Hypervisor Based Password Security

HyperPass: Hypervisor Based Password Security James "Murphy" McCauley, Radhika Mittal Abstract Phishing attacks: It has been shown that it is quite Passwords are the linchpin in the security of an increasing possible to fool users into divulging passwords and other number of online services – services that range from private data [11]. While some are quick to dismiss such social networking to business communication to banking. attacks as “user error”, phishing can be coupled with Given their importance, it is unfortunate that passwords network-based attacks or can incorporate techniques such are relatively easily stolen using a number of different as homograph domain names to create user experiences types of attack. We introduce HyperPass: an approach that are very difficult to differentiate from legitimate ones. and proof-of-concept system that aims to prevent some of Attacking hosts: By compromising a user’s machine, these attacks by moving passwords from a user’s normal passwords can be stolen directly in any of several operating environment into a secure hypervisor. Notably, ways, e.g., by examining HTTP post data, reading them this is done while maintaining compatibility with existing from browser password managers, or logging keystrokes. online services, applications, and operating systems. These techniques have been used by botnets (the Torpig botnet alone steals a password every second [30]) as well 1 Introduction as by off-the-shelf “spyware” which has even been pre- installed on rental computers [24]. While preventing Passwords are the linchpin of online security. Certainly, this sort of host compromise is an ongoing effort by both there are other major technologies involved in cyberse- industry and academia, it continues to be an elusive goal. curity. And certainly, stronger types of authentication Additionally, passwords have shortcomings stemming exist (e.g., hardware tokens, multifactor authentication, from the fact that they must be remembered [8]. This and cryptographic methods) [25]. However, in most case constraint leads many users to select “weak” passwords, it is largely just a string of seven or eight characters [4] which automated tools can brute-force in a tractable that keeps one user from pretending to be another when amount of time [30]. This also leads to many users reusing interacting with an increasing number of online services – passwords across services, meaning that an attacker who services which touch our lives in an increasing number of has stolen a single password for a user may have actually ways, from our personal lives, to our business practices, gained access to that user’s accounts on multiple services. to our banking and finances. Finally, passwords are replayable, but few users change Considering their importance, it is unfortunate that them regularly due to the burden of remembering new passwords are relatively easy to steal. Indeed, attackers ones. Making all of this worse: users may receive little or have a variety of ways of attaining passwords: no indication that their passwords have been stolen until Attacking servers: Attackers have been successful in it is too late. stealing passwords directly from the services for which In this paper, we introduce HyperPass – the primary the passwords are intended to protect access; indeed there purpose of which is to protect against host-based pass- have been a number of high-profile cases of this [31]. word theft while using unmodified operating systems, ap- Network-based attacks: In theory, Transport Layer plications, and online services. We do this by leveraging Security provides strong protection from passwords being a hypervisor-based approach that isolates passwords from “sniffed from the wire”. In practice, however, software the user’s operating system and applications. In addition, bugs [15] and compromised Certificate Authorities [29] we explore how HyperPass can be used to confront some have shown that it is not airtight. Clever attacks on TLS of the dangers of phishing, network-based attacks, and usage such as “SSL stripping” [18] weaken it further. other sources of password insecurity. 1 The remainder of this paper is organized as follows: been applied to virtual machines [23]. Overshadow [2] In §2 we examine some of the related work and its provides a twist: applications see their own resources as relationship to HyperPass. In §3, we explain the basic usual, but the operating system and other applications see architecture of HyperPass and its different components. those resources in an encrypted form. CloudTerminal [13] This is followed by a security analysis in §4. We describe proposes a “secure thin terminal” environment which our proof-of-concept implementation of HyperPass in §5 provides access to remote applications run by services, and evaluate its performance overhead in §6 before but isolated from the ordinary operating system. In concluding in §7. general, these approaches provide some number of isolated environments, with the idea that an attacker 2 Related Work may compromise one, but still be unable to access sensitive information in another environment. This One way to prevent credentials from falling into the isolation comes at a cost in terms of user experience – a wrong hands is to change their nature – moving from user must adjust the way in which he or she works to simple usernames and passwords (which can be stolen account for isolated user interfaces and limitations in and replayed) to something else. Various schemes have how data can be shared between these environments. been proposed and deployed in this vein [25], including HyperPass isolates along a different axis: instead of security tokens, smart cards, and biometric authentication. isolating applications from each other, we isolate just Often, these alternate approaches are used as part of passwords from everything else. In particular, this means Two-Factor Authentication [27], which requires some that existing applications can continue to share data just combination of a knowledge factor (such as a password), a as they always have – it is just that none of them can possession factor (such as a smart card), and an inherence access passwords. Additionally, where CloudTerminal factor (such as biometric data). Due to their recent requires the cooperation of services, HyperPass does widespread availability, cellular telephones are now often not. Recently, others have suggested storing only used as a possession factor, for example by Google [9] passwords in an isolated environment [3]. Conceptually, and banking websites. At a high level, our approach is this is very similar to HyperPass. Unlike HyperPass, similar to the above – prevent usable credentials from however, their method does not operate at the network falling into the wrong hands. However, our approach does level, requiring browser plugins or other changes to it not by altering the credentials themselves (which takes applications. Furthermore, the authors make no attempt the cooperation of both the user and the service provider) to support existing services or tackle any attacks except but by guarding existing credentials from attackers (which for key loggers. does not). Under the assumption that hypervisors can be made Like HyperPass, other systems attempt to hide pass- to securely isolate data on a machine (an assumption we words from malicious software. For example, password share), researchers have suggested a broad agenda for managers in general provide some protection against further research in the use of hypervisors to improve the key loggers, as passwords need not be typed over and security of personal computers, including a proposal for over. Some password managers, such as the one in authentication [32]. Indeed, our work is largely inspired Mozilla Firefox and Apple’s Keychain, store passwords by this agenda, though we stray from the “Hypervisor- in encrypted form so that a simple memory or disk Assisted Authentication” method it proposes, which dump will not expose them. Still others [1] attempt to requires cooperation of the operating system, applications, hide passwords “in plain sight” by saving thousands of and services, and instead focus on a more incremental decoy passwords along with real ones. Another method approach which does not require cooperation from any of – onscreen keyboards [10][12] – provides further key these. logger evasion. All such methods are relatively weak evasions: while the passwords may be entered or stored 3 HyperPass Design in a way that is resistant to some forms of inspection, eventually the passwords all pass through application We take cues from recent work [13,32] which explores code in their unencrypted form, at which point they are using a secure hypervisor to provide security improve- vulnerable. HyperPass, by contrast, keeps passwords ments to existing operating systems as discussed in §2. secret even from application code. Specifically, HyperPass necessitates two environments HyperPass has the most in common with other (Figure1). The first of these is a User environment which hypervisor-based security approaches. A security model runs all of a user’s existing software – their operating involving two machines – a “red” machine for general system, applications, and (potentially) password-stealing use and a “green” machine for accessing sensitive data malware. The second is the HyperPass environment – was articulated in [7], and this basic idea has since which stores passwords (and the HyperPass code itself). 2 applications in the User environment.1

Load more