Privilege Escalation Research Articles

Kernel Protection Against Just-In-Time Code Reuse

The abundance of memory corruption and disclosure vulnerabilities in kernel code necessitates the deployment of hardening techniques to prevent privilege escalation attacks. As stricter memory isolation mechanisms between the kernel and user space become commonplace, attackers increasingly rely on code reuse techniques to exploit kernel vulnerabilities. Contrary to similar attacks in more restrictive settings, as in web browsers, in kernel exploitation, non-privileged local adversaries have great flexibility in abusing memory disclosure vulnerabilities to dynamically discover, or infer, the location of code snippets in order to construct code-reuse payloads. Recent studies have shown that the coupling of code diversification with the enforcement of a “read XOR execute” (R ∧ X) memory safety policy is an effective defense against the exploitation of userland software, but so far this approach has not been applied for the protection of the kernel itself. In this article, we fill this gap by presenting kR ∧ X: a kernel-hardening scheme based on execute-only memory and code diversification. We study a previously unexplored point in the design space, where a hypervisor or a super-privileged component is not required. Implemented mostly as a set of GCC plugins, kR ∧ X is readily applicable to x86 Linux kernels (both 32b and 64b) and can benefit from hardware support (segmentation on x86, MPX on x86-64) to optimize performance. In full protection mode, kR ∧ X incurs a low runtime overhead of 4.04%, which drops to 2.32% when MPX is available, and 1.32% when memory segmentation is in use.

Blockchain-based Object Name Service with Tokenized Authority

Today, the Internet of Things (IoT) technology is applied everywhere, providing tremendous amounts of IoT service. The GS1, a non-profit international standards organization, has established standards for IoT technology. Especially, the GS1 standardized an Object Name Service (ONS) leveraging DNS's distributed and federated infrastructure, enables users to manage and discover IoT services such as the retail, food, healthcare, smart city, and so on. However, the ONS is vulnerable to the data tampering, privilege escalation, and service fault caused by DNS attacks including the man in the middle, cache poisoning, replay, hijacking, and denial of service attacks. Nowadays, IoT services are used in security-sensitive areas, such as finance and healthcare. Therefore, the security of ONS should be strengthened before causing severe problems such as data breach, economic loss, and social loss. In this paper, we propose a blockchain-based ONS with a tokenized authority called the BlockONS. The BlockONS provides strength in the data tampering and privilege escalation allowing a fault tolerance. The BlockONS consists of a content off-chain scaling, a data tampering validation method, a fault-tolerance method, and a Blockchain Token-Based Access Control (BTBAC) method. We designed the BlockONS into two parts: A BlockONS Node part manages the validation method and BTBAC model. A BlockONS Agent part manages the off-chain scaling and fault tolerance. Finally, we implemented the BlockONS leveraging a Hyperledger Sawtooth blockchain. We proved the proposed validation method, fault tolerance method, and BTBAC method through use cases and security analyses on attack situations. We deployed the BlockONS in the Daejeon city and evaluated the performance to show the feasibility of the BlockONS.

Exploiting stack-based buffer overflow using modern day techniques

One of the most commonly known vulnerabilities that can affect a binary executable is the stack-based buffer overflow. The buffer overflow occurs when a program, while writing data to a buffer, overruns the buffer’s boundary and overwrites adjacent memory locations. Nowadays, due to multiple protection mechanisms enforced by the operating system and on the executable level, the buffer overflow has become harder to exploit. Multiple bypassing techniques are often required to be used in order to successfully exploit the vulnerability and control the execution flow of the studied executable. One of the security features designed as protection mechanisms is Data Execution Prevention (DEP) which helps prevent code execution from the stack, heap or memory pool pages by marking all memory locations in a process as non-executable unless the location explicitly contains executable code. Another protection mechanism targeted is the Address Space Layout Randomization (ASLR), which is often used in conjunction with DEP. This security feature randomizes the location where the system executables are loaded into memory. By default, modern day operating systems have these security features implemented. However, on the executable level, they have to be explicitly enabled. Most of the protection mechanisms, like the ones mentioned above, require certain techniques in order to bypass them and many of these techniques are using some form of address memory leakage in order to leverage an exploit. By successfully exploiting a buffer overflow, the adversary can potentially obtain code execution on the affected operating system which runs the vulnerable executable. The level of privilege granted to the adversary is highly depended on the level of privilege that the binary is executed with. As such, an adversary may gain elevated privileges inside the system. Most of the times, this type of vulnerability is used for privilege escalation attacks or for gaining remote code execution on the system.

