Reading List

A policy is presented that is designed to prevent different workloads from running on a given system at the same time. The motivation for this policy comes from the comercial world where there is a business interest or law that prevents the disclosure of insider information. The policy is compared with BLP and a conclusion is made that the chinese wall policy cannot be modeled with BLP. It seems that the main functionality needed that's missing in BLP is the ability to dynamically change need-to-know access lists.

Introduces the idea of multi-shadow cloaking where one virtual address is represented by multiple physical addresses. This way you can keep encrypted and decrypted versions of the each page. Using the Overshadow system, you can then have an application's memory completely hidden from it's underlying OS, protecting it from a variety of attacks even when the OS isn't trusted.

This requires that the VMM is trusted. And it also assumes that you are only interested in protecting the application from the OS reading and/or modifying its information. The OS can still perform denial of service and perhaps other types of attacks.

This system is very interesting. It tries to extend some trust from the VMM to the applications, while completely ignoring the OS. I wish that the paper did a better job of explaining exactly how much trust they can provide in the applications, and what these means with regards the type of applications that can be run in this space. The intro casts a wide net by listing a lot of applications domains, but it is not immediately clear that this technique would be applicable to all of those domains.

Overall an interesting paper as it presents a useful and non-obvious technique. And this is very clearly written so it can be read quickly.

This article provides a brief introduction to Cyclone. Cyclone is interesting to me because it is a low-level type-safe language. It is intended to be used for applications that would normally be written in C (or perhaps C++). So this opens the door to having an operating system written in a type-safe language. And this, in my opinion, would be a huge win from a security point of view as it would basically eliminate buffer overflows and other classes of vulnerabilities from the kernel. The end result would be a kernel that is both more secure and less buggy.

When a page in memory is marked as invalid (i.e., present bit is set to zero), there may still be more information to discover. Previous efforts in memory analysis have essentially stopped at this step, but this paper shows how to follow the path to find pages that may be in a swap file, or in some other location in memory. Low-level implementation details are given for the various scenarios.

Builds an argument using probability of failure and failure of host compromise to show that VMMs have an important role to play in systems security. The paper argues that using a VMM to isolate different processes improves the security over running the processes on a single OS.

This article presents a toolkit that can be used for forensic investigation of volitale memory images (e.g., the physical memory image you get using dd to collect from /dev/mem). One particularly interesting contribution is an automated technique for extracting type definitions from C code. The article show how this process works and the authors indicate that they have it working for the linux kernel (2.4 series). Other contributions include the overall toolkit architecture, extensible modules, and memory visualization (although the visualization is really just a view into the raw memory space and not a visualization per se).

This paper presented several invariants that can be used for windows memory analysis. Specifically, it is looking at invariants that are usful for finding processes and threads by doing an exhaustive scan of the memory space. A proof of concept of these techniques was created with the PTfinder tool. These techniques are complimentary to following linked list data structures (e.g., kntlist tool).

This paper presents the construction of a small hypervisor whose purpose is to protect the integrity of an operating system's kernel code. The hypervisor is intentially kept very simple, only running one OS and only serving this single protection purpose. This work makes extensive use of AMD's SVM extensions, which provides the necessary security functionality to support the hypervisor. I feel that this paper offers a nice introduction to the capabilities of SVM and provides good insight into the design decisions that one much make when construction such a system. However, the end result is perhaps only useful as a proof of concept. Ideally, one would want this functionality to not exclude the use of a full featured hypervisor on the same system.