Hardware-Assisted Circumvention of Self-Hashing Software Tamper Resistance

P.C. van Oorschot; A. Somayaji; G. Wurster

doi:10.1109/tdsc.2005.24

IEEE Transactions on Professional Communication Feb 2005

Hardware-Assisted Circumvention of Self-Hashing Software Tamper Resistance

P.C. van Oorschot ; A. Somayaji ; G. Wurster

Abstract

Self-hashing has been proposed as a technique for verifying software integrity. Appealing aspects of this approach to software tamper resistance include the promise of being able to verify the integrity of software independent of the external support environment, as well as the ability to integrate code protection mechanisms automatically. In this paper, we show that the rich functionality of most modern general-purpose processors (including UltraSparc, x86, PowerPC, AMD64, Alpha, and ARM) facilitate an automated, generic attack which defeats such self-hashing. We present a general description of the attack strategy and multiple attack implementations that exploit different processor features. Each of these implementations is generic in that it can defeat self-hashing employed by any user-space program on a single platform. Together, these implementations defeat self-hashing on most modern general-purpose processors. The generality and efficiency of our attack suggests that self-hashing is not a viable strategy for high-security tamper resistance on modern computer systems.

Journal: IEEE Transactions on Professional Communication
Published: 2005-02-01
DOI: 10.1109/tdsc.2005.24
CompPile
Open Access: Closed
Topics: digital rhetoric
Export: BibTeX RIS

Citation Context

Cited by in this index (0)

No articles in this index cite this work.

References (43)

(2005)

Internet Explorer 6: Digital Certificates
10.1145/191177.191183

↗
10.1007/3-540-61996-8_49

↗
10.1007/3-540-47870-1_10

↗
10.1007/3-540-47870-1_9

↗

Show all 43 →

10.1109/SP.2005.2

↗
10.1007/3-540-68671-1_4

↗
10.1109/TSE.2002.1027797

↗
10.1007/10958513_1

↗
10.1007/10958513_27

↗
Wurster (2005)

A Generic Attack on Hashing-Based Software Tamper Resistance

↗
(2004)

UltraSPARC III Cu User’s Manual
(2004)

The Linux Kernel Archives
(2001)

Programming Environments Manual: For 32-Bit Implementations of the PowerPC Architecture
(2003)

AMD64 Architecture Programmer’s Manual. vol. 2, System Programming
(2003)

IA-32 Intel Architecture Software Developer’s Manual
(2005)

ARM Documentation—ARM Processor Cores
(2003)

IA-32 Intel Architecture Software Developer’s Manual, vol. 3: System Programming Guide, c…
(2005)

Homepage of PaX
(1998)

Alpha Architecture Handbook
Linn

Enhancing Software Tamper-Resistance Via Stealthy Address Computations
10.1007/3-540-68671-1_6

↗
10.1007/3-540-36415-3_26

↗
Gosler

Software Protection: Myth or Reality?
Kennell

Establishing the Genuinity of Remote Computer Systems
Loscocco

The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Envir…
Peinado (2005)

NGSCB: A Trusted Open System
10.1145/782814.782838

↗
10.1016/S1389-1286(98)00019-X

↗
(2004)

Trusted Computing Group
10.21236/ADA419599

↗
10.1145/643477.643479

↗
Shankar

Side Effects Are Not Sufficient to Authenticate Software
Kennell (2004)

An Analysis of Proposed Attacks against Genuinity Tests
10.1145/1030083.1030103

↗
10.1109/SECPRI.2004.1301329

↗
10.1145/1030083.1030125

↗
(2001)

Trusted Platfrom Module (TPM) Main Specification
Miretskiy

AVFS: An On-Access Anti-Virus File System
Nick

Copilot—A Coprocessor-Based Kernel Runtime Integrity Monitor
10.1007/3-540-44456-4_7

↗
Wang (2000)

A Security Architecture for Survivability Mechanisms

↗
(2001)

MIPS32 Architecture for Programming

CrossRef global citation count: 44 View in citation network → Build reading path →

Hardware-Assisted Circumvention of Self-Hashing Software Tamper Resistance

Abstract

Citation Context

Cited by in this index (0)

References (43)

Related Articles