{"id":1484,"date":"2019-04-30T16:33:31","date_gmt":"2019-04-30T20:33:31","guid":{"rendered":"https:\/\/www.ece.ncsu.edu\/?p=232995"},"modified":"2019-04-30T16:33:31","modified_gmt":"2019-04-30T20:33:31","slug":"new-technique-uses-power-anomalies-to-id-malware-in-embedded-systems","status":"publish","type":"post","link":"https:\/\/my.ece.ncsu.edu\/communications\/2019\/new-technique-uses-power-anomalies-to-id-malware-in-embedded-systems\/","title":{"rendered":"New Technique Uses Power Anomalies to ID Malware in Embedded Systems"},"content":{"rendered":"

\"\"<\/p>\n

Researchers from North Carolina State University and the University of Texas at Austin have developed a technique for detecting types of malware that use a system\u2019s architecture to thwart traditional security measures. The new detection approach works by tracking power fluctuations in embedded systems.<\/p>\n

\u201cEmbedded systems are basically any computer that doesn\u2019t have a physical keyboard \u2013 from smartphones to Internet of Things devices,\u201d says Aydin Aysu, co-author of a paper on the work and an assistant professor of electrical and computer engineering at NC State. \u201cEmbedded systems are used in everything from the voice-activated virtual assistants in our homes to industrial control systems like those used in power plants. And malware that targets those systems can be used to seize control of these systems or to steal information.\u201d<\/p>\n

At issue are so-called micro-architectural attacks. This form of malware makes use of a system\u2019s architectural design, effectively hijacking the hardware in a way that gives outside users control of the system and access to its data. Spectre and Meltdown<\/a> are high-profile examples of micro-architectural malware.<\/p>\n

\u201cThe nature of micro-architectural attacks makes them very difficult to detect \u2013 but we have found a way to detect them,\u201d Aysu says. \u201cWe have a good idea of what power consumption looks like when embedded systems are operating normally. By looking for anomalies in power consumption, we can tell that there is malware in a system \u2013 even if we can\u2019t identify the malware directly.\u201d<\/p>\n

The power-monitoring solution can be incorporated into smart batteries for use with new embedded systems technologies. New \u201cplug and play\u201d hardware would be needed to apply the detection tool with existing embedded systems.<\/p>\n

There is one other limitation: the new detection technique relies on an embedded system\u2019s power reporting. In lab testing, researchers found that \u2013 in some instances \u2013 the power monitoring detection tool could be fooled if the malware modifies its activity to mimic \u201cnormal\u201d power usage patterns.<\/p>\n

\u201cHowever, even in these instances our technique provides an advantage,\u201d Aysu says. \u201cWe found that the effort required to mimic normal power consumption and evade detection forced malware to slow down its data transfer rate by between 86 and 97 percent. In short, our approach can still reduce the effects of malware, even in those few instances where the malware is not detected.<\/p>\n

\u201cThis paper demonstrates a proof of concept. We think it offers an exciting new approach for addressing a widespread security challenge.\u201d<\/p>\n

The paper, \u201cUsing Power-Anomalies to Detect Evasive Micro-Architectural Attacks in Embedded Systems,\u201d will be presented at the IEEE International Symposium on Hardware Oriented Security and Trust (HOST), being held May 6-10 in Tysons Corner, Va. First author of the paper is Shijia Wei, a Ph.D. student at UT-Austin. The paper was co-authored by Michael Orshansky, Andreas Gerstlauer and Mohit Tiwari of UT-Austin.<\/p>\n

The work was done with support from Lockheed Martin, and from the National Science Foundation, under grants 1850373 and 1527888.<\/p>\n

-shipman-<\/p>\n

Note to Editors:<\/strong> The study abstract follows.<\/p>\n

\u201cUsing Power-Anomalies to Detect Evasive Micro-Architectural Attacks in Embedded Systems\u201d<\/strong><\/p>\n

Authors<\/em>: Shijia Wei, Michael Orshansky, Andreas Gerstlauer, and Mohit Tiwari, University of Texas at Austin; Aydin Aysu, North Carolina State University<\/p>\n

Presented<\/em>: May 6-10, IEEE International Symposium on Hardware Oriented Security and Trust, Tysons Corner, Va.<\/p>\n

Abstract:<\/strong> High-assurance embedded systems are deployed for decades and expensive to re-certify \u2013 hence, each new attack is an unpatchable problem that can only be detected by monitoring out-of-band channels such as the system\u2019s power trace or electromagnetic emissions. Micro-Architectural attacks, for example, have recently come to prominence since they break all existing software-isolation based security \u2013 for example, by hammering memory rows to gain root privileges or by abusing speculative execution and shared hardware to leak secret data. This work is the first to use anomalies in an embedded system\u2019s power trace to detect evasive micro-architectural attacks. To this end, we introduce power-mimicking micro-architectural attacks \u2013 including DRAM-rowhammer attacks, side\/covert-channel and speculation driven attacks \u2013 to study their evasiveness. We then quantify the operating range of the power-anomalies detector using the Odroid XU3 board \u2013 showing that rowhammer attacks cannot evade detection while covert channel and speculation-driven attacks can evade detection but are forced to operate at a 36\u00d7 and 7\u00d7 lower bandwidth. Our power-anomaly detector is efficient and can be embedded out-of-band into (e.g.) programmable batteries. While rowhammer and side-channel defenses require invasive code- and hardware-changes in general-purpose systems, we show that power-anomalies are a simple and effective defense for embedded systems. Power-anomalies can help future-proof embedded systems against vulnerabilities that are likely to emerge as new hardware like phase-change memories and accelerators become mainstream.<\/p>\n

This post was originally published<\/a> in NC State News.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

\"\"A new technique uses power fluctuations to detect malware that uses a system\u2019s architecture to thwart traditional security measures.<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ncst_dynamicHeaderBlockName":"","ncst_dynamicHeaderData":"","ncst_content_audit_freq":"","ncst_content_audit_date":"","ncst_content_audit_display":false,"ncst_backToTopFlag":"","footnotes":""},"categories":[180,185],"tags":[],"class_list":["post-1484","post","type-post","status-publish","format-standard","hentry","category-research","category-smart"],"displayCategory":null,"acf":{"ncst_posts_meta_modified_date":null},"_links":{"self":[{"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/posts\/1484","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/comments?post=1484"}],"version-history":[{"count":2,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/posts\/1484\/revisions"}],"predecessor-version":[{"id":2633,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/posts\/1484\/revisions\/2633"}],"wp:attachment":[{"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/media?parent=1484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/categories?post=1484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/my.ece.ncsu.edu\/communications\/wp-json\/wp\/v2\/tags?post=1484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}