Attacking Hypervisors via Firmware and Hardware

Size: px
Start display at page:

Download "Attacking Hypervisors via Firmware and Hardware"

Transcription

1 Attacking Hypervisors via Firmware and Hardware Alex Matrosov Mikhail Gorobets, Oleksandr Bazhaniuk Andrew Furtak, Yuriy Bulygin Advanced Threat Research

2 Agenda Hypervisor based isolation Firmware rootkit vs hypervisor Attacking hypervisors through system firmware Tools and mitigations Conclusions

3 Image source Hypervisor Based Isolation

4 Hypervisor Based Isolation Virtual Machine Virtual Machine App App App App Operating System Operating System Privilege VMM / Hypervisor System Firmware (BIOS, U/EFI firmware, SMI handlers, Coreboot ) Memory Hardware CPU Graphics I/O Network

5 Hypervisor Based Isolation Virtual Machine Virtual Machine App App App Attack Operating System Operating System Privilege VMM / Hypervisor System Firmware (BIOS, U/EFI firmware, SMI handlers, Coreboot ) Memory Hardware CPU Graphics I/O Network

6 Hypervisor Protections Software Isolation CPU / SoC: traps to hypervisor (VM Exits), MSR & I/O permissions bitmaps, rings (PV) Memory / MMIO: hardware page tables (e.g. EPT, NPT), software shadow page tables Devices Isolation CPU / SoC: interrupt remapping Memory / MMIO: IOMMU, No-DMA ranges

7 CPU Virtualization (simplified) VM Guest OS Instructions, exceptions, interrupts Access to CPU MSRs (e.g. DEBUGCTL) Access to I/O ports Access to (e.g. 0xB2) memory (EPT violations) Hypervisor Traps (VM Exits) VMM Host VM Exit Handler VM Control Structure (VMCS) MSR Bitmaps Extended Page Tables I/O Bitmaps

8 Protecting Memory with HW Assisted Paging VM Guest OS VMM Host Process Virtual Memory CR3 Guest Physical Memory GPA0 VMCS EPTP Host Physical Memory HPA0 VA0 Guest Page Tables GPA1 EPT HPA1 VA1 GPA2 GPA0 HPA3 HPA2 VA2 GPA3 GPA2 HPA5 HPA3 VA3 VA4 GPA4 GPA5 GPA6 GPA4 HPA4 (1:1 mapping) GPA6 block HPA4 HPA5 HPA6

9 Hypervisor Protections System Firmware Isolation

10 Firmware Rootkit vs Hypervisor Image source

11 What is firmware rootkit? Virtual Machine Virtual Machine App App App App Operating System Operating System Privilege VMM / Hypervisor System Firmware Rootkit (e.g. DXE driver) Memory Hardware CPU Graphics I/O Network

12 Firmware rootkit can open a backdoor for an attacker VM to access all other VMs Virtual Machine App App Operating System Attacker VM App App Operating System 3. Now using this backdoor, attacker VM can access all of memory of victim VMs VMM / Hypervisor System Firmware Backdoor Rootkit 2. During each boot rootkit installs a backdoor for an attacker controlled VM 1. At some point system firmware got infected with a rootkit staying persistent

13 Backdoor for attacker s VM 1. Firmware rootkit searches & modifies VM s VMCS(B), VMM page tables 2. Rootkit added page table entries to attacker VM which expose entire physical memory Now attacker VM has full access to physical memory of VMM and other VMs

14 So how would one install a rootkit in the firmware?

15 Using hardware SPI flash programmer

16 USB & exploiting weak firmware protections...

17 Software access and exploiting some vulnerability in firmware From privileged guest (e.g. Dom0). Requires privesc from normal guest (e.g. DomU) or remote From the host OS before/in parallel to VMM From normal guest if firmware is exposed to the guest by VMM For example, if firmware is not adequately write protected in system flash memory

