Instrumentation is the Next Internet Explorer

I read Rik Farrow's Musings(.pdf) in the latest USENIX ;login: and noticed this section:

[Rik read] an amazing paper by Chad Verbowski... of Microsoft Research... Flight Data Recorder (.pdf) (FDR) (say, haven’t I heard of another similarly named software project?) has the goal of capturing configuration and file changes from Microsoft systems and will be shipped with Windows Vista.

Using a time window of only 6 ms, FDR captures all changes to system configuration–related registry entries and files, saves the log locally, then cleverly compresses it, without losing any interesting data, before uploading the compressed logs to a server. The goal was to capture data from thousands of servers while using less than 1% of network bandwidth, with a less than 20 MB/day logfile per system that can be analyzed in 3 seconds.

Sounds unbelievable, but FDR manages to compress each event into an average of 0.7 of a byte. The motivation for this clever work was the discovery that 33% of system outages were related to configuration changes, so tracking those changes was key to system reliability.

This made me remember a comment in the Joanna Rutkowska interview I didn't previously highlight:

"The scary part is that once an attacker [gets] into the system, we can't reliably read system memory, neither using software-based, nor hardware-based, methods. That means we can't answer the question of whether the system is clean or not," she says.

In other words, we have a problem with instrumentation. Microsoft is working on better instrumentation as demonstrated by FDR, but it's not what Joanna means or needs. We might be able to get better instrumentation if the OS is running within a hypervisor that monitors all aspects of the OS.

How does this relate to Internet Explorer? The Web browser was one of the first major components moved into the OS, once Microsoft saw how powerful Netscape was. Since then Microsoft has continued to move other features into the OS or into the suites of applications Microsoft provides, with anti-virus, host-based IPS and PC health the latest initiatives. I think we'll see greater moves towards instrumentation of the OS for security purposes, but the question will be whether non-Microsoft people and/or products will be able to access these offerings.

If these instrumentation readings are available, then we'll see vendors like Guidance Software make use of them for forensics purposes. Alternatively Microsoft might move deeper into the security space and sell its own forensics software. Many of the great Sysinternals tools which are now part of Microsoft have forensic and security purposes. That could be one sign of the future.

Comments

Anonymous said…
Would you trust a system where the vendor offers you absolutely everything, from the hypervisor, to the operating system, to the antivirus? I don't think I will, moreover if it's closed source.
8:54 PM
Richard Bejtlich said…
Probably not! Then again, I do trust open systems that someone could audit, like OpenBSM.
9:10 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more