Fine-grained covert debugging using hypervisors and analysis via visualization
|
|
|
- Muriel Hensley
- 8 years ago
- Views:
Transcription
1 Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Fine-grained covert debugging using hypervisors and analysis via visualization Daniel A. Quist Lorie M. Liebrock Offensive Computing, LLC New Mexico Tech Defcon 17 Las Vegas, NV
2 Introduction Reverse Engineering g is Hard! Hypervisor based executable monitoring Modifications for improved performance Visualization tool for rapid analysis Modifying the reverse engineering process
3 Difficulties of RE Time consuming gprocess Difficult set of skills to acquire Tools are advanced, but still don t provide adequate views. Focused on static analysis Software armoring makes process even more difficult
4 Process for Reverse Engineering Setup an isolated run-time environment Execution and initial analysis Deobfuscate compressed or packed code Disassembly / Code-level Analysis Identify and analyze relevant and interesting portions of the program
5 Isolated Analysis Environment Setup an Isolated Runtime Environment Virtual machines: VMWare, Xen, KVM, Need to protect yourself ffrom malicious code Create a known-good baseline environment Quickly allows backtracking if something bad happens
6 Execution and Initial Analysis Goal: Quickly figure out what the program is doing without looking at assembly Look for: Changes to the file system Changes to the behavior of the system Network traffic Overall performance Ads or changed browser settings
7 Remove Software Armoring Program protections to prevent reverse engineering Done via packers Small encoder/decoder Self-modifying code Lots of research about this OllyBonE, Saffron, Polyunpack, Renovo, Ether, Azure My research uses Ether
8 Packing and Encryption Self-modifying code Small decoder stub Decompress the main executable Restore imports Play tricks with the executable OS Loader is inherently lazy (efficient) Hide the imports Obscure relocations Use bogus values for various unimportant fields
9 Software Armoring Compressed, obfuscated, hidden code Virtual machine detection Debugger detection Shifting decode frames
10 Normal PE File
11 Packed PE File
12 Troublesome Protections Virtual Machine Detection Redpill, ocvmdetect, Paul Ferrie s paper Debugger Detection IsDebuggerPresent() EFLAGS bitmask Timing Attacks Analyze value of RDTSC before and after Really effective
13 Thwarting Protections Two methods for circumvention 1. Know about all the protections before hand and disable them 2. Make yourself invisible
14 Virtual Machine Monitoring Soft VM Based systems Renovo Polyunpack Zynamics Bochs unpacker Problems Detection of virtual machines is easy Intel CPU never traditionally designed for virtualization Do not emulate x86 bug-for-bug
15 OS Integrated Monitoring Saffron, OllyBonE Page-fault handler based debugger Abuses the supervisor bit on memory pages High-level executions per page Problems Destabilizes the system Need dedicated hardware Fine-grain monitoring not possible
16 Fully Hardware Virtualizations Ether: A. Dinaburg, P. Royal Xen based hypervisor system Base functions for monitoring System calls Instruction traces Memory Writes All interactions done by memory page mapping Problems Unpacking code primitive Dumps mangled and not possible to dissassemble Old version of Xen hypervisor
17 Disassembly and Code Analysis Most nebulous portion of the process Largely depends on intuition Example: When we reversed the MP3 Cutter and MIRC programs Takes time and experience Looking at assembly is tedious Suffers from not seeing the forest from the trees syndrome Analyst fatigue Level of attention required yields few results
18 Find Interesting and Relevant Portions of the Executable Like disassembly, this relies on a lot of intuition and experience Typical starting points: Look for interesting strings Look for API calls Examine the interaction with the OS This portion is fundamentally imprecise, tedious, and often frustrating for beginners and experts
