Pitfalls of virtual machine introspection on modern hardware
نویسندگان
چکیده
Over the last few years there has been immense progress in developing powerful security tools based on Virtual Machine Introspection (VMI). VMI offers unique capabilities which can be used to check and enforce security policies in the presence of a potentially compromised guest. With the introduction of new hardware virtualization extensions, VMI can be further enhanced to provide lightweight, in-band control over the execution of virtual machines. In publications released before the extensions were available, security researchers issued warnings that these new extensions may be used to subvert VMI. Since hardware supporting these extensions is now available, in this paper, we aim to discuss and re-evaluate claims made in prior-art. We further continue the discussion by highlighting critical limitations of the virtualization extensions. We go on to show that thorough consideration and understanding of these limitations is necessary when developing VMI based security applications. Otherwise, improper handling will inadvertently expose these applications to subversion attacks. Finally, we take a look at Intel’s normal and dual-monitor System Management Mode and discuss how they can be used to both implement and subvert VMI based security applications.
منابع مشابه
LO-PHI: Low-Observable Physical Host Instrumentation for Malware Analysis
Dynamic-analysis techniques have become the linchpins of modern malware analysis. However, software-based methods have been shown to expose numerous artifacts, which can either be detected and subverted, or potentially interfere with the analysis altogether, making their results untrustworthy. The need for less-intrusive methods of analysis has led many researchers to utilize introspection in p...
متن کاملDepartment of Informatics
To approach the ever growing complexity of modern malware, security applications increasingly leverage virtualization technology to perform Virtual Machine Introspection (VMI). VMI constitutes techniques that allow the observation, analysis, and control of guest Virtual Machines (VMs) from the outside. This lends VMI-based applications an omniscient character gaining a complete and untainted vi...
متن کاملVirtual Machine Security Systems
Current operating systems provide the process abstraction to achieve resource sharing and isolation. From a security perspective, however, an attacker who has compromised one process can usually gain control of the entire machine. This makes security systems running on the same computer, such as anti-virus programs or intrusion detection systems, also vulnerable to attack. In response to the im...
متن کاملVirtual Machine Introspection with Xen on ARM
In the recent years, virtual machine introspection (VMI) has become a valuable technique for developing security applications for virtualized environments. With the increasing popularity of the ARM architecture, and the recent addition of hardware virtualization extensions, there is a growing need for porting existing VMI tools. Porting these applications requires proper hypervisor support, whi...
متن کاملSurvey: Virtual Machine Introspection Based System Monitoring and Malware Detection Techniques
In recent years, modern malware are growing powerful. It is very common to see them subvert their victim machine’s security tools upon installation. Traditionally, one can solve this problem by moving critical security services into network so that they are isolated from monitored host and attackers. However, this will result in a poor review of what’s happening inside the host. To address this...
متن کامل