18 DEMO Rootkit in System Firmware Exposes Secrets from Virtual Machines https://youtu.be/sjniipn0104 Image source

19 We flashed rootkited part of firmware image from within a root partition to install the rootkit The system doesn t properly protect firmware in SPI flash memory so we could bypass write-protection Finally more systems protect firmware on the flash memory common.bios_wp CHIPSEC module to test write-protection Malware can exploit vulnerabilities in firmware to install a rootkit on such systems Attacking and Defending BIOS in 2015

20 VMM forensics With the help of a rootkit in firmware any VM guest can extract all information about hypervisor and other VMs and just from memory VMCS structures, MSR and I/O bitmaps for each VM guest EPT for each VM guest Regular page tables for hypervisor and each VM guest IOMMU pages tables for each IOMMU device Full hypervisor memory map, VM exit handler Real hardware configuration (registers for real PCIe devices, MMIO contents )

21 VMM Hardware Page Tables

22 Attacking Hypervisors through System Firmware (with OS kernel access) Image source

23 Pointer Vulnerabilities in SMI Handlers Phys Memory RAX (code) RBX (pointer) RCX (function) RDX RSI RDI SMI SMI Handlers in SMRAM Fake structure inside SMRAM OS Memory Exploit tricks SMI handler to write to an address inside SMRAM Attacking and Defending BIOS in 2015

24 SMI Pointer Exploiting firmware SMI handler to attack VMM Virtual Machine (child partition) App App Operating System Root partition App Attack Operating System VMM allows VM to invoke SMI handlers (grants access to SW SMI I/O port 0xB2) Memory Hypervisor SMI Handlers System Firmware I/O Hardware CPU Network Graphics Compromised VM injects SMM payload through the input pointer vulnerability in SMI handler SMM firmware payload modifies hypervisor code or VMCS/EPT to install a backdoor

25 DEMO Attacking Hypervisor via Poisonous Pointers in Firmware SMI handlers https://youtu.be/zujel9cgse8

26 Root cause? Port B2h is open to VM in I/O bitmap

27 So this is firmware issue, right? What if firmware validates pointers?

28 Still exploitable Phys Memory RAX (code) RBX (pointer) RCX (function) RDX RSI RDI SMI SMI Handlers in SMRAM Hypervisor Memory (Protected by EPT) Firmware SMI handler validates input pointers to ensure they are outside of SMRAM preventing overwrite of SMI code/data

29 Point SMI handler to overwrite VMM page! Phys Memory RAX (code) RBX (pointer) SMI SMI Handlers in SMRAM RCX (function) RDX RSI RDI Hypervisor Memory (Protected by EPT) VMM Protected Page VMM Protections are OFF VT state and EPT protections are OFF in SMM (without STM) SMI handler writes to a protected page via supplied pointer

30 Attacking VMM by proxying through SMI handler Virtual Machine (child partition) App App Operating System Root partition App Attack Operating System VM with direct access to SMIs invokes SMI handler and supplies a pointer to some VMM page VMM / Hypervisor Memory SMI Handlers System Firmware Hardware CPU Graphics SMI handler writes to the supplied pointer overwriting contents of protected VMM page I/O Network

31 Do Hypervisors Dream of Electric Sheep? Vulnerability used in this section is VU# a.k.a. S3 Resume Boot Script Vulnerability independently discovered by ATR of Intel Security, Rafal Wojtczuk of Bromium and LegbaCore It s also used in Thunderstrike 2 by LegbaCore & Trammell Hudson

32 NORMAL BOOT S3 RESUME Waking the system from S3 sleep state Virtual Machine Apps / OS BDS VMM / Hypervisor U/EFI System Firmware DXE UEFI core & drivers S3 Boot Script Table Restores hardware config Script Engine Platform Init Platform Init

33 What is S3 boot script table? A table of opcodes in physical memory which restores platform configuration S3_BOOTSCRIPT_MEM_WRITE opcode writes some value to specified memory location on behalf of firmware S3_BOOTSCRIPT_DISPATCH/2 S3_BOOTSCRIPT_PCI_CONFIG_WRITE S3_BOOTSCRIPT_IO_WRITE

