KR102022168B1 - Apparatus and methods for detecting of stealth task using hardware task switching - Google Patents

Abstract

A hidden task monitoring and treatment method for a computing device performed in a hardware task switchable computing device disclosed herein may include reading a table from storage related to control of hardware task switching, storing a copy of the table into storage, Comparing the table with a copy of the table, determining whether the table has changed, and if it is determined that the table has changed, performing a predetermined processing method.

Description

{APPARATUS AND METHODS FOR DETECTING OF STEALTH TASK USING HARDWARE TASK SWITCHING}

The present disclosure relates to a method and apparatus for detecting and treating a hidden task performed using hardware task switching in a computing device by a malicious attack by an attacker.

In public networks such as the Internet and private networks inside an enterprise, a plurality of client terminals are connected, and when one client terminal is infected with malicious code, other client terminals may be infected with the same malicious code. In addition, it is necessary to monitor a program installed or executed on a client terminal. Common malicious codes gain the authority of the client terminal to damage or encrypt important files of the client terminal or transmit them to the outside of the terminal.

Existing vaccines that monitor malicious code intrusions into client terminals such as viruses, ransomware, and worms from the network mainly use a method of detecting and deleting known rootkits.

However, if an attacker who has gained administrator privileges through a rootkit executes a hidden task that cannot be detected by an operating system, the existing vaccine deletes the rootkit and cannot detect or terminate the hidden task.

In this way, when an attacker executes a concealment task, a file change or damage to a user's terminal device can be performed without being detected by a conventional general vaccine. There is a problem in that the attacker can use the resources of his own.

Patent Application Publication No. 10-1366554, 2014.2.18

As a prior art, an attack method for generating a hidden task that cannot be detected by an operating system has not been known, but through experiments, there is a method of generating such a hidden task. Thus, the present invention uses hardware task switching. The present invention proposes a method and apparatus for detecting whether a hidden task is generated that cannot be detected by an operating system and treating the same.

Problems to be solved by the present invention are not limited to the above-mentioned problems, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

The present disclosure provides a method for concealment task monitoring and treatment of a computing device performed in a computing device capable of hardware task switching. The method for monitoring and treating hidden tasks of the computing device includes reading a table from storage related to control of hardware task switching; Storing a copy of the table on storage; Comparing the table with a copy of the table to determine whether the table has been changed; And if it is determined that the table has been changed, performing a predetermined processing method.

The method and other embodiments may include the following features.

The computing device is based on Intel Architecture-32 (IA-32), and the table related to the control of the hardware task switching may be a Global Descriptor Table (GDT) or a Task State Segment (TSS). The determining of whether or not the table is changed may determine that the table is changed when a Task State Segment (TSS) descriptor is changed or added or when an EIP value of the TSS is changed. If it is determined that the table has been changed, the method may further include retrieving and patching execution code of a concealment task and restoring the changed table by using a copy of the table.

Other specific details of the invention are included in the detailed description and drawings.

According to embodiments disclosed herein, when an attacker executes a hidden task through hardware task switching, it can detect and treat it.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a view showing the configuration of the hidden task monitoring and treatment system according to an embodiment of the present invention.
2 is a diagram showing an experimental result of the feasibility of concealment task through hardware task switching.
3 is a flowchart illustrating a hidden task monitoring and treatment method according to an embodiment of the present invention.
4 and 5 are diagrams illustrating a relationship between a GDT, an IDT, an LDT, and a TSS according to an embodiment of the present invention.
6 is a diagram illustrating an IA-32 based TSS structure.

The techniques disclosed herein may be applied to methods of concealment task monitoring and treatment of computing devices. However, the technology disclosed herein is not limited thereto, and may be applied to all electronic devices and methods to which the technical spirit of the technology may be applied.

