PowerPoint Presentation

Size: px

Start display at page:

Download "PowerPoint Presentation"

호근 황
5 years ago
Views:

1 GPU-based Keylogger Jihwan yoon

2 Index Who am I Keylogger, GPU GPU based Keylogging - Locating the keyboard buffer - Capturing KEYSTROKES Demo

3 About me

4 Who am I 윤지환 CERT-IS reader BOB 3 rd Interested in - System Hacking - bug-hunting 131ackcon@gmail.com

5 Who am I Project

6 2013 : 논문공개 (You Can Type, but You Can t Hide: A Stealthy GPU-based Keylogger) 2015 : POC 공개 (GPU rootkit & GPU keylogger)

7 공개된 POC 는실행 X, 문법 X 진짜개념만증명한코드, 작성하다가만코드 ( 물론공개안된부분도있을듯 ) 처음부터다키로거를제작하는것이빠르다.

8 Keylogger

9 Keylogger 사용자의입력을훔쳐보는프로그램 탐지될가능성이크다. 1. Software keylogger 1) User-level - API(GetAsyncKeyState ) 2) Kernel-level - SYSCALL, Driver Functions 2. Hardware keylogger - BIOS-level, firmware, wireless sniffers, device plugged inline

10 GPU

11 GPU(Graphics Processing Unit) 2D 핸들링, 3D 그래픽랜더링에사용되며, CPU 의부담을줄여준다. 전용그래픽카드, 통합그래픽솔루션, 내장그래픽, 가속처리장치 Graphics API : OpenCL, CUDA. DirectX

12 CPU vs GPU Architecture Control ALU ALU ALU ALU Cache DRAM DRAM CPU GPU

13 CPU vs GPU Architecture

14 GPU based Keylogging

15 < 요구사항 > Nvidia 나 AMD 그래픽카드 (Intel 이 AMD 의 SDK 지원 ) <Component> Host Process -> 키보드버퍼의주소를메인메모리에위치시키는작업 (page table 변조 ) GPU -> DMA 를통해키보드버퍼를모니터링

16 GPU Code Kernel Module 4. 키로거시작 3. 페이지테이블엔트리조작 2. 페이지스캔 Controller Process 1. 버퍼할당 Scanner 모니터링 부트스트랩조작

17 GPU Code Kernel Module 4. 키로거시작 3. 페이지테이블엔트리조작 2. 페이지스캔 Controller Process 1. 버퍼할당 Scanner Locating the keyboard buffer(1,2) 모니터링 부트스트랩조작

18 GPU Code Kernel Module 4. 키로거시작 3. 페이지테이블엔트리조작 2. 페이지스캔 Controller Process 1. 버퍼할당 Scanner Capturing Keystrokes(3,4) 모니터링 부트스트랩조작

19 1. Locating the Keyboard buffer Target : USB type keyboard 키보드버퍼는 URB(USB Request Block) 멤버변수인 transfer_buffer 에저장 키보드버퍼를찾기위해메모리스캔하는 LKM(Loadable Kernel Module) 구현

20 1. Locating the Keyboard buffer URB(usb request block) in linux/usb.h

21 1. Locating the Keyboard buffer struct usb_device *dev void *transfer_buffer dma_addr_t *transfer_dma u32 *transfer_buffer_length URB(usb request block) in linux/usb.h

22 1. Locating the Keyboard buffer USB Device Structure - 0x400 boundary transfer_dma - 0x20 boundary Product field - (USB type : "usb" && "keyboard ) (wireless type : "usb" && "reciever ) transfer_buffer_length - 8byte transfer_buffer - Scan code값저장 ( 입력없을경우 null)

23 1. Locating the Keyboard buffer USB Device Structure - 0x400 boundary transfer_dma - 0x20 boundary Product field - (USB type : "usb" && "keyboard ) (wireless type : "usb" && "reciever ) transfer_buffer_length - 8byte transfer_buffer - Scan code값저장 ( 입력없을경우 null)

24 2. Capturing Keystrokes Modifier keys (Shift, Alt, Ctrl) Raw Scan Codes urbp->transfer_buffer Buffer[0] Modifier keys(shift, Alt, Ctrl), Buffer[1] no special use, Buffer[2] ~ buffer[5] Raw Scan Code Key Pressed : 다음입력이이루어질때까지남아있는다. Error state : Buffer[0] ~ [1] 은 1, 나머지는 0 으로채워진다.

25 2. Capturing Keystrokes Allocate Modification Page Table 1) Monitoring 2) Release the memory GPU CPU NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

26 2. Capturing Keystrokes Host Processor Virtual Page Table Original Page table Physical Original Keyboard buffer NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

27 2. Capturing Keystrokes Host Processor Virtual Page Table Keyboard buffer Physical Original Keyboard buffer NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

28 2. Capturing Keystrokes Host Processor Virtual Page Table Keyboard buffer Physical Keyboard buffer GPU cudahostgetdevicepointer( 0x , ~~~) NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

29 2. Capturing Keystrokes Host Processor Virtual Page Table Keyboard buffer Physical Keyboard buffer cudahostgetdevicepointer( 0x , ~~~) GPU Page-locked Keyboard buffer NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

30 2. Capturing Keystrokes Host Processor munmap() Virtual Page Table Keyboard buffer Physical Keyboard buffer cudahostgetdevicepointer( 0x , ~~~) GPU Page-locked Keyboard buffer NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

31 2. Capturing Keystrokes Host Processor Physical Keyboard buffer Communication GPU Page-locked Keyboard buffer NVIDIA CUDA 는 GPU 를관리하는호스트 controller process 와같은주소공간을공유 GPU 가직접접근하기위해서는키보드버퍼가호스트프로세스의가상주소공간에맵핑 controller process 의페이지테이블을조작함으로써접근가능

32 2. Capturing Keystrokes

33 2. Capturing Keystrokes

34 Demo lspci grep -i nvidia 01:00.0 VGA compatible controller: NVIDIA Corporation GF108M [GeForce GT 635M] (rev a1) uname -a Linux bk generic #15-Ubuntu SMP Thu Apr 16 23:32:37 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu Release: Codename: vivid

35 To do next 현재는리눅스 & CUDA 조합 OpenCL 을이용하여 AMD 에도호환 윈도우버전도제작

36 REFERENCE

37 감사합니다. Jihwan yoon

Copyright 2012, Oracle and/or its affiliates. All rights reserved.,,,,,,,,,,,,,.,..., U.S. GOVERNMENT END USERS. Oracle programs, including any operat

Sun Server X3-2( Sun Fire X4170 M3) Oracle Solaris : E35482 01 2012 9 Copyright 2012, Oracle and/or its affiliates. All rights reserved.,,,,,,,,,,,,,.,..., U.S. GOVERNMENT END USERS. Oracle programs, including