34 NORMAL BOOT S3 RESUME MODIFY Xen exposes S3 boot script table to Dom0 Privileged PV guest (Dom0) Exploit VM modifies S3 boot script table in memory Upon resume, firmware executes rogue S3 script Xen Hypervisor U/EFI System Firmware BDS DXE UEFI core & drivers S3 Boot Script Table Restores hardware config Script Engine Platform PEI 0xDBAA4000 Platform PEI

35 DEMO Attacking Xen in its sleep https://youtu.be/dsu-scejyjg Image source

36 Déjà vu? Xen 0wning Trilogy (Part 3) by Invisible Things Lab

37 So these firmware vulnerabilities are exploitable from privileged guest (e.g. root partition, Dom0..) What about use cases where guests must be strongly isolated from the root partition?

38 Image sciencenews.org Tools and Mitigations

39 First things first - fix that firmware! Firmware can be tested for vulnerabilities! common.uefi.s3bootscript (tests S3 boot script protections) tools.smm.smm_ptr (tests for SMI pointer issues) Protect the firmware in system flash memory common.bios_wp common.spi_lock... (tests firmware protections in system flash memory)

40 Testing hypervisors Simple hardware emulation fuzzing modules for open source CHIPSEC tools.vmm.*_fuzz I/O, MSR, PCIe device, MMIO overlap, more soon Tools to explore VMM hardware config chipsec_util iommu (IOMMU) chipsec_util vm (CPU VM extensions)

41 Dealing with system firmware attacks.. A number of interfaces through which firmware can be attacked or relay attack onto VMM UEFI variables, SMI handlers, S3 boot script, SPI flash MMIO, FW update.. FW doesn t know memory VMM needs to protect VMM need to be careful with which of these it exposes to VMs including to administrative (privileged) guests Some need not be exposed (e.g. S3 boot script), some may be emulated and monitored

42 Conclusions Compromised firmware is bad news for VMM. Test your system s firmware for security issues Windows 10 enables path for firmware deployment via Windows Update Secure privileged/administrative guests; attacks from such guests are important Vulnerabilities in device and CPU emulation are very common. Fuzz all HW interfaces Firmware interfaces/features may affect hypervisor security if exposed to VMs. Both need to be designed to be aware of each other

43 References 1. CHIPSEC: https://github.com/chipsec/chipsec 2. Intel s ATR Security of System Firmware 3. Attacking and Defending BIOS in 2015 by Intel ATR 4. Hardware Involved Software Attacks by Jeff Forristal 5. Xen 0wning Trilogy by Invisible Things Lab Low level PC attack papers by Xeno Kovah

44 Thank you!

Attacking Hypervisors via Firmware and Hardware

Attacking Hypervisors via Firmware and Hardware Attacking Hypervisors via Firmware and Hardware Mikhail Gorobets, Oleksandr Bazhaniuk, Alex Matrosov, Andrew Furtak, Yuriy Bulygin Advanced Threat Research Agenda Hypervisor based isolation Firmware rootkit

More information

Nested Virtualization

Nested Virtualization Nested Virtualization Dongxiao Xu, Xiantao Zhang, Yang Zhang May 9, 2013 Agenda Nested Virtualization Overview Dive into Nested Virtualization Details Nested CPU Virtualization Nested MMU Virtualization

More information

Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor?

Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Mr. Jacob Torrey February 26, 2014 Dartmouth College 153 Brooks Road, Rome, NY 315.336.3306 http://ainfosec.com @JacobTorrey

More information

A Tour Beyond BIOS Supporting an SMM Resource Monitor using the EFI Developer Kit II

A Tour Beyond BIOS Supporting an SMM Resource Monitor using the EFI Developer Kit II White Paper A Tour Beyond BIOS Supporting an SMM Resource Monitor using the EFI Developer Kit II Jiewen Yao Intel Corporation Vincent J. Zimmer Intel Corporation June 2015 i Executive Summary In the current

More information

Virtual Machine Security

Virtual Machine Security Virtual Machine Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ 1 Operating System Quandary Q: What is the primary goal

More information

Bluepilling the Xen Hypervisor

Bluepilling the Xen Hypervisor Bluepilling the Xen Hypervisor Joanna Rutkowska & Alexander Tereshkin Invisible Things Lab Black Hat USA 2008, August 7th, Las Vegas, NV Xen 0wning Trilogy Part Three Previously on Xen 0wning Trilogy...

