Countering Covert Access with SecureCore

The x86 architecture’s inherent security model has a very large attack surface due to the fact that a large amount of software runs in a privileged level and has unfettered access to critical system state. Software used for data piracy or exfiltration, stealthy execution, malicious alteration of critical information, or control of network end-nodes takes advantage of this large attack surface to develop increasingly complex covert access methods. Countering such advanced attacks requires equally sophisticated techniques to reduce attack susceptibility and ensure trust. To this end, AIS, Inc. will leverage the SecureCore platform, a current AFRL/RI research program, to provide new capabilities that counter various classes of covert access methods. Using SecureCore to mitigate covert access effectively reduces the attack surface of the system. AIS, Inc. has already demonstrated the capability for SecureCore to prevent a number of specific covert access techniques; this effort will examine the feasibility of extending SecureCore to sufficiently address a wide variety of advanced access methods. These findings will lead to new opportunities to protect our systems from new and emerging threats and will pave the way for transition of the technology into a commercial product.