Memoryranger Prevents Highjacking File_object Structures in Windows Kernel

Windows OS kernel memory is one of the main targets of cyber-attacks. By launching such attacks, hackers are succeeding in process privilege escalation and tampering with users data by accessing kernel mode memory. This paper considers a new example of such an attack, which results in access to the files opened in an exclusive mode. Windows built-in security features prevent such legal access, but attackers can circumvent them by patching dynamically allocated objects. The research shows that the Windows 10, version 1809 x64 is vulnerable to this attack. The paper provides an example of using MemoryRanger, a hypervisor-based solution to prevent such attack by running kernel-mode drivers in isolated kernel memory enclaves.

A Combination Method for Android Malware Detection Based on Control Flow Graphs and Machine Learning Algorithms

Android malware severely threaten system and user security in terms of privilege escalation, remote control, tariff theft, and privacy leakage. Therefore, it is of great importance and necessity to detect Android malware. In this paper, we present a combination method for Android malware detection based on the machine learning algorithm. First, we construct the control flow graph of the application to obtain API information. Based on the API information, we innovatively construct Boolean, frequency, and time-series data sets. Based on these three data sets, three detection models for Android malware detection regarding API calls, API frequency, and API sequence aspects are constructed. Ultimately, an ensemble model is constructed for conformity. We tested and compared the accuracy and stability of our detection models through a large number of experiments. The experiments were conducted on 10010 benign applications and 10683 malicious applications. The results show that our detection model achieves 98.98% detection precision and has high accuracy and stability. All of the results are consistent with the theoretical analysis in this paper.

Role Behavior Detection Method of Privilege Escalation Attacks for Android Applications

Role Behavior Detection Method of Privilege Escalation Attacks for Android Applications

An adaptive and configurable protection framework against android privilege escalation threats

Android is a successful mobile platform with a thriving application ecosystem. However, despite its security precautions like permission mechanism, it is still vulnerable to privilege escalation threats and particularly confused deputy attacks that exploit the permission leak vulnerabilities of Android applications. Worse, most existing detection and protection techniques have become costly and unresponsive in current Android dynamic permission environments. In this paper, we propose a configurable Android security framework to prevent the exploitation of permission leak vulnerabilities of third-party applications via confused deputy attacks. Our framework collects the runtime states of applications and enforces policy and capability-based access control to restrain riskful inter-application communications, so as to provide more responsive, adaptive, and flexible application protection. Besides, our framework provides users with a flexible runtime policy configuration together with a complementary security mechanism to mitigate risks induced by inappropriate policies. Additionally, we present a sophisticated access decision cache system with a proactive maintenance method that ensures the efficiency and dependability of decision services. Theoretical analysis and experimental evaluation demonstrate that our approach provides configurable and effective protections for third-party applications against permission leak vulnerabilities at small performance and usability costs.

A Privacy-Preserving Passenger Information Management Scheme for Road Transport System in Nigeria

In Nigeria road transport system, the conventional paper-based manifest allows passengers' information to be collected and used for emergency purposes. However, the privacy of passengers is not preserved because an adversary can easily obtain these sensitive information for malicious intentions such as extortion, kidnapping, route monitoring, assassination, spying, and so forth. To address this problem, we develop a provably secure scalable lightweight data management scheme for achieving data privacy, authenticity, integrity, and confidentiality in road transport systems. An efficient authentication scheme is developed to achieve data authenticity and integrity, and a novel perturbation to guarantee data privacy and confidentiality. We show that the scheme is provably secure in the random oracle model based on Discrete Logarithm Assumption (DLA). In addition, the scheme achieves strong anonymity, conditional traceability and resistance to various attacks, and provides countermeasure against privilege escalation. The novel perturbation prevents gleaning by adversaries and ensures perfect reconstruction of original data from the perturbed data. Compared with related schemes, the performance evaluation and comparisons show an improved efficiency in terms of computation and communication overheads. Therefore, the proposed scheme is suitable for practical applications in the road transport system in Nigeria to overcome the weaknesses and limitations of the paper manifest.