More information

A Hypervisor IPS based on Hardware assisted Virtualization Technology

A Hypervisor IPS based on Hardware assisted Virtualization Technology A Hypervisor IPS based on Hardware assisted Virtualization Technology 1. Introduction Junichi Murakami (murakami@fourteenforty.jp) Fourteenforty Research Institute, Inc. Recently malware has become more

More information

Introducing Ring -3 Rootkits

Introducing Ring -3 Rootkits Introducing Ring -3 Rootkits Alexander Tereshkin and Rafal Wojtczuk Black Hat USA, July 29 2009 Las Vegas, NV 1 Introducing Ring -3 2 Getting there 3 Writing useful Ring -3 rootkits A Quest to Ring -3

More information

Intel Virtualization Technology Overview Yu Ke

Intel Virtualization Technology Overview Yu Ke Intel Virtualization Technology Overview Yu Ke SSG System Software Division Agenda Virtualization Overview Intel Virtualization Technology 2 What is Virtualization VM 0 VM 1 VM n Virtual Machines (VMs)

More information

Securing Your Cloud with Xen Project s Advanced Security Features

Securing Your Cloud with Xen Project s Advanced Security Features Securing Your Cloud with Xen Project s Advanced Security Features Russell Pavlicek, Xen Project Evangelist CloudOpen North America 2013 Who is the Old, Fat Geek Up Front? Xen Project Evangelist Employed

More information

Knut Omang Ifi/Oracle 19 Oct, 2015

Knut Omang Ifi/Oracle 19 Oct, 2015 Software and hardware support for Network Virtualization Knut Omang Ifi/Oracle 19 Oct, 2015 Motivation Goal: Introduction to challenges in providing fast networking to virtual machines Prerequisites: What

More information

Virtualization Technology. Zhiming Shen

Virtualization Technology. Zhiming Shen Virtualization Technology Zhiming Shen Virtualization: rejuvenation 1960 s: first track of virtualization Time and resource sharing on expensive mainframes IBM VM/370 Late 1970 s and early 1980 s: became

More information

Virtual machines and operating systems

Virtual machines and operating systems V i r t u a l m a c h i n e s a n d o p e r a t i n g s y s t e m s Virtual machines and operating systems Krzysztof Lichota lichota@mimuw.edu.pl A g e n d a Virtual machines and operating systems interactions

More information

Compromise-as-a-Service

Compromise-as-a-Service ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg 3/31/14 Compromise-as-a-Service Our PleAZURE Felix Wilhelm & Matthias Luft {fwilhelm, mluft}@ernw.de ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg Agenda

More information

matasano Hardware Virtualization Rootkits Dino A. Dai Zovi

matasano Hardware Virtualization Rootkits Dino A. Dai Zovi Hardware Virtualization Rootkits Dino A. Dai Zovi Agenda Introductions Virtualization (Software and Hardware) Intel VT-x (aka Vanderpool ) VM Rootkits Implementing a VT-x based Rootkit Detecting Hardware-VM

More information

Security Challenges in Virtualized Environments

Security Challenges in Virtualized Environments Security Challenges in Virtualized Environments Joanna Rutkowska, Invisible Things Lab Confidence 2008, Krakow, Poland, May 15th, 2008 1 Virtualization-based MALWARE 2 Using Virtual Machines for ISOLATION

More information

Uses for Virtual Machines. Virtual Machines. There are several uses for virtual machines:

Uses for Virtual Machines. Virtual Machines. There are several uses for virtual machines: Virtual Machines Uses for Virtual Machines Virtual machine technology, often just called virtualization, makes one computer behave as several computers by sharing the resources of a single computer between

