TY - GEN
T1 - Hart
T2 - 25th European Symposium on Research in Computer Security, ESORICS 2020
AU - Du, Yunlan
AU - Ning, Zhenyu
AU - Xu, Jun
AU - Wang, Zhilong
AU - Lin, Yueh Hsun
AU - Zhang, Fengwei
AU - Xing, Xinyu
AU - Mao, Bing
N1 - Publisher Copyright:
© Springer Nature Switzerland AG 2020.
PY - 2020
Y1 - 2020
N2 - While the usage of kernel modules has become more prevalent from mobile to IoT devices, it poses an increased threat to computer systems since the modules enjoy high privileges as the main kernel but lack the matching robustness and security. In this work, we propose HART, a modular and dynamic tracing framework enabled by the Embedded Trace Macrocell (ETM) debugging feature in Arm processors. Powered by even the minimum supports of ETM, HART can trace binary-only modules without any modification to the main kernel efficiently, and plug and play on any module at any time. Besides, HART provides convenient interfaces for users to further build tracing-based security solutions, such as the modular AddressSanitizer HASAN we demonstrated. Our evaluation shows that HART and HASAN incur the average overhead of 5% and 6% on 6 widely-used benchmarks, and HASAN detects all vulnerabilities in various types, proving their efficiency and effectiveness.
AB - While the usage of kernel modules has become more prevalent from mobile to IoT devices, it poses an increased threat to computer systems since the modules enjoy high privileges as the main kernel but lack the matching robustness and security. In this work, we propose HART, a modular and dynamic tracing framework enabled by the Embedded Trace Macrocell (ETM) debugging feature in Arm processors. Powered by even the minimum supports of ETM, HART can trace binary-only modules without any modification to the main kernel efficiently, and plug and play on any module at any time. Besides, HART provides convenient interfaces for users to further build tracing-based security solutions, such as the modular AddressSanitizer HASAN we demonstrated. Our evaluation shows that HART and HASAN incur the average overhead of 5% and 6% on 6 widely-used benchmarks, and HASAN detects all vulnerabilities in various types, proving their efficiency and effectiveness.
UR - http://www.scopus.com/inward/record.url?scp=85091560404&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85091560404&partnerID=8YFLogxK
U2 - 10.1007/978-3-030-58951-6_16
DO - 10.1007/978-3-030-58951-6_16
M3 - Conference contribution
AN - SCOPUS:85091560404
SN - 9783030589509
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 316
EP - 337
BT - Computer Security – ESORICS 2020 - 25th European Symposium on Research in Computer Security, Proceedings
A2 - Chen, Liqun
A2 - Schneider, Steve
A2 - Li, Ninghui
A2 - Liang, Kaitai
PB - Springer Science and Business Media Deutschland GmbH
Y2 - 14 September 2020 through 18 September 2020
ER -