It is to be noted that the technical terms used herein are merely used to describe particular embodiments and are not intended to limit the spirit of the technology disclosed herein. In addition, the technical terms used herein should be construed as meanings generally understood by those skilled in the art to which the technology disclosed herein belongs, unless defined otherwise in this specification. It should not be interpreted in a comprehensive sense, or in an overly reduced sense. In addition, when the technical terms used herein are incorrect technical terms that do not accurately express the spirit of the technology disclosed herein, technical terms that can be properly understood by those skilled in the art to which the technology disclosed herein belongs. It should be replaced by. In addition, the general terms used herein should be interpreted as defined in the dictionary, or according to the context before and after, and should not be interpreted in an excessively reduced sense.

As used herein, terms including ordinal numbers such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, and the same or similar components will be given the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted.

In addition, in describing the technology disclosed herein, if it is determined that the detailed description of the related known technology may obscure the gist of the technology disclosed herein, the detailed description thereof will be omitted. In addition, it is to be noted that the accompanying drawings are only for easily understanding the spirit of the technology disclosed in this specification, and the spirit of the technology should not be construed as being limited by the accompanying drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary block diagram of a hidden task monitoring and treatment apparatus. The hidden task monitoring and treatment apparatus disclosed herein may be configured of a control unit 110, a monitoring unit 120, a storage unit 130, and a communication unit 140.

The controller 110 and the monitor 120 may include all kinds of devices capable of processing data, such as a processor. Here, the 'processor' may refer to a data processing apparatus embedded in hardware having, for example, a circuit physically structured to perform a function represented by code or instructions included in a program. As an example of a data processing device embedded in hardware, a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, and an application-specific integrated ASIC may be used. It may include a processing device such as a circuit, a field programmable gate array (FPGA), but the scope of the present invention is not limited thereto.

The hidden task monitoring and treatment apparatus may be implemented in a computing device capable of hardware task switching.

A task is a unit of work that allows a processor to dispatch, allocate, suspend, suspend, or execute, for example, IA-. The 32 (Intel Architecture- 32) based processor provides a mechanism for task storage, task dispatch for execution, and task switching.

When the processor is operating in protected mode, the execution of the process occurs within the task, which consists of two components: the task execution space and the task state segment (TSS). The task execution space consists of code segments, stack segments, one or more data segments. Complex systems can perform multi-tasking using the processor's task management functions, in which case the TSS can provide a task-linking mechanism.

An operating system that supports multitasking may dispatch and perform a plurality of tasks as long as the resources of the system allow, and for this purpose, a method of switching each task may be used.

As an example of a task switching method, a preemptive type of task switching may allow another task to preempt the central processing unit even if the task of the task being performed is not completed. That is, no matter what the situation while the task is running, you can stop the task once and start again from where other tasks were previously performed.

In detail, all register values of a task performed in the CPU are stored, and the register values of the previously executed task are stored in the CPU and resumed from the point where they stopped.

Certain central processing units provide a hardware task switching mechanism for task switching, in which case they also use TSS. TSS is a data segment that describes the state of the CPU associated with a particular task. That is, the TSS selector of TSS, which stores the task to be performed by the hardware LTR instruction, is stored in the TR register, and the central processing unit refers to the GDTR and TR register, and the TSS descriptor existing in the GDT (Global Descriptor Table). (Descriptor) is used to refer to the actual TSS region. The TSS region may be configured in a structure capable of recording all registers required for the execution of the CPU, and task switching may be performed by storing and reloading previous task information in the structure. In other words, as an example, a TSS selector may be designated through a simple JMP command to automatically perform task switching. In addition, a task switching using a CALL may be present.

Software Task Switching, on the other hand, saves and reloads only the state that needs to be changed, and saves the current stack pointer and reloads the new stack pointer. Can be performed.

When implemented in a computing device capable of hardware task switching, the controller 110 may read a table related to control of hardware task switching from the storage 130 and store a copy thereof in the storage 130.

