Università degli Studi di
Trento
Trusted Flow for Malware
Protection
F. Massacci
(DIT - University of Trento - www.dit.unitn.it)
Università degli Studi di
Trento
Observation on Trust Boundaries
• Cheating Husbands and other stories (Fagin et al.)
• Corporate Network looks like an Harem
– Different hierachies of husbands (each with his privileges
and precious jewelry)
– Bulky Guards at the door
– Spies and mail surveilance and censorship
– Bedchamber boys
• Enter Laptops and mobility…
– Allow husbands to have sex in the (internet) bazar
– And then come back to harem carring malware with them…
– They can become zombies controlled from outside…
• Something clearly wrong here…
Università degli Studi di
Trento
Trusted Flow for Malware
• Solution: Cut mobility, tighten entrance rule
– Not really possible
– So we must allow sex in the bazar
• Solution: Check behavior of husband once inside
• Option 1: check clothes are untainted
– Digitally signed assemblies/software (eg .NET)
– Not very good: show clean clothes at the door, use
completely dirty dresses (eg latest rootkit, recent IAT attack
on .NET by UniTN)
• Option 2: trusted flow for Malware
Università degli Studi di
Trento
Implementing Trusted Flow for Malware
• Inoculation of Vaccines into husbands
–
–
–
–
Injecting trusted flow into important sw once inside
Give husbands obfuscated drinks on wedding day
if vaccine spots keep appearing (trusted flow) fine
else repudiate husband (isolate laptop from network)
• Unfortunately…
– Smart husbands can always reverse engineer software
– Can tell original drink from inoculated drink
– Can make their own anti-vaccines: give spots even if
misbehaving
Università degli Studi di
Trento
Implementing Trusted Flow for Malware 2
• Fortunately…
– Normal husbands can only buy ready-made (automated) antivaccines from the bazar
– Smart husbands aren’t many and have better things to do
• than making anti-vaccines (or having sex in the bazar for that matter)
• Objective: keep normal husbands from misbehaving
– Vaccines should be unique to each husband
– Vaccines should require human intervention for removal or
bypassing