19 Contributions Modifications to Ether Improve malware unpacking Enable advanced tracing mechanisms Automate much of the tedious portions Visualizing Execution for Reversing and Analysis (VERA) Speed up disassembly and finding interesting portions of an executable Faster identification of the Original Entry Point
20 Ether System Architecture
21 Extensions to Ether Removed unpacking code from hypervisor into userspace Better user mode analysis PE Repair system Allows for disassembly of executables Added enhanced monitoring system for executables
22 Results Close to a truly covert analysis system Ether is nearly invisible Still subject to bluepill detections Fine-grain resolution of program execution Application memory monitoring and full analysis capabilities Dumps from Ether can now be loaded in IDA Pro without modification
23 Open Problems Unpacking process produces lots of candidate dump files Need to figure out what the OEP is Import rebuilding is still an issue Now that t there is a nice tool for tracing programs covertly, we need to do analysis
24 Visualization of Trace Data Goals: Quickly visually subvert software armoring Identify modules of the program Initialization Main loops End of unpacking code Figure out where the self-modifying code ends (OEP detection) Discover dynamic runtime program behavior Integrate with existing tools
25 Visualizing the OEP Problem Each block (vertex) represents a basic block executed in the user mode code Each line represents a transition The thicker the line, the more it was executed Colors represent areas of memory execution
26 VERA Visualization of Executables for Reversing and Analysis Windows MFC Application Integrates with IDA Pro Fast, small memory footprint
27 VERA Architecture
28 Visualizing Packers Memory regions marked for PE heuristics
29 Demo!
30 Netbull Virus (Not Packed)
31 Netbull Zoomed View
32 Visualizing Packers Memory regions marked for PE heuristics
33 UPX
34 UPX - OEP
35 ASPack
36 FSG
37 MEW
38 TeLock
39 Future Work General GUI / bug fixes Integration with IDA Pro Memory access visualization System call integration Function boundaries Interactivity with unpacking process Modify hypervisor to work with WinDBG, OllyDbg, IDA Debugger
40 Conclusions Visualizations make it easy to identify the OEP No statistical analysis of data needed Program phases readily identified Graphs are relatively simple Preliminary user study shows tool holds promise for speeding up reverse engineering
41 Questions? These slides are out of date! Find the latest ones at:
Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis
Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Game Changing Hypervisor Based Malware Analysis and Visualization Danny Quist Lorie Liebrock New Mexico Tech Computer
for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory
Visualizing Compiled Executables for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory Overview Explanation of Problem Overview of Reverse Engineering Process
Visualizing Compiled Executables for Malware Analysis
Visualizing Compiled Executables for Malware Analysis Daniel A. Quist New Mexico Tech Los Alamos National Laboratory Lorie M. Liebrock New Mexico Tech ABSTRACT Reverse engineering compiled executables
Attacking Obfuscated Code with IDA Pro. Chris Eagle
Attacking Obfuscated Code with IDA Pro Chris Eagle Outline Introduction Operation Demos Summary 2 First Order Of Business MOVE UP AND IN! There is plenty of room up front I can't increase the font size
Adi Hayon Tomer Teller
Adi Hayon Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory in a remote process (and write to it) Executes the code in that memory region Frees the code Memory dump
Denial-of-Service Attacks on Host-Based Generic Unpackers
Denial-of-Service Attacks on Host-Based Generic Unpackers Limin Liu 1, Jiang Ming 2, Zhi Wang 2,3, Debin Gao 2, and Chunfu Jia 3 1 State Key Lab of Information Security, Graduate University of CAS, China
File Disinfection Framework (FDF) Striking back at polymorphic viruses
