SHARK: Architectural support for autonomic protection against stealth by rootkit exploits

Rootkits have become a growing concern in cyber-security. Typically, they exploit kernel vulnerabilities to gain root privileges of a system and conceal malware’s activities from users and system administrators without any authorization. Once infected, these malware applications will operate completely in stealth, leaving no trace for administrators and anti-malware tools. Current anti-rootkit solutions try to either strengthen the kernel by removing known vulnerabilities or develop software tools at the OS or Virtual Machine Monitor levels to monitor the integrity of the kernel. Seeing the failure of these software techniques, we propose, in this paper, an autonomic architecture called SHARK, or Secure Hardware support Against RootKit by employing hardware support to provide system-level security without trusting the software stack, including the OS kernel. SHARK enhances the relationship between the OS and the hardware architecture, making the entire system more security-aware in ...

• Type: Conference
• Year: 2008
• Where: MICRO
• Authors: Vikas R. Vasisht, Hsien-Hsin S. Lee
• Keywords: Conceal Malware, Hardware, MICRO 2008, Rootkits, SHARK