More information

The Microsoft Windows Hypervisor High Level Architecture

The Microsoft Windows Hypervisor High Level Architecture The Microsoft Windows Hypervisor High Level Architecture September 21, 2007 Abstract The Microsoft Windows hypervisor brings new virtualization capabilities to the Windows Server operating system. Its

More information

Chapter 5 Cloud Resource Virtualization

Chapter 5 Cloud Resource Virtualization Chapter 5 Cloud Resource Virtualization Contents Virtualization. Layering and virtualization. Virtual machine monitor. Virtual machine. Performance and security isolation. Architectural support for virtualization.

More information

UEFI Firmware Security Best Practices

UEFI Firmware Security Best Practices UEFI Firmware Security Best Practices Presented by: Dick Wilkins, PhD Principal Technology Liaison presented by UEFI Plugfest May 2014 Agenda Introduction Threats and Vulnerabilities Mitigation Guidelines

More information

Windows Server Virtualization & The Windows Hypervisor

Windows Server Virtualization & The Windows Hypervisor Windows Server Virtualization & The Windows Hypervisor Brandon Baker Lead Security Engineer Windows Kernel Team Microsoft Corporation Agenda - Windows Server Virtualization (WSV) Why a hypervisor? Quick

More information

Virtualization. Types of Interfaces

Virtualization. Types of Interfaces Virtualization Virtualization: extend or replace an existing interface to mimic the behavior of another system. Introduced in 1970s: run legacy software on newer mainframe hardware Handle platform diversity

More information

Hypervisors. Introduction. Introduction. Introduction. Introduction. Introduction. Credits:

Hypervisors. Introduction. Introduction. Introduction. Introduction. Introduction. Credits: Hypervisors Credits: P. Chaganti Xen Virtualization A practical handbook D. Chisnall The definitive guide to Xen Hypervisor G. Kesden Lect. 25 CS 15-440 G. Heiser UNSW/NICTA/OKL Virtualization is a technique

More information

Basics in Energy Information (& Communication) Systems Virtualization / Virtual Machines

Basics in Energy Information (& Communication) Systems Virtualization / Virtual Machines Basics in Energy Information (& Communication) Systems Virtualization / Virtual Machines Dr. Johann Pohany, Virtualization Virtualization deals with extending or replacing an existing interface so as to

More information

Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs

Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs Code Injection From the Hypervisor: Removing the need for in-guest agents Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs SADE: SteAlthy Deployment and Execution Introduction

More information

Distributed Systems. Virtualization. Paul Krzyzanowski pxk@cs.rutgers.edu

Distributed Systems. Virtualization. Paul Krzyzanowski pxk@cs.rutgers.edu Distributed Systems Virtualization Paul Krzyzanowski pxk@cs.rutgers.edu Except as otherwise noted, the content of this presentation is licensed under the Creative Commons Attribution 2.5 License. Virtualization

More information

POACHER TURNED GATEKEEPER: LESSONS LEARNED FROM EIGHT YEARS OF BREAKING HYPERVISORS. Rafal Wojtczuk

POACHER TURNED GATEKEEPER: LESSONS LEARNED FROM EIGHT YEARS OF BREAKING HYPERVISORS. Rafal Wojtczuk <rafal@bromium.com> POACHER TURNED GATEKEEPER: LESSONS LEARNED FROM EIGHT YEARS OF BREAKING HYPERVISORS Rafal Wojtczuk Agenda About the speaker Types of hypervisors Attack surface Examples of past and

More information

Chapter 2 Technical Background, Preliminaries and Assumptions

Chapter 2 Technical Background, Preliminaries and Assumptions Chapter 2 Technical Background, Preliminaries and Assumptions Putting a computer in front of a child and expecting it to teach him is like putting a book under his pillow, only more expensive. Joseph Weizenbaum,

More information

Cloud^H^H^H^H^H Virtualization Technology. Andrew Jones (drjones@redhat.com) May 2011