File Disinfection Framework (FDF) Striking back at polymorphic viruses 1 CONTENTS Introduction 3 File Disinfection Framework (FDF) 4 Disinfection solution development today 5 Goals 6 Target audience 6
Peeking into Pandora s Bochs. Instrumenting a Full System Emulator to Analyse Malicious Software
Instrumenting a Full System Emulator to Analyse Malicious Software Lutz Böhne (lutz.boehne@redteam-pentesting.de) RedTeam Pentesting GmbH http://www.redteam-pentesting.de April 9th 2010, Paris Hackito
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Virtual machines and operating systems
V i r t u a l m a c h i n e s a n d o p e r a t i n g s y s t e m s Virtual machines and operating systems Krzysztof Lichota lichota@mimuw.edu.pl A g e n d a Virtual machines and operating systems interactions
Compromise-as-a-Service
ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg 3/31/14 Compromise-as-a-Service Our PleAZURE Felix Wilhelm & Matthias Luft {fwilhelm, mluft}@ernw.de ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg Agenda
Detecting the Presence of Virtual Machines Using the Local Data Table
Detecting the Presence of Virtual Machines Using the Local Data Table Abstract Danny Quist {chamuco@gmail.com} Val Smith {mvalsmith@metasploit.com} Offensive Computing http://www.offensivecomputing.net/
CERIAS Tech Report 2015-9 Basic Dynamic Processes Analysis of Malware in Hypervisors Type I & II by Ibrahim Waziri Jr, Sam Liles Center for Education
CERIAS Tech Report 2015-9 Basic Dynamic Processes Analysis of Malware in Hypervisors Type I & II by Ibrahim Waziri Jr, Sam Liles Center for Education and Research Information Assurance and Security Purdue
PE Explorer. Heaventools. Malware Code Analysis Made Easy
Heaventools PE Explorer Data Sheet Malware Code Analysis Made Easy Reverse engineers within the anti-virus, vulnerability research and forensics companies face the challenge of analysing a large number
FRONT FLYLEAF PAGE. This page has been intentionally left blank
FRONT FLYLEAF PAGE This page has been intentionally left blank Abstract The research performed under this publication will combine virtualization technology with current kernel debugging techniques to
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com WHY PERFORM MALWARE ANALYSIS? What are some of the reasons that one might want to invest the (sometimes significant) resources required
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips Agenda Overview W32/Xpaj analysis Overview of a virtual machine Software protection trends W32/Winemmem analysis W32/Induc
LASTLINE WHITEPAPER. In-Depth Analysis of Malware
LASTLINE WHITEPAPER In-Depth Analysis of Malware Abstract Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse).
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009 Agenda Part 1: Introduction (~5 ) Infection
Hypervisor Support for Identifying Covertly Executing Binaries
Hypervisor Support for Identifying Covertly Executing Binaries Lionel Litty H. Andrés Lagar-Cavilla Dept. of Computer Science University of Toronto {llitty,andreslc}@cs.toronto.edu David Lie Dept. of Elec.
So You Want To Analyze Malware? Tools, Techniques, and Mindset
So You Want To Analyze Malware? Tools, Techniques, and Mindset Introduction Who, What, Why? Introduction Me Wes Brown Software and Systems Hacker Fond of Lisp-based and Functional Languages Developed Lisp
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows Products Details ESET Endpoint Security 6 protects company devices against most current threats. It proactively looks for suspicious activity
TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com
TitanMist: Your First Step to Reversing Nirvana TitanMist mist.reversinglabs.com Contents Introduction to TitanEngine.. 3 Introduction to TitanMist 4 Creating an unpacker for TitanMist.. 5 References and
x86 ISA Modifications to support Virtual Machines
x86 ISA Modifications to support Virtual Machines Douglas Beal Ashish Kumar Gupta CSE 548 Project Outline of the talk Review of Virtual Machines What complicates Virtualization Technique for Virtualization
The QEMU/KVM Hypervisor
