Ninja: Towards Transparent Tracing and Debugging On
Total Page：16
File Type：pdf, Size：1020Kb
Ninja: Towards Transparent Tracing and Debugging on ARM Zhenyu Ning and Fengwei Zhang, Wayne State University https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ning This paper is included in the Proceedings of the 26th USENIX Security Symposium August 16–18, 2017 • Vancouver, BC, Canada ISBN 978-1-931971-40-9 Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIX Ninja: Towards Transparent Tracing and Debugging on ARM Zhenyu Ning and Fengwei Zhang Wayne State University fzhenyu.ning, [email protected] Abstract lar hardware components, and performance slowdown. The hardware-assisted virtualization technique [17, 50] Existing malware analysis platforms leave detectable fin- can improve the transparency of the virtualization-based gerprints like uncommon string properties in QEMU, systems; however, this approach still leaves artifacts on signatures in Android Java virtual machine, and arti- basic instruction execution semantics that could be easily facts in Linux kernel profiles. Since these fingerprints detected by malware [39]. provide the malware a chance to split its behavior de- To address this challenge, researchers study the mal- pending on whether the analysis system is present or ware on bare-metal devices via modifying the system not, existing analysis systems are not sufficient to ana- software [22, 37, 44, 55] or leveraging OS APIs [15, 56] lyze the sophisticated malware. In this paper, we pro- to monitor the runtime behavior of malware. Although pose NINJA, a transparent malware analysis framework bare-metal based approaches eliminate the detection of on ARM platform with low artifacts. NINJA leverages a the emulator or hypervisor, the artifacts introduced by the hardware-assisted isolated execution environment Trust- analysis tool itself are still detectable by malware. More- Zone to transparently trace and debug a target applica- over, privileged malware can even manipulate the anal- tion with the help of Performance Monitor Unit and Em- ysis tool since they run in the same environment. How bedded Trace Macrocell. NINJA does not modify system to build a transparent mobile malware analysis system is software and is OS-agnostic on ARM platform. We im- still a challenging problem. plement a prototype of NINJA (i.e., tracing and debug- This transparency problem has been well studied in ging subsystems), and the experiment results show that the traditional x86 architecture, and similar milestones NINJA is efficient and transparent for malware analysis. have been made from emulation-based analysis sys- tems [2, 40] to hardware-assisted virtualization analysis 1 Introduction systems [19, 20, 32], and then to bare-metal analysis sys- tems [30, 31, 41, 54]. However, this problem still chal- Malware on the mobile platform exhibits an explosive lenges the state-of-the-art malware analysis systems. growth in recent years. To solve the threat of the mali- We consider that an analysis system consists of an En- cious applications, a variety of tools have been proposed vironment (e.g., operating system, emulator, hypervisor, for malware detection and analysis [18, 22, 37, 44, 45, or sandbox) and an Analyzer (e.g., instruction analyzer, 52, 55, 56]. However, sophisticated malware, which is API tracer, or application debugger). The Environment also known as evasive malware, is able to evade the anal- provides the Analyzer with the access to the states of the ysis by collecting the artifacts of the execution environ- target malware, and the Analyzer is responsible for the ment or the analysis tool, and refuses to perform any ma- further analysis of the states. Consider an analysis sys- licious behavior if an analysis system is detected. tem that leverages the emulator to record the system call As most of the existing mobile malware analysis sys- sequence and sends the sequence to a remote server for tems [18, 45, 52] are based on emulation or virtual- further analysis. In this system, the Environment is the ization technology, a series of anti-emulation and anti- emulator, which provides access to the system call se- virtualization techniques [29, 36, 48] have been devel- quence, and both the system call recorder and the remote oped to challenge them. These techniques show that server belong to the Analyzer. Evasive malware can de- the emulation or virtualization can be easily detected tect this analysis system via anti-emulation techniques by footprints like string properties, absence of particu- and evade the analysis. USENIX Association 26th USENIX Security Symposium 33 To build a transparent analysis system, we propose 64-bit ARMv8 Exception Levels ARMv7 modes and PLs three requirements. Firstly, the Environment must be iso- Non-Secure state Secure state EL0 EL0 lated. Otherwise, the Environment itself can be manip- usr mode (PL0) ulated by the malware. Secondly, the Environment ex- Applications Applications EL1 EL1 fiq/irq/svc/abt/und/sys mode (PL1) ists on an off-the-shelf (OTS) bare-metal platform with- Rich OS Secure OS EL2 hyp mode (PL2) out modifying the software or hardware (e.g., emulation Hypervisor EL3 and virtualization are not). Although studying the anti- fiq/irq/svc/mon/abt/und/sys mode (PL3) emulation and anti-virtualization techniques [29, 36, 39, Secure monitor 48] helps us to build a more transparent system by fix- ing the imperfections of the Environment, we consider Figure 1: The ARMv8 and ARMv7 Architectures. perfect emulation or virtualization is impractical due to the complexity of the software. Instead, if the Environ- • We implement debugging and tracing subsystems ment already exists in the OTS bare-metal platform, mal- with a variety of program analysis functionalities. ware cannot detect the analysis system by the presence of NINJA is capable of studying kernel- or hypervisor- the Environment. Finally, the Analyzer should not leave level malware. The tracing subsystem exhibits a low any detectable footprints (e.g., files, memory, registers, performance overhead and the instruction and sys- or code) to the outside of the Environment. An Analyzer tem call tracing is immune to timing attacks. violating this requirement can be detected. 1 In light of the three requirements, we present NINJA , 2 Background a transparent malware analysis framework on ARM plat- form based on hardware features including TrustZone 2.1 TrustZone and Trusted Firmware technology, Performance Monitoring Unit (PMU), and Embedded Trace Macrocell (ETM). We implement a ARM TrustZone technology [12] introduces a hardware- prototype of NINJA that embodies a trace subsystem assisted security concept that divides the execution envi- with different tracing granularities and a debug subsys- ronment into two isolated domains, i.e., secure domain tem with a GDB-like debugging protocol on ARM Juno and non-secure domain. Due to security concerns, the development board. Additionally, hardware-based traps secure domain could access the resources (e.g., mem- and memory protection are leveraged to keep the use of ory and registers) of the non-secure domain, but not vice system registers transparent to the target application. The versa. In ARMv8 architecture, the only way to switch experimental results show that our framework can trans- from normal domain to secure domain is to trigger a parently monitor and analyze the behavior of the mal- secure exception [8], and the exception return instruc- ware samples. Moreover, NINJA introduces reasonable tion eret is used to switch back to the normal domain overhead. We evaluate the performance of the trace sub- from the secure domain after the exception is handled. system with several popular benchmarks, and the result Figure 1 shows the difference between the ARMv8 shows that the overheads of the instruction trace and sys- and the ARMv7 architectures. In the new architecture, tem call trace are less than 1% and the Android API trace ARM removes the execution modes in ARMv7 and re- introduces 4 to 154 times slowdown. names the Privilege Level (PL) to Exception Level (EL). The main contributions of this work include: The term EL indicates the level where an exception can be handled and all ELs except EL0 can handle excep- • We present a hardware-assisted analysis framework, tions. Any exception occurs in a certain level could only named NINJA, on ARM platform with low artifacts. be handled in the same level or a higher level. It does not rely on emulation, virtualization, or sys- The names of the system registers in 64-bit ARMv8 tem software, and is OS-agnostic. NINJA resides architecture contain a suffix that indicating the lowest in a hardware isolation execution environment, and EL at which the register can be accessed. For example, thus is transparent to the analyzed malware. the name of the PMEVCNTR EL0 register indicates that the lowest EL to access this register is EL0. Similarly, the • NINJA eliminates its footprints by novel techniques registers with suffix EL3 can only be accessed in EL3. including hardware traps, memory mapping inter- ARM Trusted Firmware [7] (ATF) is an official im- ception, and timer adjusting. The evaluation result plementation of secure domain provided by ARM, and demonstrates the effectiveness of the mitigation and it supports an array of hardware platforms and emula- NINJA achieves a high level of transparency. More- tors. While entering the secure domain, the ATF saves over, we evaluate the instruction-skid problem and the context of the normal domain and dispatches the se- show that it has little influence on our system. cure exception to the corresponding exception handler. 1ANINJA in feudal Japan has invisibility and transparency ability After the handler finishes the handling process, the ATF 34 26th USENIX Security Symposium USENIX Association restores the context of the normal domain and switches checking the values of these registers. By leveraging back with eret instruction. ATF also provides a trusted TrustZone technology, NINJA configures needed PMU boot path by authenticating the firmware image with sev- registers as secure ones so that even the privileged mal- eral approaches like signatures and public keys.