Privilege Escalation Research Articles

A Web Shell Detection Method Based on Multiview Feature Fusion

Web shell is a malicious script file that can harm web servers. Web shell is often used by intruders to perform a series of malicious operations on website servers, such as privilege escalation and sensitive information leakage. Existing web shell detection methods have some shortcomings, such as viewing a single network traffic behavior, using simple signature comparisons, and adopting easily bypassed regex matches. In view of the above deficiencies, a web shell detection method based on multiview feature fusion is proposed based on the PHP language web shell. Firstly, lexical features, syntactic features, and abstract features that can effectively represent the internal meaning of web shells from multiple levels are integrated and extracted. Secondly, the Fisher score is utilized to rank and filter the most representative features, according to the importance of each feature. Finally, an optimized support vector machine (SVM) is used to establish a model that can effectively distinguish between web shell and normal script. In large-scale experiments, the final classification accuracy of the model on 1056 web shells and 1056 benign web scripts reached 92.18%. The results also surpassed well-known web shell detection tools such as VirusTotal, ClamAV, LOKI, and CloudWalker, as well as the state-of-the-art web shell detectionmethods.

RansomSpector: An introspection-based approach to detect crypto ransomware

Crypto ransomware encrypts user files and then extorts a ransom for decryption, thus it brings a big threat to users. To address this problem, we propose RansomSpector, an introspection-based approach to detect crypto ransomware. Compared to previous solutions, our approach makes progress in two aspects. First, RansomSpector is based on the virtual machine introspection technique, and it resides in the hypervisor layer under the operating system (OS) where ransomware runs. Thus it is capable of analyzing OS-level ransomware and difficult to be bypassed by privilege escalation attacks. Second, RansomSpector monitors both the filesystem and network activities for ransomware detection, thus it achieves a higher precision and earlier warning than the approaches that only leverage the filesystem activities as the detecting basis. To validate our approach, we have implemented a prototype of RansomSpector, and collected 2,117 recent ransomware samples to evaluate it. The evaluation results indicate that our system effectively detects ransomware with a low performance overhead ( < 5% on average).

Detection of Low-Frequency and Multi-Stage Attacks in Industrial Internet of Things

The increasingly sophisticated cyber attacks have become a serious challenge for Industrial Internet of Things (IIoT), which presents two new characteristics: low frequency and multi-stage. That is, hackers could gain authority to attack industrial equipment/infrastructure gradually in a long interval through lurking, lateral intrusion and privilege escalation. While, the existing Machine Learning (ML) based intrusion detection schemes all require the participation of expert knowledge, so it is difficult to adaptively select an attack interval and a retraining period of the detection model in IIoT, resulting in poor detection performance. To solve above problems, a bidirectional long and short-term memory network with multi-feature layer (B-MLSTM) is designed. Firstly, sequence and stage feature layers are introduced in the model training phase model which can learn the corresponding attack interval from historical data, so that the model can effectively detect attacks with different intervals. Then, a double-layer reverse unit is introduced to update the detection model. By collecting information from test data and making association analysis with historical data, the retraining period is adaptively selected to match the new attack interval. Compared with the previous works, our proposed scheme has a lower false positive rate than existing schemes by at least 46.79%, and the false negative rate is reduced by at least 79.85%, which are carried out on three classic IIoT datasets.

Additional kernel observer: privilege escalation attack prevention mechanism focusing on system call privilege changes

Cyberattacks, especially attacks that exploit operating system vulnerabilities, have been increasing in recent years. In particular, if administrator privileges are acquired by an attacker through a privilege escalation attack, the attacker can operate the entire system and cause serious damage. In this paper, we propose an additional kernel observer (AKO) that prevents privilege escalation attacks that exploit operating system vulnerabilities. We focus on the fact that a process privilege can be changed only by specific system calls. AKO monitors privilege information changes during system call processing. If AKO detects a privilege change after system call processing, whereby the invoked system call does not originally change the process privilege, AKO regards the change as a privilege escalation attack and applies countermeasures against it. AKO can therefore prevent privilege escalation attacks. Introducing the proposed method in advance can prevent this type of attack by changing any process privilege that was not originally changed in a system call, regardless of the vulnerability type. In this paper, we describe the design and implementation of AKO for Linux x86 64-bit. Moreover, we show that AKO can be expanded to prevent the falsification of various data in the kernel space. Then, we present an expansion example that prevents the invalidation of Security-Enhanced Linux. Finally, our evaluation results show that AKO is effective against privilege escalation attacks, while maintaining low overhead.

