Shield: Vulnerability-Driven Network Filters for Preventing Known Vulnerability Exploits Authors: Helen J. Wang, Chuanxiong Guo, Daniel R. Simon, and Alf Zugenmaier Publication: ACM SIGCOMM, 2004 Presenter: YanYan Wang

Motivation To defense software vulnerabilities between vulnerability disclosure and software patching. To propose a first-line worm defense in the network stack using “shields” to safely delay the needs for installing software patch that removes vulnerabilities.

Why It Is Necessary People do not patch their systems for following reasons: Disruption Unreliability Irreversibility Unawareness

Shield Framework Vulnerability specific Exploit-generic installed at the end host Operates between application protocol layer and the transport layer Examines the incoming and outgoing traffic of vulnerable applications Corrects the traffic according to the vulnerability signature

Vulnerability Modeling A shield vulnerability signature describe the vulnerability state machine and how to recognize exploits in the vulnerable event. A shield policy specifies the vulnerability signature and actions needed to recognize an exploit. It is provided by the shield designers, mostly the application vulnerability vendor.

Vulnerability Modeling Application Message Pre-vulnerability State

Shield Architecture Goals for shield design: Minimize the state maintained Need to resist resource consumption attacks (e.g. DoS). Enough flexibility to support any application level protocol Separate policy from mechanism Design fidelity: Need to defend being an alternative target

Data Structure There are two main data structure: The application vulnerability state machine specifications (Spec) Instruct shield to emulate the application vulnerability state machine at run time Contents state machines specifics, port number, event and session info. Run time session states Includes current state of the session and other context info.

Components Policy loader Application dispatcher Session dispatcher Integrate new shield policy with existing one or created new Application dispatcher Determine which Spec. to refer to upon arrival of raw data based on port number. Session dispatcher Obtain the location of the session ID, message. type, message. Boundary marker, and extract message(s), dispatch the event to appropriate state machine instance.

Components (cont.) State machine instance Shield interpreter Give the new arrival event and the current state, consult with Spec., invoke the correspondent event handler and call shield interpret to decode the handler. Shield interpreter Find out how to parse application level protocol payload and examine for exploits from the handler, as well as drop packets, session tear-down, or setting the next state for current SMI.

Shield Architecture

Detailed Design Issue Scattered arrivals Out-of-Order arrivals Recognize multi-data arrival Out-of-Order arrivals Shield copy and passes to the application Max needs to be set in the policy Application Level Fragmentation The Spec needs to contain the location of the application level fragment ID

Shield Policy Language

Shield Policy Language Payload specification - Static States, events, state machine transition, and generic application level protocol info. Loaded into Spec. Handler specification – Run Time Handler specification and payload paring instructions Examine the packet payload, pinpoint any exploit, record the session context for later Syntax of the handlers and the payload format are parsed and stored in Spec. by policy loader

Implementation Shield Prototype Using WinSock2 LSP C++ Used vulnerability behind Slammer, MSBlast, CodeRed, and twelve other vulnerabilities from Microsoft security bulletins

Evaluation Applicability

Evaluation False Positives 36 cases for exhaustive testing SSRP protocol of SQL server 2000 No false positive Does not mean false positive-free

Strength Defend vulnerability without installing patches Non-invasive Exploit-generic Development of shield policy language Set potential standard

Weakness Only work for known vulnerability Need to manually generate signatures Vulnerability specific Does not work on all vulnerability Bugs deeply embedded in the application’s logic File-base vulnerability

Improvement Automated tool to generate signature More experiment on applications with vulnerability that does not apply to shield