Detecting kernel exploits
A kernel is monitored for occurrence of a set of Kprobes. A determination is made that a Strategy that makes use of at least one Kprobe included in the set of Kprobes has been matched. A remedial action is taken in response to the determination. Examples of such remedial actions include generating an alert and terminating a network connection.
1. A system, comprising:
a processor configured to:
monitor for an activation of a set of one or more previously attached Kprobes;
determine that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled; and
take a remedial action in response to the determination that the security violation has occurred; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the processor is further configured to set a debugging tracepoint.
3. The system of claim 1 , wherein the remedial action includes generating an alert.
4. The system of claim 1 , wherein the remedial action includes terminating a network connection.
5. The system of claim 1 , wherein the strategy pattern is associated with setting a CR4 control register.
6. The system of claim 1 , wherein the strategy pattern is associated with disabling Supervisor Mode Execution Prevention (SMEP).
7. The system of claim 1 , wherein the strategy pattern is associated with disabling Supervisor Mode Access Prevention (SMAP).
8. The system of claim 1 , wherein the strategy pattern is associated with a function being called with a return address in userland.
9. The system of claim 1 , wherein the strategy pattern is associated with credential preparation.
10. The system of claim 1 , wherein the strategy pattern is associated with disabling a security module.
11. The system of claim 10 , wherein the processor is further configured to scan kernel memory to determine whether the security module has been disabled.
12. The system of claim 1 , wherein a filter for a magic cookie value is applied as a function argument to determine whether a security mechanism has been disabled.
13. The system of claim 1 , wherein at least one Kprobe included in the set of Kprobes is periodically triggered by a Sensor.
14. A method, comprising:
monitoring for an activation of a set of one or more previously attached Kprobes;
determining that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled; and
taking a remedial action in response to the determination that the security violation has occurred.
15. The method of claim 14 , further comprising setting a debugging tracepoint.
16. The method of claim 14 , wherein the remedial action includes generating an alert.
17. The method of claim 14 , wherein the remedial action includes terminating a network connection.
18. The method of claim 14 , wherein the strategy pattern is associated with setting a CR 4 control register.
19. The method of claim 14 , wherein the strategy pattern is associated with disabling Supervisor Mode Execution Prevention (SMEP).
20. The method of claim 14 , wherein the strategy pattern is associated with disabling Supervisor Mode Access Prevention (SMAP).
21. The method of claim 14 , wherein the strategy pattern is associated with a function being called with a return address in userland.
22. The method of claim 14 , wherein the strategy pattern is associated with credential preparation.
23. The method of claim 14 , wherein the strategy pattern is associated with disabling a security module.
24. The method of claim 23 , further comprising scanning kernel memory to determine whether the security module has been disabled.
25. The method of claim 14 , wherein a filter for a magic cookie value is applied as a function argument to determine whether a security mechanism has been disabled.
26. The method of claim 14 , wherein at least one Kprobe included in the set of Kprobes is periodically triggered by a Sensor.
27. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
monitoring for an activation of a set of one or more previously attached Kprobes;
determining that a security violation corresponding to a strategy pattern match has occurred, wherein the strategy pattern comprises a set of one or more behaviors including the activation of at least one Kprobe included in the set of Kprobes, wherein the at least one activated Kprobe is indicative of a security feature having been disabled; and
taking a remedial action in response to the determination that the security violation has occurred.