The /KVM Hypervisor Understanding what's powering your virtual machine Dr. David Alan Gilbert dgilbert@redhat.com 2015-10-14 Topics Hypervisors and where /KVM sits Components of a virtual machine KVM Devices:
KVM: A Hypervisor for All Seasons. Avi Kivity avi@qumranet.com
KVM: A Hypervisor for All Seasons Avi Kivity avi@qumranet.com November 2007 Virtualization Simulation of computer system in software Components Processor: register state, instructions, exceptions Memory
Hypervisor-Based, Hardware-Assisted System Monitoring
Horst Görtz Institute for IT-Security, Chair for System Security VMRay GmbH Hypervisor-Based, Hardware-Assisted System Monitoring VB2013 October 2-4, 2013 Berlin Carsten Willems, Ralf Hund, Thorsten Holz
Effective Java Programming. efficient software development
Effective Java Programming efficient software development Structure efficient software development what is efficiency? development process profiling during development what determines the performance of
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Dongwoo Kim : Hyeon-jeong Lee s Husband
2/ 32 Who we are Dongwoo Kim : Hyeon-jeong Lee s Husband Ph.D. Candidate at Chungnam National University in South Korea Majoring in Computer Communications & Security Interested in mobile hacking, digital
Detecting the One Percent: Advanced Targeted Malware Detection
Detecting the One Percent: Advanced Targeted Malware Detection Tomer Teller Check Point Software Technologies Session ID: SP02-T19 Session Classification: Intermediate Antivirus 20 th+ Anniversary The
FATKit: A Framework for the Extraction and Analysis of Digital Forensic Data from Volatile System Memory p.1/11
FATKit: A Framework for the Extraction and Analysis of Digital Forensic Data from Volatile System Memory DFRWS 2006: Work in Progress (WIP) Aug 16, 2006 AAron Walters 4TΦ Research Nick L. Petroni Jr. University
Bluepilling the Xen Hypervisor
Bluepilling the Xen Hypervisor Joanna Rutkowska & Alexander Tereshkin Invisible Things Lab Black Hat USA 2008, August 7th, Las Vegas, NV Xen 0wning Trilogy Part Three Previously on Xen 0wning Trilogy...
Securing Your Cloud with Xen Project s Advanced Security Features
Securing Your Cloud with Xen Project s Advanced Security Features Russell Pavlicek, Xen Project Evangelist CloudOpen North America 2013 Who is the Old, Fat Geek Up Front? Xen Project Evangelist Employed
Journal of Theoretical and Applied Information Technology 10 th June 2013. Vol. 52 No.1 2005-2013 JATIT & LLS. All rights reserved.
ARCHITECTURE OF MALWARE TRACKER VISUALIZATION FOR MALWARE ANALYSIS 1 CHAN LEE YEE, 2 MAHAMOD ISMAIL, 3 NASHARUDDIN ZAINAL, 4 LEE LING CHUAN 1,4 PhD Student, Department of Electrical, Electronic and System
System Structures. Services Interface Structure
System Structures Services Interface Structure Operating system services (1) Operating system services (2) Functions that are helpful to the user User interface Command line interpreter Batch interface
Security Intelligence Services. Cybersecurity training. www.kaspersky.com
Kaspersky Security Intelligence Services. Cybersecurity training www.kaspersky.com CYBERSECURITY TRAINING Leverage Kaspersky Lab s cybersecurity knowledge, experience and intelligence through these innovative
Lecture 26: Obfuscation
Lecture 26: Obfuscation 15411: Compiler Design Robbie Harwood and Maxime Serrano 21 November 2013 1 Introduction We have previously (lecture 20) considered the problem of doing compilation backwards (i.e.,
Spyware Analysis. jan.monsch@csnc.ch. Security Event - April 28, 2004 Page 1
Spyware Analysis jan.monsch@csnc.ch Security Event - April 28, 2004 Page 1 Content Definition & types of spyware Statistics Hooks Static vs. dynamic software analysis Test environment for spyware Analysis
Virtualization. Explain how today s virtualization movement is actually a reinvention
Virtualization Learning Objectives Explain how today s virtualization movement is actually a reinvention of the past. Explain how virtualization works. Discuss the technical challenges to virtualization.
