A Framework for Analyzing GPU-Executed Malware

Abstract

Graphics processing units (GPU) are an integral part of today's computing environment. The marketing emphasis on user experience pushes vendors to constantly look for better graphics hardware and newer drivers to integrate into their products. Most commodity GPUs function as accelerators for image and video processing tasks and are present (either as dedicated or integrated form factor) in everyday devices including desktops, laptops, smartphones or other portable gadgets. Recent trends have seen the GPU move to perform additional tasks such as offloading some of the computation from the CPU or solve highly parallel problems. As GPUs become more powerful and widespread they will naturally become a very attractive target for attackers. Cybercriminals will look for any vulnerability in the GPU hardware or software, and will try to use it as an attack vector to compromise the system. This paper presents some of the incidents that involve the use of GPUs to perform malicious actions and proposes a framework to allow analysts to inspect the code executed on the GPU and trigger security alerts. The proposed solution will look at the processes running inside an operating system, it will identify which of them require access to the GPU and will try to intercept and scan for any suspicious activities, similar to a conventional security solution.