Yeah, thanks for joining, thanks for letting me talk here.
So, first little introduction, I am Ankit Durk, from Microsoft Defender for Linux, so this
is an anti-malware solution on the Linux space, I am a consumer of my colleagues, so back
and then Lakshmi and McNadir, they also contributed to this project, so I am going to talk
about how do you reliably extract process metadata, specifically for short met process using
VPA, which is actually quite important for security databases.
So, before moving ahead, let me talk about the background, so endpoint detection and
response are like cyber security tools, which are responsible for monitoring detection
investigation and placing response to the threats which are actively happening on the
points like servers, laptops, so these idea solutions, actively monitors and gives
you a comprehensive visibility into the endpoint, the detection and investigation as some
of the features, which are provided by the idea, so that any security expert can actually
track out malicious behavior, which is like now leading to the malicious behavior.
So, idea solutions and also they also generate automated alerts, which can be used by security
expert to eventually react in real time for the tricks happening on the endpoint.
These idea solutions are continuously monitoring your endpoints based on event logs or
authentication attempts and tracks like process findings.
This process time is actually played quite crucial in each of these idea features, because
those actual provides the logical order of the lifecycle of the process, it gives you
help see a full HP and scope of security bridge.
The process time mindset created using process metadata like PID is creation time, the
process name, paths and command line arguments.
So, any kind of gaps that you can observe in process metadata can actually result in hampering
these detection and investigation, which actually helps you out to map to the corresponding
threads.
So, typical process timelines are actually created by monitoring basic events, occurring
on the endpoint like for an executive and these events are eventually used to extract
a data out of it.
The information collected within these events is actually collated, aggregated across
events for a one particular process and then sent to the security portal for display.
The other features like detection and investigation actually uses these timelines for
further providing investigation with the process.
So, it gives us that process time is actually playing a very crucial role here and then
any kind of gaps in this timeline can result in lot of issues.
So, let us move ahead.
So, there also the existing methods like three basic, measured methods like profile system
based extraction or it be in net link.
Each has its own advantages and disadvantages.
For example, the profile system gives you extensive information about process, but they
are actually quite on the level for short-lip process, because whenever the process exists
the data gets deleted there.
Or in this system actually gives you reliable data for events that you are talking about
it, but those are very noisy and can result in a lot of performance issues on this
server.
Net link is quite light fit, it gives you a very performing data, but this is more
numerical based like PID or PPIID.
So, still you have to rely on other methods to extract the complete information about
the process.
So, specifically like for short-lip process we are looking off the solutions and not to
get the libel data as well as this were like performance for servers, because the server
is the performance is the most important thing, anti-malware solution cannot eat up the
resources on the head near the server.
Yes, thanks.
So, we were exploring like different methods, so VPS came out to like very, very libel there.
So, by leveraging VPS to extract like process data information within VPS program like
in the kernel space and by utilizing VPS which provide access to like kernel data such
as like task structure, the information collected was very libel and complete for us, and
now you can use the information to use the space for consumers, the method to be very
effective for short-lip process and was as well as a performance.
The flow diagram looks like they were like multiple probes where task to different system
calls.
So, there was a anti-probe and a exit probe attached to like XV system call and the process
metadata was collected into it and now plays into a intermediate PPIHASHA.
So, when exit probe arrives the other data which is collected as part of XV is combined
and then send to the ring buffer in between.
On user space side there was a thread which is constantly pulling over this ring buffer
and it turns to the call back to the endary state of back to the business.
Looking into like more implemented data share like different process meta is collected
using like different ways.
For example, for PID the BPS helpers gives you the directly the PID there using BPS
get current PID to GIT and opportunity to get actually give you that.
For other complex three it is like current working directly process paths and command lines
I am going to talk about more the rate of it complexity and we expected out I want to
take more about it.
But based on that there were different probes attached to different system calls not to
collect all the processes that are working.
Before moving ahead let us talk about some basic building blocks that are used so as you
know task structure is like a basic building blocks of learning kernel which has immense
large motor information available for any process to manage and schedule processes including
is process state doing a memory management for the process file descriptors and more.
So, and by like utilizing BPS it gives you access to this data structure there BPS helper
functions helps you extract the pointer to the task it is in process context and once you
have the pointer to that task you can extract all possible information is related to process.
So, we specifically use this task structure to extract parent PID the process paths current
working directly and the month point entries.
I will talk about what exactly is a denty there because the direct paths are not available
as part of the program.
So, denty structure is like basic fundamental part of virtual file system layer in Linux
kernel.
It organizes all of your files and direct trees into pre-like structure in file system where
internal nodes are actually direct trees and leaf are actually the only files.
So, simply doing a P traversal from the leaf to the root node and on the way collecting
the data on the specific node will give you the full path.
So, and there is little adjustment needed for mount point because if your root file system
is mounted to a different point you need to conquer the adjuster path according to that.
One particular problem that we see is if paths are very deep into the system it can result
into little performance impact.