Practical Threat Intelligence. with Bromium LAVA
Practical Threat Intelligence with Bromium LAVA Practical Threat Intelligence Executive Summary Threat intelligence today is costly and time consuming and does not always result in a reduction of successful
Subverting the Xen hypervisor
Subverting the Xen hypervisor Rafał Wojtczuk Invisible Things Lab Black Hat USA 2008, August 7th, Las Vegas, NV Xen 0wning Trilogy Part One Known virtulizationbased rootkits Bluepill and Vitriol They install
Static Analysis of Virtualization- Obfuscated Binaries
Static Analysis of Virtualization- Obfuscated Binaries Johannes Kinder School of Computer and Communication Sciences École Polytechnique Fédérale de Lausanne (EPFL), Switzerland Virtualization Obfuscation
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Dynamic analysis of malicious code
J Comput Virol (2006) 2:67 77 DOI 10.1007/s11416-006-0012-2 ORIGINAL PAPER Dynamic analysis of malicious code Ulrich Bayer Andreas Moser Christopher Kruegel Engin Kirda Received: 13 January 2006 / Accepted:
Software Reversing Engineering (a.k.a. Reversing) Spiros Mancoridis. What is Reverse Engineering? Software Reverse Engineering: Reversing
Software Reversing Engineering (a.k.a. Reversing) Spiros Mancoridis What is Reverse Engineering? Reverse engineering (RE) is the process of etracting the knowledge or design blueprints from anything man
2) Xen Hypervisor 3) UEC
5. Implementation Implementation of the trust model requires first preparing a test bed. It is a cloud computing environment that is required as the first step towards the implementation. Various tools
Introduction. Application Security. Reasons For Reverse Engineering. This lecture. Java Byte Code
Introduction Application Security Tom Chothia Computer Security, Lecture 16 Compiled code is really just data which can be edit and inspected. By examining low level code protections can be removed and
Self Protection Techniques in Malware
DSIE 10 5 th Doctoral lsymposium on Informatics Engineering i January 28 29, 2010 Porto, Portugal Self Protection Techniques in Malware Tiago Santos Overview Introduction Malware Types Why Self Protection?
IOS110. Virtualization 5/27/2014 1
IOS110 Virtualization 5/27/2014 1 Agenda What is Virtualization? Types of Virtualization. Advantages and Disadvantages. Virtualization software Hyper V What is Virtualization? Virtualization Refers to
Virtualization Technologies (ENCS 691K Chapter 3)
Virtualization Technologies (ENCS 691K Chapter 3) Roch Glitho, PhD Associate Professor and Canada Research Chair My URL - http://users.encs.concordia.ca/~glitho/ The Key Technologies on Which Cloud Computing
Intel Application Software Development Tool Suite 2.2 for Intel Atom processor. In-Depth
Application Software Development Tool Suite 2.2 for Atom processor In-Depth Contents Application Software Development Tool Suite 2.2 for Atom processor............................... 3 Features and Benefits...................................