WINDOWS PRIVILEGE ESCALATION THROUGH NETWORK BACKDOOR AND INFORMATION MINING USING USB HACKTOOL

A privilege escalation in the Windows system can be defined as a method of gaining access to the kernel system and allowing the user to have an administrative access to the local admin account system on the computer. This paper describes the proof of concept attack scheme using Universal Serial Bus (USB) Hacktool. The attack scheme, the same interaction on the physical access to the computer system could be accomplished by the attacker using a little effort on social engineering and specialized USB Hacktool to take over the computer system in full where it will collect valuable information and escalate the administrative privilege to gain unauthorized admin access which further attack can be done like setting up an open port for backdoor access. The evaluation of this paper gives a significant value as for educational purpose for proof of concept security project. The implementation on this project could help the responsible team to take necessary action toward physical security access to their computer or workstation.

An autonomous lightweight conditional privacy-preserving authentication scheme with provable security for vehicular ad-hoc networks

ABSTRACTVehicular ad hoc network (VANET) is an emerging technology in wireless communications which has the prospect to improve traffic safety and efficiency, as well as reduce air pollution. The traffic-related messages transmitted between vehicles and roadside units must be signed and verified without revealing the real identities of the vehicles. However, an authorized trusted party must be able to obtain the real identity of a vehicle on a controversial message. Existing conditional privacy-preserving authentication (CPPA) schemes in VANETs either rely on a tamper-proof device or complex mathematical operations such as bilinear pairing and map-to-point hash function or cannot meet the privacy and security requirements in VANETs. In this work, we propose an efficient CPPA scheme for VANETs based on the elliptic curve cryptography without relying on any hardware device. The scheme satisfies the security and privacy requirements of VANETs, solves private key compromise problem, and provides countermeasure against privilege escalation. We show that the scheme is existentially secure against an adaptive chosen message and identity attacks in the random oracle model based on the hardness of the elliptic curve discrete logarithm problem. The performance results show that the proposed scheme is more efficient than previous schemes in VANETs.

Fault Attacks on Secure Embedded Software: Threats, Design, and Evaluation

Embedded software is developed under the assumption that hardware execution is always correct. Fault attacks break and exploit that assumption. Through the careful introduction of targeted faults, an adversary modifies the control-flow or data-flow integrity of software. The modified program execution is then analyzed and used as a source of information leakage, or as a mechanism for privilege escalation. Due to the increasing complexity of modern embedded systems, and due to the difficulty of guaranteeing correct hardware execution even under a weak adversary, fault attacks are a growing threat. For example, the assumption that an adversary has to be close to the physical execution of software, in order to inject an exploitable fault into hardware, has repeatedly been shown to be incorrect. This article is a review on hardware-based fault attacks on software, with emphasis on the context of embedded systems. We present a detailed discussion of the anatomy of a fault attack, and we make a review of fault attack evaluation techniques. The paper emphasizes the perspective from the attacker, rather than the perspective of countermeasure development. However, we emphasize that improvements to countermeasures often build on insight into the attacks.

A survey of Android exploits in the wild

The Android operating system has been dominating the mobile device market in recent years. Although Android has actively strengthened its security mechanisms and fixed a great number of vulnerabilities as its version evolves, new vulnerabilities still keep emerging. Vulnerability exploitation is a common way to achieve privilege escalation on Android systems. In order to provide a holistic and comprehensive understanding of the exploits, we conduct a survey of publicly available 63 exploits for Android devices in this paper. Based on the analysis of the collected real-world exploits, we construct a taxonomy on Android exploitation and present the similarities/differences and strength/weakness of different types of exploits. On the other hand, we conduct an evaluation on a group of selected exploits on our test devices. Based on both the theoretical analysis and the experimental results of the evaluation, we present our insight into the Android exploitation. The growth of exploit categories along the timeline reflects three trends: (1) the individual exploits are more device specific and operating system version specific; (2) exploits targeting vendors' customization grow steadily where the increase of other types of exploits slows down; and (3) memory corruption gradually becomes the primary approach to initiate exploitation.