Multifeature-Based Behavior of Privilege Escalation Attack Detection Method for Android Applications

This study proposed an application behavior-detection method based on multifeature and process algebra for detecting privilege escalation attacks in Android applications. The five features of application that constituted the attack were determined through an analysis of the privilege escalation attack model. On the basis of the extraction of multiple features, process algebra was used to build the application-behavior model and the attack model. Strong equivalence relation was used to verify the application behavior. Finally, dataflow path detection is conducted among the applications that can constitute privilege escalation attacks to determine those apps constituted a privilege escalation attack. The accuracy and effectiveness of the proposed method were verified using the DroidBench benchmark test and the test set that includes 55 APKs of 22 types.

Analysis of Privilege Escalation Based on Hierarchical RBAC Model

As access control policies become more and more complex, the detection of access control vulnerabilities becomes more important. Previous research efforts have concentrated on access control vulnerabilities due to programming errors, while the privilege escalation caused by logic errors or abuse of privileges has seldom attracted researchers’ attention, which is also a kind of access control vulnerabilities. To investigate the property of privilege escalation, hierarchical RBAC model is used to describe complex relations between different roles that are represented by a directed role graph. Permissions are divided into multiple categories according to the inheritance of permissions in the role hierarchy. Three types of vulnerabilities, Upward Privilege Escalation, Downward Privilege Escalation and Horizonal Privilege Escalation, are defined and decided theorically based on the inheritance relations between roles in a role graph. Besides the three type, another type of privilege escalation that is not related to the hierarchy of roles is also studied. Finally, the decision theorems of three vulnerabilities are used to optimize the access control decision algorithm.

PrOS: Light-Weight Privatized Se cure OSes in ARM TrustZone

TrustZone is a hardware security technique in ARM mobile devices. Using TrustZone, software components running within the secure world can be completely isolated from the normal world, which ensures hardware-enforced security access control over the underlying computing resources. In order to support multiple trusted applications, TrustZone runs its own operating system, called the secure OS, within the secure world. Unfortunately, attackers have been exploiting privilege escalation vulnerabilities in a secure OS, as reported in most of major secure OSes from product vendors including Samsung, Huawei, and Qualcomm. More critically, as all trusted applications are running on the same secure OS instance, compromising the secure OS leads to compromising all trusted applications, rendering the secure OS as a single point of failure endangering the entire TrustZone's security. This paper presents PrOS, our mechanism to privatize secure OSes through direct virtualization of TrustZone. PrOS allows each trusted application to run with its own secure OS such that the secure OS is no longer a single point of security failure. One particular challenge for PrOS lies in how efficiently to implement software-only virtualization for TrustZone for a practical deployment in real systems despite the condition that the current ARM architectures do not support hardware-assisted virtualization for TrustZone. As opposed to the common belief that software-only virtualization is inefficient and sluggish, we have found several common design features inherent in the secure OS to leverage for optimally tailoring the TrustZone virtualization scheme. We implemented PrOS on a 64-bit ARM development board. According to our evaluation, PrOS incurs 0.02 and 1.18 percent performance overheads on average in the normal and secure worlds, respectively, demonstrating its effectiveness in the field.

Risk Measurement Method for Privilege Escalation Attacks on Android Apps Based on Process Algebra

On the Android platform, information leakage can use an application-layer privilege escalation attack composed of multi-app collusion. However, the detection effect of a single app that can construct privilege escalation attacks is not good. Furthermore, the existing software and app measurement methods are not applicable to the measurement of collusion privilege escalation attacks. We propose a method for measuring the risk of a single app by using process algebra to model and determine the attack behavior, and we construct a measurement function based on sensitive data transitions and the feature set of attack behavior. Through the analysis of the privilege escalation attack model, the feature set of attack behavior is obtained. Then, based on the extracted behavior feature set, process algebra is used to model the dangerous behavior of an app. The dangerous behavior of the app is determined by weak equivalence and non-equivalence, and finally the risk of the app is measured based on the measurement function. Three known applications are used to verify the attack, and the risk measurement values are above 0.98. Based on the classification of applications on the market, we select typical apps in each category to build the test set. Benchmark tests and test set experiments show that the risk measurement results are consistent with the actual detection results, verifying the feasibility and effectiveness of this method.

