Nighthawk: Transparent System Introspection from Ring -3

Abstract

During the past decade, virtualization-based (e.g., virtual machine introspection) and hardware-assisted approaches (e.g., x86 SMM and ARM TrustZone) have been used to defend against low-level malware such as rootkits. However, these approaches either require a large Trusted Computing Base (TCB) or they must share CPU time with the operating system, disrupting normal execution. In this paper, we propose an introspection framework called Nighthawk that transparently checks system integrity at runtime. Nighthawk leverages the Intel Management Engine (IME), a co-processor that runs in isolation from the main CPU. By using the IME, our approach has a minimal TCB and incurs negligible overhead on the host system on a suite of indicative benchmarks. We use Nighthawk to check the integrity of the system software and firmware of a host system at runtime. The experimental results show that Nighthawk can detect real-world attacks against the OS, hypervisors, and System Management Mode while mitigating several classes of evasive attacks.

L. Zhou—Work was done while visiting COMPASS lab at Wayne State University.

Appendices

A Appendix: Intel ME

An overview of system components and the IME is shown in Fig. 7.

Fig. 7.

Adapted from Ruan [33]

Overview of the IME. We use its isolation features to provide transparent system introspection capabilities. The left shows the IME in relation to other parts of a host system. The right shows the IME’s memory layout on our prototype.

B Appendix: Code added in Intel IME

Properties of our custom IME added code are shown in Table 5. All told, we wrote 400 lines of new C code and 270 lines of new assembly code, all of which fit in an IME firmware image less than 2 KB in size.

Table 5. Introspection code added in custom IME firmware

C Appendix: Remote Communication Protocol

Here we present the details about remote communication protocol between remote server and IME in target machine.

Table 6. Communication commands in Nighthawk, each consisting of an operation and corresponding object. Any Command can be combined with any Object.

D Appendix: Performance of the IME Core

We run experiments to investigate the computational capabilities of the IME. In particular, we develop a CPU speed testing benchmark, which we inject into the memcpy function in the IME. That is, this benchmark executes every time memcpy is invoked. The testing program is a nested-loop (inner loop: n, outer loop: m) function with 15 instructions in the inner loop such that $n\times m=10^6$. We read the time stamp counter at the beginning and the end of the benchmark—denoted as $T_1$ and $T_2$, and thus approximate the average speed of the IME CPU using the formula $v\approx \frac{15\times 10^{6}\times (n\times m)}{(T_2-T_1)}$. We sweep $n = {100,200,...,10000}$ and $m = {100,200,1000}$; the experimental result shows that the IME CPU executes approximately 15 million instructions each second. Compared to the target system’s main CPU (which can execute billions of instructions per second), the IME CPU has a significantly lower performance.