Cloud^H^H^H^H^H Virtualization Technology. Andrew Jones (drjones@redhat.com) May 2011 Cloud^H^H^H^H^H Virtualization Technology Andrew Jones (drjones@redhat.com) May 2011 Outline Promise to not use the word Cloud again...but still give a couple use cases for Virtualization Emulation it's

More information

Requirements for an Integrity-Protected Hypervisor on the x86 Hardware Virtualized Architecture

Requirements for an Integrity-Protected Hypervisor on the x86 Hardware Virtualized Architecture Requirements for an Integrity-Protected Hypervisor on the x86 Hardware Virtualized Architecture Amit Vasudevan 1, Jonathan M. McCune 1, Ning Qu 2, Leendert van Doorn 3, and Adrian Perrig 1 1 CyLab, Carnegie

More information

Attacking Intel Trusted Execution Technology

Attacking Intel Trusted Execution Technology Attacking Intel Trusted Execution Technology Rafal Wojtczuk rafal@invisiblethingslab.com Joanna Rutkowska joanna@invisiblethingslab.com ---===[ Invisible Things Lab ]===--- Abstract In this paper we present

More information

Full and Para Virtualization

Full and Para Virtualization Full and Para Virtualization Dr. Sanjay P. Ahuja, Ph.D. 2010-14 FIS Distinguished Professor of Computer Science School of Computing, UNF x86 Hardware Virtualization The x86 architecture offers four levels

More information

OSes. Arvind Seshadri Mark Luk Ning Qu Adrian Perrig SOSP2007. CyLab of CMU. SecVisor: A Tiny Hypervisor to Provide

OSes. Arvind Seshadri Mark Luk Ning Qu Adrian Perrig SOSP2007. CyLab of CMU. SecVisor: A Tiny Hypervisor to Provide SecVisor: A Seshadri Mark Luk Ning Qu CyLab of CMU SOSP2007 Outline Introduction Assumption SVM Background Design Problems Implementation Kernel Porting Evaluation Limitation Introducion Why? Only approved

More information

Virtualization in Linux KVM + QEMU

Virtualization in Linux KVM + QEMU CS695 Topics in Virtualization and Cloud Computing KVM + QEMU Senthil, Puru, Prateek and Shashank 1 Topics covered KVM and QEMU Architecture VTx support CPU virtualization in KMV Memory virtualization

More information

Advanced Computer Networks. Network I/O Virtualization

Advanced Computer Networks. Network I/O Virtualization Advanced Computer Networks 263 3501 00 Network I/O Virtualization Patrick Stuedi Spring Semester 2014 Oriana Riva, Department of Computer Science ETH Zürich 1 Outline Last week: Today: Software Defined

More information

Virtualization. Pradipta De pradipta.de@sunykorea.ac.kr

Virtualization. Pradipta De pradipta.de@sunykorea.ac.kr Virtualization Pradipta De pradipta.de@sunykorea.ac.kr Today s Topic Virtualization Basics System Virtualization Techniques CSE506: Ext Filesystem 2 Virtualization? A virtual machine (VM) is an emulation

More information

Securing your Virtual Datacenter. Part 1: Preventing, Mitigating Privilege Escalation

Securing your Virtual Datacenter. Part 1: Preventing, Mitigating Privilege Escalation Securing your Virtual Datacenter Part 1: Preventing, Mitigating Privilege Escalation Before We Start... Today's discussion is by no means an exhaustive discussion of the security implications of virtualization

More information

Virtual Machines. COMP 3361: Operating Systems I Winter 2015 http://www.cs.du.edu/3361

Virtual Machines. COMP 3361: Operating Systems I Winter 2015 http://www.cs.du.edu/3361 s COMP 3361: Operating Systems I Winter 2015 http://www.cs.du.edu/3361 1 Virtualization! Create illusion of multiple machines on the same physical hardware! Single computer hosts multiple virtual machines