Covert Device Association Among Colluding Apps via Edge Processor Workload

While thriving application (app) distribution systems involving incentivized third-party app vendors are desirable for the emerging edge computing paradigm, they also bring security challenges as faced by the current mobile app distribution systems. This article studies a threat called covert device association , in which the vendors of two apps collude to figure out which of their app installations run on the same edge device. The threat can widely spread when the two apps are popular. It is also a stepping stone for: 1) the de-anonymization attacks against the users anonymous to one of the two vendors and 2) privilege escalation in which the two colluding vendors have united privileges. We show that the threat can be implemented via a reliable and ubiquitous covert channel based on the edge device’s processor workload without requiring any privileged permissions. We present the implementation details for three attack scenarios of: 1) two Android apps; 2) an Android app and a Web session running in the mobile Tor browser; and 3) two Android Things apps. Evaluation on two smartphones and an embedded edge device shows that the covert channel gives at least 0.25 b/s data rate with zero empirical bit error rate and the covert device association can be completed within 3.2 min.

An adaptive framework against android privilege escalation threats using deep learning and semi-supervised approaches

The immense popularity of Android makes it a primary target of malicious attackers and developers which brings a significant threat from malicious applications for android users through the escalation of the abuse of android permissions and inter-component communication (ICC) mechanism. Therefore, protecting android users from malicious developers and applications is crucial for Android market and communities. As malicious applications can hide their malicious behavior and change the behaviors frequently by abusing the android’s ICC mechanism and related vulnerabilities, it is a challenging task to identify them accurately before it becomes a prevalent reason for users’ privacy and data breach. Therefore, it is essential to develop such a malware detection engine that will ensure zero-day detection. In this research, we propose an adaptive framework which can learn the behavior of malware from the usage of permissions and their escalations. For our adaptive framework, we proposed two different detection models using deep learning and semi-supervised approaches. The proposed detection models can extract knowledge from unlabeled apps to identify the new malicious behavior using the unsupervised training nature of deep learning and clustering techniques and their integration to the supervised detection engine. Thus, our adaptive framework learns about new malicious apps and their behavior without supervised labeling by manual expert and can ensure zero-day protection. The proposed detection models have been tested on a real mobile malware test-bed and data set. The Experimental results show that the deep learning and semi-supervised based models achieve 99.024% of accuracies, more effective for zero-day protection and outperform other existing supervised detection engines.

PGFit: Static permission analysis of health and fitness apps in IoT programming frameworks

Popular Internet of Things (IoT) programming frameworks, such as Google Fit, enable third-party developers to build apps that store and retrieve user data from a variety of data sources such as wearable devices. Most of these apps, particularly those that are health and fitness-related, collect potentially sensitive personal data and send it to cloud servers. Analogous to Android OS, IoT programming frameworks often follow similar permission model; third-party apps on IoT platforms prompt users to grant the apps the access to their private data stored on cloud servers of IoT programming frameworks. Most users have a poor understanding of why these permissions are being asked. This can often lead to unnecessary permissions being granted, which in turn grant these apps with excessive privileges. Over-privileged apps might not be harmful to users when they are used as designed, however, they can potentially be exploited by a malicious actor in a cyber security attack. This is of particular concern with health and fitness apps, which may be exploited to leak highly sensitive personal information. This paper presents PGFit, a static permission analysis tool that precisely and efficiently identifies privilege escalation in third-party apps built on top of a popular IoT programming framework, Google Fit. PGFit extracts the set of requested permission scopes and the set of used data types in Google Fit-enabled apps to determine whether the requested permission scopes are actually necessary. PGFit performs graph reachability analysis on inter-procedural control flow graph. PGFit serves as a quality assurance tool for developers and a privacy checker for app users. We evaluated PGFit using a set of 20 popular Google Fit-enabled apps downloaded from Google Play. Our tool successfully identified the unnecessary permission scopes granted in our data set apps and found that 6 (30%) of the 20 apps are over-privileged.

Security Implications of Intentional Capacitive Crosstalk

With advances in shrinking process technology sizes, the parasitic effects of closely routed adjacent wires, crosstalk , still present problems in practice since they directly influence performance and functionality. Even though there is a solid understanding of parasitic effects in hardware designs, the security implications of such undesired effects have been scarcely investigated. In this paper, we leverage the physical routing effects of capacitive crosstalk to demonstrate a new parametric hardware Trojan design methodology. We show that such Trojans can be implemented by only rerouting already existing resources. Thus, our approach possesses a zero-gate area overhead which is both stealthy and challenging to detect with standard visual inspection techniques. In two case studies, we demonstrate its devastating consequences: (1) we realize an implementation attack on a third-party cryptographic AES IP core and (2) we realize a privilege escalation on a general-purpose processor capable of running any modern operating system. In these case studies, we take special care to ensure that the Trojans do not violate design rule checks, which further highlights that the capacitive crosstalk Trojans can be building blocks for malicious circuitry design. We then investigate how state-of-the-art visual inspection techniques can be enhanced to cope with parametric hardware Trojans. In particular, we develop an automated layout-level mitigation approach which exploits the characteristic wire length of capacitive crosstalk Trojans. Finally, we highlight further implementation strategies for capacitive crosstalk Trojans and pinpoint future research directions.