Bug hunting. Vulnerability finding methods in Windows 32 environments compared. FX of Phenoelit
Bug hunting Vulnerability finding methods in Windows 32 environments compared FX of Phenoelit The goal: 0day What we are looking for: Handles network side input Runs on a remote system Is complex enough
Evading Android Emulator
Evading Android Emulator Thanasis Petsas petsas@ics.forth.gr petsas@ics.forth.gr - www.syssec-project.eu 1 What is a Virtual Machine? A software based computer that functions like a physical machine A
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Virtualization. Pradipta De pradipta.de@sunykorea.ac.kr
Virtualization Pradipta De pradipta.de@sunykorea.ac.kr Today s Topic Virtualization Basics System Virtualization Techniques CSE506: Ext Filesystem 2 Virtualization? A virtual machine (VM) is an emulation
Getting Ahead of Malware
IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,
Hypervisor Memory Forensics
Hypervisor Memory Forensics Mariano Graziano and Davide Balzarotti SANS DFIR EU SUMMIT October 2013 - Prague S3 GROUP S3 GROUP Actaeon Memory forensics of virtualization environments Locate any Intel Hardware
Full Potential of Dynamic Binary Translation for AV Emulation Engine
www.iss.net Full Potential of Dynamic Binary Translation for AV Emulation Engine VB Conference (Oct 12, 2006) Jim Wu ISS X-Force Agenda Roles of emulation in AV Survey of software emulation technologies
Under the Hood: How Actaeon Unveils Your Hypervisor
Under the Hood: How Actaeon Unveils Your Hypervisor Eurecom, Sophia Antipolis, France, EU HITB Kuala Lumpur, October 2013 Table of Contents Eurecom S3 Security Lab What s the problem we are facing Why
Machine Virtualization: Efficient Hypervisors, Stealthy Malware
Machine Virtualization: Efficient Hypervisors, Stealthy Malware Muli Ben-Yehuda Technion & Hypervisor Technologies and Consulting Ltd Muli Ben-Yehuda (Technion & Hypervisor) Efficient Hypervisors, Stealthy
Malware: Prevenire (e curare) con strumenti open-source
Malware: Prevenire (e curare) con strumenti open-source Roberto Paleari roberto.paleari@emaze.net Linux Day 2011 Modena, 22 ottobre 2011 Who am I? PhD Research activities Malware analysis Systems & applications
Peeking into Pandora's Bochs { Instrumenting a Full System Emulator to Analyse Malicious Software
{ Instrumenting a Full System Emulator to Analyse Malicious Software Lutz Bohne (lutz.boehne@redteam-pentesting.de) RedTeam Pentesting GmbH http://www.redteam-pentesting.de October, 28th, Luxembourg hack.lu
Cloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems
Cloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems Lorenzo Martignoni, Pongsin Poosankam, y Matei Zaharia, Jun Han, y Stephen McCamant, Dawn Song, Vern Paxson, Adrian Perrig,
Security Challenges in Virtualized Environments
Security Challenges in Virtualized Environments Joanna Rutkowska, Invisible Things Lab Confidence 2008, Krakow, Poland, May 15th, 2008 1 Virtualization-based MALWARE 2 Using Virtual Machines for ISOLATION
matasano Hardware Virtualization Rootkits Dino A. Dai Zovi
Hardware Virtualization Rootkits Dino A. Dai Zovi Agenda Introductions Virtualization (Software and Hardware) Intel VT-x (aka Vanderpool ) VM Rootkits Implementing a VT-x based Rootkit Detecting Hardware-VM
This is DEEPerent: Tracking App behaviors with (Nothing changed) phone for Evasive android malware
This is DEEPerent: Tracking App behaviors with (Nothing changed) phone for Evasive android malware What I will talk about.. Challenges we faced on android malware analysis: Fast code analysis (Reversing)
Basics of Virtualisation
Basics of Virtualisation Volker Büge Institut für Experimentelle Kernphysik Universität Karlsruhe Die Kooperation von The x86 Architecture Why do we need virtualisation? x86 based operating systems are
CHAPTER 2 THEORETICAL FOUNDATION
CHAPTER 2 THEORETICAL FOUNDATION 2.1 Theoretical Foundation Cloud computing has become the recent trends in nowadays computing technology world. In order to understand the concept of cloud, people should
SPIDER: Stealthy Binary Program Instrumentation and Debugging Via Hardware Virtualization
SPIDER: Stealthy Binary Program Instrumentation and Debugging Via Hardware Virtualization Zhui Deng, Xiangyu Zhang and Dongyan Xu Department of Computer Science and CERIAS, Purdue University, West Lafayette,
Operating System Structures
COP 4610: Introduction to Operating Systems (Spring 2015) Operating System Structures Zhi Wang Florida State University Content Operating system services User interface System calls System programs Operating
13.1 Backup virtual machines running on VMware ESXi / ESX Server
