This presentation introduces "Socarrat," a novel and cost-effective approach to building a secure Write Once, Read Many (WORM) device, primarily for append-only logging in critical systems. Developed by Gorka Guardiola Múzquiz and Enrique Soriano-Salvador, Socarrat leverages a "reverse file system" model, where a small, intelligent USB device (such as a Raspberry Pi) intercepts and decodes block-level operations from a host operating system (supporting ext4 and exFAT). This allows it to infer and securely store log entries in separate, undeletable files on the device itself, even if the host system is fully compromised. The project aims to provide hardware-like WORM guarantees via software, adhering to a "Continuous Printer Model," and incorporates tamper-evident logging. The talk covers the system's architecture, challenges in maintaining file system consistency across different formats, the experience of porting to Plan 9's 9P protocol, and future development, including capabilities to detect and react to malicious file system modifications.
Socarrat: A Cost-Effective Secure WORM Device for Logs
0:00 Introduction to "Socarrat": Gorka Guardiola and Enrique Soriano-Salvador introduce their project, "Socarrat," a system for secure Write Once, Read Many (WORM) storage. The name (meaning burnt rice on a paella pan) metaphorically represents data that is extremely difficult to remove.
1:01 The WORM Problem: The core challenge is guaranteeing that data, especially security logs, cannot be deleted or modified once written, even if the host system is entirely compromised by an attacker who has escalated privileges. WORM provides a crucial security guarantee.
2:00 Continuous Printer Model: Socarrat aims to provide hardware-level WORM guarantees through software, inspired by a continuous printer: "what's printed is printed and cannot be undone." This model includes liveness (data is committed frequently) and ensures that even if an attacker commits bad data, previous valid data cannot be unprinted.
2:40 Socarrat's Design Philosophy: Socarrat is designed as a very cheap (e.g., Raspberry Pi-based), local, plug-and-play USB device compatible with any conventional operating system. It specializes in append-only log files and also incorporates tamper-evidence capabilities from their previous work, SealFS.
3:56 The Reverse File System: The system's innovation is the "reverse file system." Socarrat acts as an intelligent hard disk, presenting itself as a standard block device. It monitors incoming block-level writes from the host OS, decodes them to understand file system operations (like appending to a log file), and then stores these inferred operations as separate, undeletable files on the Socarrat device, inaccessible to a compromised host.
5:00 File System Support and Challenges: Socarrat currently supports ext4 and exFAT. A major challenge is correctly interpreting file system updates, as metadata and data blocks can be written out of order. For ext4, journaling helps, but for exFAT (which lacks robust journaling), they employ a "coherent time window" and disk zeroing.
6:00 Plan 9 Porting Insights: The project was successfully ported to Plan 9 using the 9P protocol. While 9P is synchronous and potentially slower than NBD without careful parallelization, it was found to be simpler and more semantically well-defined, and the porting process helped uncover numerous bugs in their existing implementation.
8:10 Malicious Activity Detection: By observing all block transactions, Socarrat can detect attempts by an attacker to delete or modify append-only log files. Policies for reacting to such detected attacks include returning I/O errors, resetting the USB device to read-only, or implementing a "honeypot" to store the malicious writes for later auditing.
9:22 Future Development: Future plans include completing the Plan 9 port (especially USB On-The-Go support, which is surprisingly difficult to find and enable), supporting other file systems, and developing stackable modules to add features like cryptography.
10:54 Performance and Practicality: While Plan 9's 9P protocol can be slower than NBD due to its synchronous nature, practical performance on newer USB3 hardware is still being measured. The system prioritizes secure logging and cost-effectiveness over high-performance I/O or large-scale storage (e.g., compared to DVDRs).