Forensic Acquisition of IOS Devices

Apple devices are well known for their high-security features in terms of data storage. IOS devices have some restrictions for their usability. The device contains only internal memory and the users can back up their data into iCloud or iTunes. IOS devices are more secure when compared to other mobile devices. The IOS devices can also be jailbroken for the purpose of removing software restrictions and allows the installation of application from the unknown sources i.e., the app that are not unavailable in Apple App store. After jailbreaking, the device becomes vulnerable and lets the attacker to access the device. Apple provides both hardware and software patches to the vulnerabilities, which means many versions can’t be jailbreak so easily. To perform Forensic investigation on the IOS devices, even the forensic investigators need privilege escalation to access the data of the device. The tools which are used to investigate IOS devices are avail as commercial. This project proposes an opensource method to access the IOS device using SSH shell. After the successful mount of device, the data can be acquired for further forensic analysis. Based on the artifacts analysed, the investigators can be able to find the root cause of the crime.

Secure hierarchical Bitcoin wallet scheme against privilege escalation attacks

As the rising popularity of Bitcoin, people tend to use Bitcoin wallets to manage the keys for spending or receiving funds. Instead of generating randomly pairs of keys, which may need higher space complexity for key management, hierarchical deterministic (HD) wallets derive all the keys from a single seed, which is sufficient to recover all the keys, to reduce the complexity of key management. In an HD wallet, it allows users to generate child public keys from the parent public keys without knowing any of the corresponding private keys. This feature allows a permitted auditor to derive all the public keys for auditing. However, this feature makes HD wallets suffered from so-called privilege escalation attacks, where the leakage of any child private key along with its parent public key will expose the other child private keys. To confront with this security flaw, we propose a novel HD wallet scheme that gives out a signature with trapdoor hash functions instead of directly giving private keys for signing. Since it conceals private keys from any child nodes, it can prevent from privilege escalation attacks. Nevertheless, the proposed scheme also provides unlinkability between two public keys to achieve anonymity of user identities and high scalability to the derivations of huge amount of keys. Thus, the proposed scheme achieves user anonymity, public key derivation, and high scalability.

A Provably Secure Pairing-free Anonymous Handover Authentication Protocol For Mobile Wireless Networks

To address the limitations in the existing anonymous handover authentication (AHA) protocols, we propose a novel certificateless-based public key cryptography (CL-PKC) AHA protocol using elliptic curve cryptography (ECC). The protocol can achieve all the security requirements of AHA protocol and provide countermeasure against privilege escalation. The beauty of our protocol is that it is autonomous, where nodes only need to contact the authentication server (AS) once for pseudonym set and thereafter they can renew their pseudonyms on their own. The formal protocol analysis shows that the protocol achieves mutual authentication and session key establishment. Moreover, we show that the protocol is secure in the random oracle model based on elliptic curve discrete logarithm assumption (DLA). The performance evaluation demonstrates that the proposed AHA protocol is very efficient in terms of computation cost and communication overhead than related protocols.

Concordance and Term Frequency in Analyzing API Calls for Malware Behavior Detection

Application Programming Interface (API) is used for the software to interact with an operating system to do certain task such as opening file, deleting file and many more. Programmers use this API to make it easier for their program to communicate with the operating system without having the knowledge of the hardware of the target system. Malware author is an attacker that may belong to an organization or work for themselves. Some malware author has the capabilities to write their own malware, uses the same kind of APIs that is used to create normal programs to create malware. There are many researches done in this field, however, most researchers used n-gram to detect the sequence of API calls and although it gave good results, it is time consuming to process through all the output. This is the reason why this paper proposed to use Concordance to search for the API call sequence of a malware because it uses KWIC (Key Word in Context), thus only displayed the output based on the queried keyword. After that, Term Frequency (TF) is used to search for the most commonly used APIs in the dataset. The results of the experiment show that concordance can be used to search for API call sequence as we manage to identify six malicious behaviors (Install Itself at Startup, Enumerate All Process, Privilege Escalation, Terminate Process, Process Hollowing and Ant debugging) using this method. And based on the TF score, the most commonly used API in the dataset is the Reg Close Key (TF: 1.388), which on its own is not a dangerous API, hence we can infer that most API is not malicious in nature, it is how they were implemented is making them dangerous.

