BlackHat资料us-14-Muttik-Creating-A-Spider-Goat-Using-Transactional-Memory-Support-For-Securitypdf.pdfVIP

CREATING A SPIDER GOAT: USING TRANSACTIONAL MEMORY SUPPORT FOR SECURITY Igor Muttik | PhD Alex Nayshtut | CISSP-ISSAP Roman Dementiev | PhD Introducing Spider Goat… Spider Pig + Sacrificial Goat = Spider Goat Agenda • Monitoring memory • Transaction synchronization problem • What is TSX? • Can we use TSX for security? • Demo – detecting unauthorized memory changes • Potential applications: advantages and challenges • Memory monitoring approaches • Conclusions Monitoring Memory for Changes 1) Reading protected RAM cells in a loop • Malicious code (e.g. shellcode) may have time to disable security • CPU intensive • No reverting of changes 2) Setting up exceptions on memory pages (4k) • Mark protected pages read-only – any write creates a page fault • Software then has to check what exactly was changed • Reverting changes requires storing original data (up to 2*RAM) 4 Transaction Synchronization Problem • Multiple threads accessing the same database record Alice is a scenario very common in database software! • Example: $ $1000 $1000 • Alice has $1000 in a database record in her account as a total value $1100 • Bob wants to transfer $100 to Alice • Carol also wants to transfer to Alice but $50 • Depending on timing of reads and writes the end result may be either $1100 or $1050 or $1150 + $100 + $50 • Typica