So, you might have to put some thresholds there how deep you want to go voting.
So, the very first task of like extracting the process is to extract like the corresponding denty
so and the denty node is as is part of your task structure there.
So, based on what kind of path you collecting if it is a process path or the current
working directory the corresponding denty node can be expected from task structure there and once
you have a denty node the next thing that you also need to collect is like collecting the
denty for the mount point because if you have root mounts leaf file system is mounted somewhere
else you need to adjust the paths according to that mount point.
So, now here you once you all you have all dentries for different paths there now simply
call this function out to like get the actual path. So, this function is simply doing a tree
traversal from leaf of the node to the top of the root and every denty node has a field called
D and a school name which you can use to actually get the name of the file and directory.
If you look at this there is a follow up but that is like a static loop there in evpec program
you cannot have like dynamic loop there it has to be the static burn and that is the reason
that you have to place some static limits to it. Secondly as explained before due to performance
reasons you also really want to go very deep into the paths and only collect those which are
just meeting the sessions. So, both loops the first loop is collecting the paths and second one
is collecting the mount point path there and combining these two paths will give you the final
path therefore, corresponding process. This part of the code is giving you the command lines.
So, based on the probe the task you are indexed in very. So, for exactly it is like the first
index or exactly it is like the second index. So, first thing if you look at the top line
it is reading you the kernel address for the command line array from kernel space to the user space.
Once you have that address now you simply look into back collecting each arguments again you have
to do the similar thing you first have to extract the kernel address for the argument for the index
and then move into the user space and then finally we have the address corresponding the user space
for the argument you read the corresponding arguments from that particular address in the user space
and then place into the local before and send it into the space space. So, in this way
your process paths kernel work in the rectities or command lines are collected and then
in place to the user space use a space side by bearing before there.
In order to understand like how effective is this method is we did some experiments.
So, we then like different commands which were representing shortly process and the process
method data is collected like for two different methods one is like BPF waste and reverse
profile system and in fact we run these experiments for three different scenarios. So, first
keeping your machine idle with no workload there. The second was the stress scenario where last
number of post stress school queries for run in background the third one was like running open
SSL compilation. So, we really want to simulate actual environment where how does the methods
get effective and other process represent a system. So, results were great especially look at
the part which is representing with the BPF results there almost like close to 100 percent
the data was always complete with no gaps there and if you look at the similar for profile system
it got significantly reduced for post stress scenarios like almost close to 30 percent there was
actually no data.
Of course, like there was some limitations it is you need to have quite an understanding of kernel
if it for run like little bit difficult to write about it you need to have some knowledge about it.
One more thing that BPF programs has to be thoroughly vetted by a verifier. So, you have to write
a code where BPF verifier cannot fail and you kind of bug this in verifier can result in
the security vulnerabilities and crashes. So, result in the kernel crashes PTF as far as I know
it is not supported below 4.18 kernels. So, for those set of kernels you still have to rely on
like other methods. I think in terms of performance this is very great in terms of profile system
but still need to have some balance for like for example for these paths you still want to
lie on like profile system based and don't really need to do all collection in data
generally BPF spaces. But I think if you can balance out what needs to be collected in the
BPF space versus the user space you can meet the problem of the class.
Yeah, I am done. Yeah, thanks.
Yeah. Do you check if the program is altered by a detector or what is it?
Sorry. Do you check if BPF program is altered by a detector or what is it?
Yeah. So, the question is very reach a very BPF program is required to occur nodes.
I think you made like BPF maps because maps are exposed to there. So, I think this is a gap
that we are receiving right now facing where maps can be tampered and probably we need a way to
protect those out and we still exploring out the how to protect like users to not tampered with
the BPF.
Yeah. So, question is how did the work come up and was it part of the security initiative
yeah. So, what was part of the security initiative? We were observing a lot of gaps on the
idea timelines where researchers first say that because the majority of the data is missing,
they cannot actually map to corresponding kits and they need to do something about it the way
we are collecting a data there and that actually is altered into thinking where how can we
close this gap out and and is altering to ending up using data there.
How can we need to call ring buffer from the user space and you have that ability to see
it is being overwhelmed. Okay. So, the question is how do you often like pull air
ring buffer and do you really know that it is overplaying on that. So, I think we did a lot of
experiments and find it like a certain number at how often we have to do put it but that is
a problem that we are seeing that ring force can actually overflow and firstly you have to adjust
the size of the ring before in between and then actually can meet you the requirements that you have.
So, once you have the right size and you will be preferable and I do not think so there is
anything from just this about adjusting the need to have it in buffer size as well as like
pulling about it. So, we pull like every one second and that gives us the right but.
Microsoft related recently it has published a project about running in the care for users.
Experiments with them, the projects as well or maybe I will find them as well.
So, I belong to the next team but I know people were exploring VPS part of windows but right now
it is more like the POC phase they are still exploring there.
Thanks. Thanks. Thank you.
Thank you.