13 Backup / Restore VMware Virtual Machines Tomahawk Pro This chapter describes how to backup and restore virtual machines running on VMware ESX, ESXi Server or VMware Server 2.0. 13.1 Backup virtual machines
CS 695 Topics in Virtualization and Cloud Computing. Introduction
CS 695 Topics in Virtualization and Cloud Computing Introduction This class What does virtualization and cloud computing mean? 2 Cloud Computing The in-vogue term Everyone including his/her dog want something
Virtualization System Vulnerability Discovery Framework. Speaker: Qinghao Tang Title:360 Marvel Team Leader
Virtualization System Vulnerability Discovery Framework Speaker: Qinghao Tang Title:360 Marvel Team Leader 1 360 Marvel Team Established in May 2015, the first professional could computing and virtualization
Virtualization. Types of Interfaces
Virtualization Virtualization: extend or replace an existing interface to mimic the behavior of another system. Introduced in 1970s: run legacy software on newer mainframe hardware Handle platform diversity
CS 695 Topics in Virtualization and Cloud Computing and Storage Systems. Introduction
CS 695 Topics in Virtualization and Cloud Computing and Storage Systems Introduction Hot or not? source: Gartner Hype Cycle for Emerging Technologies, 2014 2 Source: http://geekandpoke.typepad.com/ 3 Cloud
COS 318: Operating Systems. Virtual Machine Monitors
COS 318: Operating Systems Virtual Machine Monitors Kai Li and Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall13/cos318/ Introduction u Have
McAfee MOVE / VMware Collaboration Best Practices
McAfee MOVE / VMware Collaboration Best Practices Christie J. Karrels Sales Engineer Federal DoD January 11, 2013 1 P a g e Contents Introduction... 3 Traditional Anti-Malware vs. Optimized Anti-Malware...
Format string exploitation on windows Using Immunity Debugger / Python. By Abysssec Inc WwW.Abysssec.Com
Format string exploitation on windows Using Immunity Debugger / Python By Abysssec Inc WwW.Abysssec.Com For real beneficiary this post you should have few assembly knowledge and you should know about classic
Chapter 14 Analyzing Network Traffic. Ed Crowley
Chapter 14 Analyzing Network Traffic Ed Crowley 10 Topics Finding Network Based Evidence Network Analysis Tools Ethereal Reassembling Sessions Using Wireshark Network Monitoring Intro Once full content
Abstract. 1. Introduction. 2. Threat Model
Beyond Ring-3: Fine Grained Application Sandboxing Ravi Sahita (ravi.sahita@intel.com), Divya Kolar (divya.kolar@intel.com) Communication Technology Lab. Intel Corporation Abstract In the recent years
Chapter 3: Operating-System Structures. System Components Operating System Services System Calls System Programs System Structure Virtual Machines
Chapter 3: Operating-System Structures System Components Operating System Services System Calls System Programs System Structure Virtual Machines Operating System Concepts 3.1 Common System Components
Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16
1 / 16 Virtualization P. A. Wilsey The text highlighted in green in these slides contain external hyperlinks. 2 / 16 Conventional System Viewed as Layers This illustration is a common presentation of the
Frontiers in Cyber Security: Beyond the OS
2013 DHS S&T/DoD ASD (R&E) CYBER SECURITY SBIR WORKSHOP Frontiers in Cyber Security: Beyond the OS Clear Hat Consulting, Inc. Sherri Sparks 7/23/13 Company Profile CHC was founded in 2007 by S. Sparks
Chapter 2 Addendum (More on Virtualization)
Chapter 2 Addendum (More on Virtualization) Roch Glitho, PhD Associate Professor and Canada Research Chair My URL - http://users.encs.concordia.ca/~glitho/ More on Systems Virtualization Type I (bare metal)
AWE: Improving Software Analysis through Modular Integration of Static and Dynamic Analyses *
AWE: Improving Software Analysis through Modular Integration of Static and Dynamic Analyses * Ruben E. Brown Roger Khazan MIT Lincoln Laboratory 244 Wood Street, Lexington, MA USA {rebrown,rkh,mzhivich}@ll.mit.edu
Virtualization Technologies and Blackboard: The Future of Blackboard Software on Multi-Core Technologies
Virtualization Technologies and Blackboard: The Future of Blackboard Software on Multi-Core Technologies Kurt Klemperer, Principal System Performance Engineer kklemperer@blackboard.com Agenda Session Length:
Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs
Code Injection From the Hypervisor: Removing the need for in-guest agents Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs SADE: SteAlthy Deployment and Execution Introduction
9/26/2011. What is Virtualization? What are the different types of virtualization.
