Practical Tamper-Evident Auditing of …...Privilege Escalation 5. Log Tampering 10 If the attacker tampers with them, we can’t detect the attack. Custos: Practical Tamper-Evident

Conclusion• Log integrity is important.

• Custos is a practical solutionfor log integrity.

• Custos can discover log tampering in near real-time.

• https://bitbucket.org/sts-lab/custos

58Custos: Practical Tamper-Evident Auditing of Operating Systems Using Trusted Execution – Riccardo Paccagnella

sk // secret keyc // counterH // current hash

Logging:H.Update(mi)m

Logger

ENCLAVE

https://bitbucket.org/sts-lab/custos

Tamper Evident Tape Manufacturers - Security Bag Tape 2018 · 2018. 9. 21. · Tamper evident tapes can be applied to bags protecting contents with obvious tamper evident messages

Tamper Evident Microprocessors - field is being used for creating

Efficient Data Structures for Tamper-Evident Logging

Publius A Robust, Tamper Evident, Censorship Resistant WWW Based Publishing System

CUSTOS: Practical Tamper-Evident Auditing of Operating ...€¦ · In this work, we introduce CUSTOS, a practical framework for the detection of tampering in system logs. CUSTOS consists

Tamper evident encryption of integers using keyed Hash Message Authentication Code

We can custom make your bags Tamper Evident Cash Solutions - … · Tamper Evident Cash Solutions from Versapak By Appointment to Her Majesty the Queen Supplier of Tamper Evident

InnoSealer Tamper Evident Bag Closing System

Ethical Polypaper Pvt. Ltd., Ahmedabad, Tamper Evident Envelope

Daydots Tamper-Evident Labels - Food Safety Solutions · 2019-05-22 · Tamper-Evident Labels Delivery is a fast-growing trend that can help you grow your business. But it does introduce

More About InnoSeal Systems- Tamper Evident Bag Sealer

Worldwide Supplier of Security Seals Tamper-Evident … · Worldwide Supplier of Security Seals . Tamper-Evident Products & Cable Ties . Dickey Manufacturing Company (DMC) is dedicated

Igb tamper evident child resistant packaging 2017

Tamper-Evident Digital Signatures: Protecting Certification Authorities Against Malware

Bravura Packers Private Limited€¦ · TAMPER PROOF BAGS Tamper Proof Courier Bags Tamper Proof Security Bags Tamper Evident Security Bags Tamper Proof Bags O u r P r o d u c t s

Tamper evident products1

Tamper Evident Seals - Lasersec · 2017. 4. 11. · Tamper Evident Seal Tamper evident seal application is a fast and easy way to offer your customers a tamper evident container or

Laser Stitch Offers Tamper-Evident Solution! 909A

Efficient Data Structures for Tamper-Evident Logging...Tamper evident solutions • Current commercial solutions – ‘Write only’ hardware appliances – Security depends on correct

VoteBox: a tamper-evident, verifiable electronic voting system

ForkBase: Immutable, Tamper-evident Storage Substrate for ...ooibc/icde20forkbase.pdfForkBase: Immutable, Tamper-evident Storage Substrate for Branchable Applications Qian Lin 1, Kaiyuan

PROCUREMENT OF PUSH FIT TYPE OR ROTO TYPE TAMPER EVIDENT ... · tamper evident poly carbonate security seals tender no. stq 6033 punjab state transmission corporation ltd. (regd

Tamper evident & label solutions - Void Stickers stickers catalog.pdf · Tamper evident & label solutions World leading specialist on tamper evident and warranty seals We have the

Tamper Evident Jar Promotional. Tamper Evident Jar Tear – off Tamper band Straight sided Stackable Frustrum Seal

STEB's Security Tamper Evident Bags · 2020. 9. 1. · TAMPER EVIDENT BAG Internal transparent pocket to display receipt as proof of purchase at airport duty-free shop, or on board

MAILROOM FURNITURE SORT UNITS TAMPER EVIDENT ...flexipakmailroom.com/download/Flexpakcatalouge.pdfTAMPER EVIDENT BAGS SECURE STORAGE SORT UNITS CARTS SECURE MAILBOXES MailroomMatters15

VoteBox: a tamper-evident, verifiable electronic voting system · USENIX Association 17th USENIX Security Symposium 349 VoteBox: a tamper-evident, verifiable electronic voting system

Purchase of Tamper Evident Envelopes for the University of ... · 2.2 During 2016-17, University of Delhi has procured tamper evident envelopes of about Rs. 4,00,000/- approx. However,

PETE packaging Tamper-Resistant, Tamper-Evident Containers · Tamper-Resistant, Tamper-Evident Containers Specifi cally designed to inhibit tampering, eliminating the need for shrink

DOT SUPPLIES - AlcoPro€¦ · 342 Tamper Evident Tape $25.00 Tamper Evident Tape Use Tamper Evident to fasten test results to the Alcohol Test Form. Each box contains two rolls of

Non-Printed Tamper-Evident TapeSecurity Tape Strips Seal your cartons for safety with Labelmaster’s Printed Tamper-Evident Tape Strips. These strips provide physical evidence of

Tamper-Evident Digital Signatures: Protecting Certification Authorities Against Malware

Basing Cryptographic Protocols on Tamper-Evident SealsKey words: tamper-evident seals, human, protocol, universally composable, coin ipping 1. Introduction In this paper we consider

 · 2020. 9. 1. · - Security & Tamper Evident Directory ... From courier to crime evidence bags- Dynaflex March 24, 2014 by Maha Agarwal Leave a Reply Tweet DYNA SAFE tamper evident

tamper evident - Distinctive Medical...TAMPER EVIDENT Maintaining the integrity of items moving around hospitals has never been more important. Our range of tamper evident bags, seals,