BootBandit: A macOS bootloader attack

Historically, the boot phase on personal computers left systems in a relatively vulnerable state. Because traditional antivirus software runs within the operating system, the boot environment is difficult to protect from malware. Examples of attacks against bootloaders include so‐called “evil maid” attacks, in which an intruder physically obtains a boot disk to install malicious software for obtaining the password used to encrypt a disk. The password then must be stored and retrieved again through physical access. In this paper, we discuss an attack that borrows concepts from the evil maid. We assume exploitation can be used to infect a bootloader on a system running macOS remotely to install code to steal the user's password. We explore the ability to create a communication channel between the bootloader and the operating system to remotely steal the password for a disk protected by FileVault 2. On a macOS system, this attack has additional implications due to “password forwarding” technology, in which a user's account password also serves as the FileVault password, enabling an additional attack surface through privilege escalation.

FinalFilter: Asserting Security Properties of a Processor at Runtime

In an ideal world, it would be possible to build a provably correct and secure processor. However, the complexity of today's processors puts this ideal out of reach. The complete verification of a modern processor remains intractable. Statically verifying even a simple security property -for example, privilege escalation never occurs -remains beyond the state of the art in formal verification. Testing can complement formal verification methods, yet testing is incomplete and bugs in the hardware that leave it vulnerable continue to elude test suites. Further, a crafty malicious actor can evade typical testing coverage metrics. Recent efforts, including that of three of the authors, have explored the use of static analysis on the design files (e.g., hardware description level source code or gate-level netlists) to find suspicious circuitry. These techniques rely on heuristics to define patterns that indicate a likely trojan and then search for instances in the design that match the pattern. However, malicious circuitry that does not match the pattern will be missed, as will inadvertent bugs that open vulnerabilities. By the time the weakness is uncovered, the hardware is already in the end user's hands and vulnerable to attack. In the absence of a full proof of correctness, what is needed is a final filter: a runtime verification technique that works-postdeployment-to detect and respond to security property violations as they occur during execution. In this article, we make the case for final filters using our tool, FinalFilter, as a case study.

The epidemiology of lateral movement: exposures and countermeasures with network contagion models

ABSTRACT An approach is developed for analyzing computer networks to identify systems and accounts that are at particular risk of compromise by an adversary seeking to move laterally through the network via authentication. The dynamics of the adversary are modeled as a contagion spreading across systems linked via authentication relationships derived from Administrator account access and active session data. The adversary is assumed to traverse the network via credential chaining, where the adversary steals credentials from one system, uses them to authenticate to another, and repeats the process. Graph topology measures are used to analyze different contagion models applied to a real Windows network for three primary exposures by identifying: accounts which, either individually or collectively, provide wide and far-reaching access to many systems across the network; accounts with notable privilege escalation liability; and ‘gatekeeper’ systems through which the adversary must pass in order to reach critical assets. The approach can be used to test how different mitigations and countermeasures affect these exposures; for example, we find that disabling remote logins by local accounts and implementing protections that prevent the caching of credentials on remote hosts can substantially curtail lateral movement and privilege escalation.

SafeChain: Securing Trigger-Action Programming From Attack Chains

The proliferation of Internet of Things (IoT) is reshaping our lifestyle. With IoT sensors and devices communicating with each other via the Internet, people can customize automation rules to meet their needs. Unless carefully defined, however, such rules can easily become points of security failure as the number of devices and complexity of rules increase. Device owners may end up unintentionally providing access or revealing private information to unauthorized entities due to complex chain reactions among devices. Prior work on trigger-action programming either focuses on conflict resolution or usability issues, or fails to accurately and efficiently detect such attack chains. This paper explores security vulnerabilities when users have the freedom to customize automation rules using trigger-action programming. We define two broad classes of attack--privilege escalation and privacy leakage--and present a practical model-checking-based system called SAFECHAIN that detects hidden attack chains exploiting the combination of rules. Built upon existing model-checking techniques, SAFECHAIN identifies attack chains by modeling the IoT ecosystem as a Finite State Machine. To improve practicability, SAFECHAIN avoids the need to accurately model an environment by frequently re-checking the automation rules given the current states, and employs rule-aware optimizations to further reduce overhead. Our comparative analysis shows that SAFECHAIN can efficiently and accurately identify attack chains, and our prototype implementation of SAFECHAIN can verify 100 rules in less than one second with no false positives.