CSE 501 Monday, September 26, 2011 Kevin Cleary kpcleary@buffalo.edu What is Virtualization? What are the different types of virtualization. Practical Uses Popular virtualization products Demo Question,
Introducing Ring -3 Rootkits
Introducing Ring -3 Rootkits Alexander Tereshkin and Rafal Wojtczuk Black Hat USA, July 29 2009 Las Vegas, NV 1 Introducing Ring -3 2 Getting there 3 Writing useful Ring -3 rootkits A Quest to Ring -3
A Survey on Virtual Machine Security
A Survey on Virtual Machine Security Jenni Susan Reuben Helsinki University of Technology jreubens@cc.hut.fi Abstract Virtualization plays a major role in helping the organizations to reduce the operational
Inside a killer IMBot. Wei Ming Khoo University of Cambridge 19 Nov 2010
Do you? or Inside a killer IMBot Wei Ming Khoo University of Cambridge 19 Nov 2010 Background Tracking a botnet propagating over Skype & Yahoo IM. Bait is Foto Exploits social connectivity (friend
Hypervisors and Virtual Machines
Hypervisors and Virtual Machines Implementation Insights on the x86 Architecture DON REVELLE Don is a performance engineer and Linux systems/kernel programmer, specializing in high-volume UNIX, Web, virtualization,
Architecture of the Kernel-based Virtual Machine (KVM)
Corporate Technology Architecture of the Kernel-based Virtual Machine (KVM) Jan Kiszka, Siemens AG, CT T DE IT 1 Corporate Competence Center Embedded Linux jan.kiszka@siemens.com Copyright Siemens AG 2010.
Survey on virtual machine security
Survey on virtual machine security Bright Prabahar P Post Graduate Scholar Karunya university Bijolin Edwin E Assistant professor Karunya university Abstract Virtualization takes a major role in cloud
Full and Para Virtualization
Full and Para Virtualization Dr. Sanjay P. Ahuja, Ph.D. 2010-14 FIS Distinguished Professor of Computer Science School of Computing, UNF x86 Hardware Virtualization The x86 architecture offers four levels
Achieving business benefits through automated software testing. By Dr. Mike Bartley, Founder and CEO, TVS (mike@testandverification.
Achieving business benefits through automated software testing By Dr. Mike Bartley, Founder and CEO, TVS (mike@testandverification.com) 1 Introduction During my experience of test automation I have seen
A lap around Team Foundation Server 2015 en Visual Studio 2015
A lap around Team Foundation Server 2015 en Visual Studio 2015 René van Osnabrugge ALM Consultant, Xpirit rvanosnabrugge@xpirit.com http://roadtoalm.com @renevo About me Also Scrum Master rvanosnabrugge@xpirit.com
Virtual Switching Without a Hypervisor for a More Secure Cloud
ing Without a for a More Secure Cloud Xin Jin Princeton University Joint work with Eric Keller(UPenn) and Jennifer Rexford(Princeton) 1 Public Cloud Infrastructure Cloud providers offer computing resources
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor?
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Mr. Jacob Torrey February 26, 2014 Dartmouth College 153 Brooks Road, Rome, NY 315.336.3306 http://ainfosec.com @JacobTorrey