2

Is there any trusted (or sealed) execution environment for Linux that can guarantee the integrity of executable applications?

My use-case is like this:

I have an executable that reads a file and applies crypto operations on the file. The attack model is that the hosting system can be compromised by an attacker which can try to reverse engineer the executable or even probe memory. To ensure it does not happen, the executable needs to be executed in a trusted or sealed or isolated environment. Thought of using Intel SGX, but ruled out because it does not support I/O in the enclave. Any suggestion will be highly appreciated.

Thanks in advance.

  • How much familiar are you with Linux? – FarazX Aug 12 '16 at 15:22
  • I would say good working knowledge. Linux is my preferred development platform. – Ripul Aug 12 '16 at 15:33
  • So great, there are many possible things you can do depending on your needs. So tell us more about what you want, giving us an example would be awesome. – FarazX Aug 12 '16 at 15:34
  • Okay. My use-case is like this: I have an executable that reads a file and applies crypto operations on the file. The attack model is that the hosting system can be compromised by an attacker which can try to reverse engineer the executable or even probe memory. To ensure it does not happen, the executable needs to be executed in a trusted or sealed or isolated environment. Thought of using Intel SGX, but ruled out because it does not support I/O in the enclave. Any suggestion will be highly appreciated. Thanks. – Ripul Aug 12 '16 at 15:44
  • 2
    It sounds like you want to implement DRM or do something with the same threat model. In that case, if the attacker has complete access to the host (physical access, or the host is thoroughly root-kitted, etc), then there's nothing you can securely do without special hardware support (HSMs or Intel SGX possibly). The only thing you can do is try to delay the attacker with some obfuscation. – Macil Aug 13 '16 at 0:29
3

No, this is not possible. Not in Linux and not in any other computer environment. It isn't a limitation of Linux, it's a limitation of physics.

If you run your code on someone else's computer… it's their computer, so they control what runs on it. If they have your code then they can see it run, inspect its memory, make it do different things if they like. They can run your code in a virtual machine for easier debugging. You can try to detect that but whatever you do they can bypass by giving your program the right responses, if they're sufficiently motivated.

Intel SGX works because when I buy a processor with SGX, it isn't really my computer, it remains partially Intel's computer. Intel retains control over the software that runs in the SGX enclave. You ship code encrypted and signed with a key that belongs to Intel; the SGX enclave decrypts and verifies the code with a key that's only accessible by the enclave. The enclave doesn't belong to me, it belongs to Intel, hence if you don't want your code reverse-engineered you need to trust only Intel and not me. I only get an encrypted blob from you and I can't run it elsewhere because I can't decrypt it.

You can use SGX for applications that require I/O. You just have to split your application into two parts: the trusted part that runs in SGX, and the user interface (and storage backend) part that runs outside.

Keep in mind that defenses against reverse engineering are very expensive (in terms of debugging and support costs, and also development time and performance loss). Reverse engineering and modifying a program is expensive; it's usually cheaper to pay you to do the modification than to do it and maintain it in-house.

  • I understand your point. Now, I don't mind if the attacker can see the program running or even stop it. I also don't mind having a trust model with Intel. What I want is a defence against reverse engineering and memory probing. There are several research papers that reported success in reaching these goals (see, ref. 1 and 2). The problem is that these implementations are not publicly available. 1) Shielding Applications from an Untrusted Cloud with Haven, by Andrew Baumann et. al. 2) Virtual ghost: Protecting applications from hostile operating systems, by John Criswell et. al. – Ripul Aug 16 '16 at 14:38
  • @Ripul The problem with obfuscation systems is that they tend to be broken very quickly. In crypto the scheme designers are well ahead of the attackers, in obfuscation the attackers are ahead. As for the two papers you cite, at a glance they don't look like they would help. Virtual Ghost protects an OS from some compromises, but you have to trust the computer owner to run Virtual Ghost in the first place. Haven relies on SGX, this one might help if you decide to trust Intel (and wait for SGX to be commercially available to you, which is still a few years away). – Gilles Aug 16 '16 at 15:10
  • I agree with you. But that is fine, since I am the owner and I am trying to protect my application from an attacker who suddenly has access to my system. I am working in an academic project and I could live with Intel SGX emulation! The thing is that Haven from Microsoft is not publicly available! Thanks. – Ripul Aug 16 '16 at 17:11
1

So long as the attacker is unable to obtain ring -1, you could set up a hypervisor and use Bispe, from https://www1.informatik.uni-erlangen.de/bispe. It's experimental, but it seems like the closest software solution to what you are looking for. It will remain secure as long as the debug registers cannot be read by the attacker. It may take some slight modification to get it to run below ring 0, but it is not unworkable. If you don't expect the malware to be able to get ring 0 in the first place, but only probe memory by other means, then it should work out of the box.

Physical access to a system allows attackers to read out RAM through cold boot and DMA attacks. Thus far, counter measures protect only against attacks targeting disk encryption keys, while the remaining memory content is left vulnerable. We present a bytecode interpreter that protects code and data of programs against memory attacks by executing them without using RAM for sensitive content. Any program content within memory is encrypted, for which the interpreter utilizes TRESOR, a cold boot resistant implementation of the AES cipher. The interpreter was developed as a Linux kernel module, taking advantage of the CPU instruction sets AVX for additional registers, and AES-NI for fast encryption. We show that the interpreter is secure against memory attacks, and that the overall performance is only a factor of 4 times slower than the performance of Python. Moreover, the performance penalty is mostly induced by the encryption.

As for Intel SGX, even though it does not support I/O, that's not necessarily a game-stopper. I/O can be added to it provided you use the appropriate APIs. You could even run an entire QEMU instance in an SGX enclave, and I believe support for that is even being worked on.

  • Fantastic! I know that I/O can be added using an API but I/O needs to be carried out in untrusted zone. This means that to ensure securrity, file contents needs to be encrypted beforehand which is not possible for my use-case. But Bispe and the idea of QEMU inside an enclave seem quite promising. I will have a look at QEMU and Bispe and update at a later point how I have got along. Many thanks for the reference. – Ripul Aug 15 '16 at 11:59
  • “So long as the attacker is unable to obtain ring -1” — if you start with unrealistic assumptions, you can reach any conclusion… Here the adversary is the owner of the computer, so if they can install @Ripul's application, they can run it in whatever way they like. – Gilles Aug 16 '16 at 0:21
  • @Giles, I am not trying for any DRM. The owner is not the adversary per say according to my use-case. I am working for a use-case where the attacker has somehow managed to get some control of the system of the owner. – Ripul Aug 16 '16 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.