Jonathon Giffin
University of Wisconsin, Madison
USA

Mihai Christodorescu
University of Wisconsin, Madison
USA

Shai Rubin
University of Wisconsin, Madison
USA

Vinod Ganapathy
University of Wisconsin, Madison
USA

Hao Wang
University of Wisconsin, Madison
USA

Recent research has proposed self-checksumming as a method by which a program can detect any possibly malicious modification to its code. Wurster et al. developed an attack against such programs that enables code modifications undetectable to any self-checksumming routine. In particular, the attack replicated pages of program text and altered values in hardware data structures so that data reads and instruction fetches retrieved values from different memory pages. A cornerstone of their attack was its applicability to a variety of commodity hardware: they could alter memory accesses using only a malicious operating system. In this paper, we show that their page-replication attack can be detected by self-checksumming programs with self-modifying code. Our detection is efficient, requiring less than 1 microsecond in our experiments, and is robust up to attacks using either costly interpretive emulation of all memory write operations or specialized hardware.

Keywords: Tamper resistance, self-checksumming, self-modifying code, attack detection

Read Paper (in PDF)