RootAgency: A digital signature-based root privilege management agency for cloud terminal devices

Rooting an Android device can be a voluntary behavior from end users with various motivations, such as removing OEM pre-installed apps. This leads to an increase in opportunity of privilege escalation for malwares. The existing root privilege management schemes rely on the end users to make privilege granting decisions for all legal and illegal apps installed on the device. However, unskilled end users are incapable, or are careless in determining which privileges are appropriate for what type of app. To address this issue, a root privilege management agency named RootAgency is proposed, which adopts a digital signature scheme to guarantee the exclusive root-privilege-granting opportunities of authenticated apps. RootAgency authenticates an app by checking whether it holds the signature generated by the secret key, and grants the root privilege when a signed app submits the request. Moreover, it verifies the app’s integrity to prevent it from repackaging. Thus, the users are not involved in decision making while confronting root requests. The proposed scheme ensures the security of rooted Android devices, and enhances the security of mobile terminal devices. This diminishes the threat to cloud infrastructure from root-misused Android devices. In addition, a prototype is implemented to evaluate its effectiveness, efficiency, and overhead. The experimental results show that RootAgency is widely compatible and its performance overhead is reasonable.

PrivGuard: Protecting Sensitive Kernel Data From Privilege Escalation Attacks

Kernels of operating systems are written in low-level unsafe languages, which make them inevitably vulnerable to memory corruption attacks. Most existing kernel defense mechanisms focus on preventing control-data attacks. Recently, attackers have turned the direction to non-control-data attacks by hijacking data flow, so as to bypass current defense mechanisms. Previous work has proved that non-control-data attacks are the critical threat to kernels. One of the important purposes of these attacks is to achieve privilege escalation by overwriting sensitive kernel data. The goal of our research is to develop a lightweight protection mechanism to mitigate non-control-data attacks that compromise sensitive kernel data. We propose an approach that enforces data integrity of sensitive kernel data by preventing the illegal write to these data to mitigate privilege escalation attacks. The main challenge of the proposed approach is to validate the modification of sensitive kernel data at runtime. The validation routine must verify the legitimacy of the duplicated sensitive data and ensure the credibility of the verification. To address this challenge, we modify the system call entry point to monitor the change of the sensitive kernel data without any change to Linux access control mechanism. Then, we use stack canaries to protect the duplication of sensitive kernel data that are used for integrity checking. In addition, we protect the integrity of sensitive kernel data by forbidding illegal updates to them. We have implemented the prototype for Linux kernel on Ubuntu Linux platform. The evaluation results of our prototype demonstrate that it can mitigate privilege escalation attacks and its performance overhead is moderate.

JTAG Fault Injection Attack

Fault injection attacks are wide spread in the domain of smart cards and microcontrollers but have not been yet democratized on complex embedded microprocessors, such as system on chip that can be found in smart phones, tablets, and automotive systems. The main explanation is the difficulty involved in injecting a fault at the right place and at the right time to make these attacks effective on such devices. However, for development and debugging, these devices provide new tools that could be considered as possibly enabling attacks. One of them, the JTAG debug tool is present on most electronic devices today. In this letter, we present the first fault injection attack based on JTAG. Using the example of a privilege escalation attack, we detail how this tool can be used either to check the feasibility of this attack by fault injection or to perform an actual attack.

LDAP Vulnerability Detection in Web Applications

Lightweight Directory Access Protocol (LDAP) is commonly used in web applications to provide lookup information and enforcing authentication. Web applications may suffer from LDAP injection vulnerabilities that can lead to security breaches such as login bypass and privilege escalation. This paper1 proposes OCL fault injection-based detection of LDAP injection attacks. The authors extract design-level information and constraints expressed in OCL and then randomly alter them to generate test cases that have the capability to uncover LDAP injection vulnerabilities. The authors proposed approaches to implement test case generation, and they used one open source PHP application and one custom application to evaluate the proposed approach. The analysis shows that this approach can detect LDAP injection vulnerabilities.