The storage unit 130 temporarily or permanently stores data processed by the control unit 110 or the monitoring unit 120, and stores state data of the central processing unit of the hidden task monitoring and treatment unit and data necessary for task switching. Includes features The storage unit 130 may include a magnetic storage media or a flash storage media, but the scope of the present invention is not limited thereto. In addition, the storage unit 130 may be implemented as an active memory or an inactive memory.

In one embodiment, the storage unit 130 may be divided into a general storage and a secure storage having a higher security level than the general storage. The secure store may store data needed for the concealment task monitoring and treatment task to be performed. Such a secure storage may be implemented in the form of a secure environment with a control unit as well as a storage unit. For example, the execution environment of a general task is an execution environment having a low security level, and may be called, for example, a rich execution environment (REE). In addition, a secure execution environment that is distinguished from a general execution environment is an execution environment having a high security level, for example, may be referred to as a trusted execution environment (TEE). The secure execution environment may, for example, store data requiring a relatively high security level in a secure environment and perform related operations.

The monitor 120 may read the table related to the control of the task switching periodically in the memory and allow the controller 110 to determine whether the table has been changed. The controller 110 may retrieve the execution code of the concealment task and restore the changed table when the changed code is compared with the previously stored copy of the table.

Based on a specific architecture, hardware task switching mechanisms exist for backwards compatibility but in practice task switching mechanisms can only apply software task switching mechanisms. In this case, if an attacker gains administrator rights (Ring 0) and runs a hardware task switching mechanism to execute a new task, the operating system cannot detect the execution of the task (hidden task) even by the usage of the central processing unit. There is a problem.

For example, in an IA-32-based Microsoft Windows operating system, a driver loaded with an attacker's code containing a TSS structure is loaded to obtain Ring 0 permission, and the timer value is set for software task switching and hardware task switching as shown in FIG. When the tasks of the corresponding method are performed simultaneously, it can be confirmed that the task through the hardware task switching is not measured even by the usage measurement of the central processing unit of Windows as shown in the right screen of FIG.

The hidden task monitoring and treatment apparatus of the present specification may include a communication unit, and the communication unit may perform communication with external devices through a network. The network may be, for example, a wireless network, a wired network, a public network such as the Internet, a private network, a global system for mobile communication network (GSM) network, a general packet radio network (GPRS). ), Local area network (LAN), wide area network (WAN), metropolitan area network (MAN), cellular network, public switched telephone network (PSTN), private Network, personal area network, Bluetooth, Wi-Fi Direct, Near Field communication, UltraWide band, combinations thereof, or any other network, but It is not limited to.

The communication unit 140 may be configured as a wired and / or wireless communication module. For example, the communication unit 140 may include Wi-Fi (Wireless Fidelity, Wi-Fi), Bluetooth, Zigbee, near field communication (NFC), and Wi-Fi (Wireless Broadband Internet: Wibro). It may include a wireless communication module and a wired communication module such as a wired LAN such as Ethernet. The communication unit 140 may perform wired or wireless communication with an external device through a network.

3 is a flowchart illustrating the operation of the hidden task monitoring and treatment apparatus.

Referring to FIG. 3, the hidden task monitoring and treatment apparatus may read a table related to control of hardware task switching from a storage device (S301) and store a copy of the table to the storage device (S302).

As described above, TSS, which is a data segment describing the state of the CPU related to a specific task, can be used for switching hardware tasks. In this case, the TSS area is a structure that can record all the registers required to perform the CPU. It can be configured, and task switching can be performed by storing and reloading previous task information in this structure.

Therefore, the IA-32 based central processing unit can perform hardware task switching control by referring to and using the actual TSS region using the TSS descriptor present in the GDT, thus concealing it as an embodiment of the present invention. The task monitoring and treatment device may read a Global Descriptor Table (GDT) from the storage device and store a copy thereof.

 In another embodiment, the hidden task monitoring and treatment apparatus may read TSS data from storage and store a copy thereof as a direct table associated with control of hardware task switching.

