於核心模式中動態偵測惡意程式之入侵行為

Detecting the Malicious Code Injection by Hooking System Calls in Kernel Mode

曾裕棟(Yu-Tung Tseng)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊系統與應用研究所/碩士(2006年)

摘要

隨著日益猖獗的病毒(Virus)、木馬(Trojan)、蠕蟲(Worm)、惡意程式(Malware)及間諜程式(Spyware)，大部分的使用者透過防毒及防火牆軟體來保護個人電腦。然而在2005年的10月31日，唱片公司Sony BMG被揭露出該公司所販賣的音樂光碟裡藏有Rootkit，只要在個人電腦上播放此音樂光碟，該Rootkit便會在使用者不知的情況下植入該台個人電腦。實際上，此Rootkit為一數位版權管理(Digital Rights Management，DRM)軟體，然而為了防止使用者盜拷光碟，利用Rootkit技術攔截核心和Windows APIs之間的通訊，並修改指令和資訊，隱藏執行時的資訊及活動狀況來避免被偵測到。從另一方面來說，一惡意程式可能透過類似的技術來躲過防毒軟體的保護，甚至是防火牆軟體的偵測。
實際上，目前已發現使用類似技術的潛在威脅。在Windows作業系統中，我們可以合法的在另一個執行中的程序(Process)裡建立一新的執行緒(Thread)，也因此，一惡意程式可能藉由注入惡意程式碼片斷到一合法程序中，並立即建立一新執行緒執行所注入的惡意程式碼片斷，來躲過防火牆軟體的偵測並存取網路。換句話說，即使在防火牆軟體的保護下，惡意程式、間諜程式及Rootkit仍可藉由在系統中發動內部攻擊後，任意地向外傳送資料或開啟後門(Backdoor)。
因此在此篇論文中，我先探討注入惡意程式碼片斷的方法及其相關的潛在威脅模式，並藉由分析這些方法及威脅模式，在微軟的Windows作業系統上提出一個偵測機制 – 惡意程式入侵偵測引擎(Detecting Malicious Code Injection Engine，DMCIE)，我將此機制實作成在核心模式下執行的驅動程式，因此可動態地監控系統中所有的執行程序，並提供使用者更明確的入侵資訊，而系統在安裝此偵測機制後，其系統效能並不會有大幅度的下滑，整體效能最多只下降3.26%，也因此，此惡意程式入侵偵測引擎適合安裝在Windows作業系統中，或者與其他系統安全軟體結合，來加強整體系統安全。

關鍵字

系統安全 ； 動態鏈結函式庫注入 ； 二進位程式碼注入 ； API攔截 ； 系統呼叫攔載 ； 內部威脅

並列摘要

With the wild spread of virues, trojans, worms, malware, and spyware, most people protect their personal computer by antivirus and firewall software. However, on October 31, 2005, the rootkit coming from a Sony BMG music CD was revealed. This rootkit will be secretly installed into Microsoft Windows operating system after inserting a Sony BMG music CD into the computer. In fact, it is a kind of Digital Rights Management (DRM) software that provides protection against unauthorized copies of the CD, but it hides its process information and activity from being detected. This informs us that malicious software may use similar approaches to avoid the protection of antivirus software, and even the detection of software firewalls.
In fact, there still exist potential threats. In Windows operating system, it is considered a legitimate behavior that a process creates a remote thread in another running process. Thus a malicious process may inject malicious code into an authorized process and then execute it to bypass the detection of software firewalls without causing a warning. In other words, malware, spyware, and rootkits can launch the attack inside the system to send data or open a backdoor silently even under the protection of firewall software.
In this thesis, we discuss the methods how to inject code into running processes and corresponding potential threats. By analyzing these methods, we propose a detecting mechanism called Detecting the Malicious Code Injection Engine (DMCIE) on the Microsoft Windows operating system. DMCIE is implemented as a loadable kernel-mode driver that is able to dynamically monitor every process in the system and provide users with more precise information about the suspected injecting behavior. The maximal overhead caused by DMCIE is less than 3.26%. The minor overhead makes DMCIE suitable to be installed on Windows OS or combine with other software to increase system security.

並列關鍵字

System Security ； DLL Injection ； Binary Code Injection ； API Hooking ； System Call Hooking ； Internal Threat

參考文獻

Available: http://www.agnitum.com/

Available: http://mc.webm.ru/

Available: http://www.hxdef.org

Available: http://www.securityfocus.com/infocus/1839

[19] Jeffrey Richter. Programming Applications for Microsoft Windows, Redmond, Washington: Microsoft Press, 1999.