Live acquisition of main memory data from Android smartphones and smartwatches

Recent research in Android device forensics has largely focused on evidence recovery from NAND flash memory. However, pervasive deployment of NAND flash encryption technologies and the increase in malware infections which reside only in main memory have motivated an urgent need for the forensic study of main memory. Existing Android main memory forensics techniques are hardly being adopted in practical forensic investigations because they often require solving several usability constraints, such as requiring root privilege escalation, custom kernel replacement, or screen lock bypass. Moreover, there are still no commercially available tools for acquiring the main memory data of smart devices. To address these problems, we have developed an automated tool, called AMD, which is capable of acquiring the entire content of main memory from a range of Android smartphones and smartwatches. In developing AMD, we analyzed the firmware update protocols of these devices by reverse engineering the Android bootloader. Based on this study, we have devised a method that allows access to main memory data through the firmware update protocols. Our experimental results show that AMD overcomes the usability constraints of previous main memory acquisition approaches and that the acquired main memory data of a smartphone or smartwatch can be accurately used in forensic investigations.

Exploiting the analog properties of digital circuits for malicious hardware

While the move to smaller transistors has been a boon for performance it has dramatically increased the cost to fabricate chips using those smaller transistors. This forces the vast majority of chip design companies to trust a third party---often overseas---to fabricate their design. To guard against shipping chips with errors (intentional or otherwise) chip design companies rely on post-fabrication testing. Unfortunately, this type of testing leaves the door open to malicious modifications since attackers can craft attack triggers requiring a sequence of unlikely events, which will never be encountered by even the most diligent tester. In this paper, we show how a fabrication-time attacker can leverage analog circuits to create a hardware attack that is small (i.e., requires as little as one gate) and stealthy (i.e., requires an unlikely trigger sequence before affecting a chip's functionality). In the open spaces of an already placed and routed design, we construct a circuit that uses capacitors to siphon charge from nearby wires as they transit between digital values. When the capacitors are fully charged, they deploy an attack that forces a victim flip-flop to a desired value. We weaponize this attack into a remotely controllable privilege escalation by attaching the capacitor to a controllable wire and by selecting a victim flip-flop that holds the privilege bit for our processor. We implement this attack in an OR1200 processor and fabricate a chip. Experimental results show that the purposed attack works. It eludes activation by a diverse set of benchmarks and evades known defenses.

Improving security in cloud by formal modeling of IaaS resources

Nowadays, it is a matter of fact that Cloud is a “must” for all complex services requiring great amount of resources. Big-Data Services are a striking example: they actually perform many kind of analysis (like analytics) on very big repositories. Many File Systems and middleware exist for efficient distribution and management of data and they usually use Cloud Resources. Anyway Several problems arose about Security of data: Virtualization is the base of Cloud resources and, even if we consider data storage as virtually separated elements, security issues exist if privilege escalation allows for gaining control on any data on physical hosts. In this paper we show how it is possible to cope Model Driven Engineering techniques to security analysis and monitoring of Cloud infrastructures. For reducing overhead, we provide a formal profile of hosts thermal behaviors. Depending on services input workloads, we detect and forecast malicious actions by comparisons with real thermal data.

On the Design and Implementation of an Integrated Security Architecture for Cloud with Improved Resilience

In this paper, we propose an integrated security architecture which combines policy based access control with intrusion detection techniques and trusted computing technologies for securing distributed applications running on virtualised systems. Our security architecture incorporates access control security policies for secure interactions between applications and virtual machines in different physical virtualized servers. It provides intrusion detection and trusted attestation techniques to detect and counteract dynamic attacks in an efficient manner. We demonstrate how this integrated security architecture is used to secure the life cycle of virtual machines including dynamic hosting and allocation of resources as well as migration of virtual machines across different physical servers. We discuss the implementation of the developed architecture and show how the architecture can counteract attack scenarios involving malicious users exploiting vulnerabilities to achieve privilege escalation and then using the compromised machines to generate further attacks. The feedback between the various security components of our security architecture plays a critical role in detecting sophisticated, dynamically changing attacks, thereby increasing the resilience of the overall secure system.