The stealth task monitoring and treatment apparatus reads a table related to control of hardware task switching periodically or aperiodically (S303) and compares it with a copy of a prestored table, and compares the table for execution of the stealth task through malicious hardware task switching of an attacker. It may be determined whether the change has been made (S304).

For example, in the case of an IA-32-based central processing unit, if an attacker switches hardware tasks using the 'Jump 0x50' command, the central processing unit stores the current state register value for task switching and the 0x50 value of the GDT. You can switch to another task by referring to the base address value of the TSS descriptor. In this case, if the attacker changes the ESS value of TSS to the address of another task that the attacker wants before executing the command of 'Jump 0x50', the central processing unit executes the task that the attacker wants and the task is hidden and the operating system Can not be detected.

Therefore, the concealment task monitoring and treatment apparatus may compare the value of the prestored GDT or TSS and determine that the concealment task is operated when the value is previously stored.

In one embodiment, in the case of the IA-32-based CPU, the hidden task monitoring and treatment apparatus may refer to a pre-stored table, and if the TSS descriptor value is changed, if the TSS descriptor is added, the EIP value of the TSS may be changed. If it is changed, it may be determined that the concealment task operates.

As another example, when the TSS descriptor is changed or added using hardware debugging, the CPU may trigger an exception and determine whether to change the TSS descriptor.

The hidden task monitoring and treatment apparatus may perform a predetermined processing method when it is determined that the hidden task exists. In one embodiment, the hidden task monitoring and treatment device may terminate the hidden task or retrieve the execution code of the hidden task (Patch) for it (S305).

For example, if the above-mentioned attacker detects 'Jump 0x50' command code for switching hardware tasks, it can be deleted.

In addition, the hidden task monitoring and treatment apparatus may unload the device driver associated with the execution code of the concealment task to block a risk caused by the same concealment task that may occur later.

The hidden task monitoring and treatment apparatus may restore the changed table based on the copy of the previously stored table (S306).

For example, if the TSS descriptor value or the EIP value of the TSS is changed, it can be changed back to the original value, or deleted if the TSS descriptor is added. According to an embodiment, the stealth task monitoring and treatment apparatus may perform an operation of restoring a table before or after performing the patch operation S305 of the execution code.

The hidden task monitoring and treatment method according to the embodiments disclosed herein may be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the techniques of this specification pertain.

Preferred embodiments of the technology of the present disclosure have been described with reference to the accompanying drawings. Here, the terms or words used in the present specification and claims should not be construed as being limited to ordinary or dictionary meanings, but should be construed as meanings and concepts corresponding to the technical spirit of the present invention.

The scope of the present invention is not limited to the embodiments disclosed herein, and the present invention may be modified, changed, or improved in various forms within the scope of the spirit and claims of the present invention.

110: control unit
120: monitoring unit
130: storage unit
140: communication unit

Claims (6)

A method performed in a computing device capable of switching hardware tasks,
Reading a table from storage related to control of hardware task switching;
Copying the table read from the storage device and storing the table in the storage device as a copy table;
A step performed after storing the copy table, reading the table from a storage device and comparing the copy table with the table to determine whether the table has been changed; And
Performing a predetermined processing method when the copy table is determined to be changed after the copy table is stored;
Hidden task monitoring and treatment method of a computing device comprising a. According to claim 1,
The computing device is based on Intel Architecture-32 (IA-32), and a table related to the control of the hardware task switching is a global descriptor table (GDT) or a task state segment (TSS). And methods of treatment. The method of claim 2,
And determining that the table is changed when a task state segment (TSS) descriptor is changed or added, or when an EIP value of the TSS is changed. The method of claim 3, wherein
If it is determined that the table has been changed, searching for and patching the execution code of the concealment task. The method of claim 4, wherein
And after the copying table is stored, if it is determined that the copying table has been changed, restoring the changed table using the copying table. A computer-readable recording medium having recorded thereon a program for implementing the method of any one of claims 1 to 5.

Images