For Full-Text PDF, please login, if you are a member of IEICE,|
or go to Pay Per View on menu list, if you are a nonmember of IEICE.
Rootkit inside GPU Kernel Execution
Ohmin KWON Hyun KWON Hyunsoo YOON
IEICE TRANSACTIONS on Information and Systems
Publication Date: 2019/11/01
Online ISSN: 1745-1361
Type of Manuscript: LETTER
Category: Dependable Computing
graphics processing unit, security, rootkit,
Full Text: PDF(446.5KB)>>
We propose a rootkit installation method inside a GPU kernel execution process which works through GPU context manipulation. In GPU-based applications such as deep learning computations and cryptographic operations, the proposed method uses the feature by which the execution flow of the GPU kernel obeys the GPU context information in GPU memory. The proposed method consists of two key ideas. The first is GPU code manipulation, which is able to hijack the execution flow of the original GPU kernel to execute an injected payload without affecting the original GPU computation result. The second is a self-page-table update execution during which the GPU kernel updates its page table to access any location in system memory. After the installation, the malicious payload is executed only in the GPU kernel, and any no evidence remains in system memory. Thus, it cannot be detected by conventional rootkit detection methods.