More information

COS 318: Operating Systems. Virtual Machine Monitors

COS 318: Operating Systems. Virtual Machine Monitors COS 318: Operating Systems Virtual Machine Monitors Kai Li and Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall13/cos318/ Introduction u Have

More information

Virtualization. Dr. Yingwu Zhu

Virtualization. Dr. Yingwu Zhu Virtualization Dr. Yingwu Zhu What is virtualization? Virtualization allows one computer to do the job of multiple computers. Virtual environments let one computer host multiple operating systems at the

More information

Virtualization. Jukka K. Nurminen 23.9.2015

Virtualization. Jukka K. Nurminen 23.9.2015 Virtualization Jukka K. Nurminen 23.9.2015 Virtualization Virtualization refers to the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms,

More information

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013

CS 356 Lecture 25 and 26 Operating System Security. Spring 2013 CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control

More information

Betting BIOS Bugs Won t Bite Y er Butt? Xeno Kovah Corey Kallenberg

Betting BIOS Bugs Won t Bite Y er Butt? Xeno Kovah Corey Kallenberg Betting BIOS Bugs Won t Bite Y er Butt? Xeno Kovah Corey Kallenberg About us MITRE researchers for the past 7.5 years As of today, full @me at LegbaCore! Focused on low level x86 security at the kernel

More information

A Tale of One Software Bypass of Windows 8 Secure Boot. Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk

A Tale of One Software Bypass of Windows 8 Secure Boot. Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk A Tale of One Software Bypass of Windows 8 Secure Boot Yuriy Bulygin Andrew Furtak Oleksandr Bazhaniuk and Bootkits Windows 8 Secure Boot Attacking Secure Boot Recommendations Agenda and Bootkits OS Kernel

More information

McAfee Deep Safe. Security beyond the OS. Kai-Ping Seidenschnur Senior Security Engineer. October 16, 2012

McAfee Deep Safe. Security beyond the OS. Kai-Ping Seidenschnur Senior Security Engineer. October 16, 2012 McAfee Deep Safe Security beyond the OS Kai-Ping Seidenschnur Senior Security Engineer October 16, 2012 Intel/McAfee Initiatives: epo Deep Command and Deep Defender McAfee epo Deep Command Security Management

More information

Virtualization. Jia Rao Assistant Professor in CS http://cs.uccs.edu/~jrao/

Virtualization. Jia Rao Assistant Professor in CS http://cs.uccs.edu/~jrao/ Virtualization Jia Rao Assistant Professor in CS http://cs.uccs.edu/~jrao/ What is Virtualization? Virtualization is the simulation of the software and/ or hardware upon which other software runs. This

More information

Introduction to the NI Real-Time Hypervisor

Introduction to the NI Real-Time Hypervisor Introduction to the NI Real-Time Hypervisor 1 Agenda 1) NI Real-Time Hypervisor overview 2) Basics of virtualization technology 3) Configuring and using Real-Time Hypervisor systems 4) Performance and

More information

OS Virtualization Frank Hofmann

OS Virtualization Frank Hofmann OS Virtualization Frank Hofmann OP/N1 Released Products Engineering Sun Microsystems UK Overview Different approaches to virtualization > Compartmentalization > System Personalities > Virtual Machines

More information

KVM: Kernel-based Virtualization Driver

KVM: Kernel-based Virtualization Driver KVM: Kernel-based Virtualization Driver White Paper Overview The current interest in virtualization has led to the creation of several different hypervisors. Most of these, however, predate hardware-assisted

More information

Basics of Virtualisation

Basics of Virtualisation Basics of Virtualisation Volker Büge Institut für Experimentelle Kernphysik Universität Karlsruhe Die Kooperation von The x86 Architecture Why do we need virtualisation? x86 based operating systems are

More information

CS5460: Operating Systems. Lecture: Virtualization 2. Anton Burtsev March, 2013

CS5460: Operating Systems. Lecture: Virtualization 2. Anton Burtsev March, 2013 CS5460: Operating Systems Lecture: Virtualization 2 Anton Burtsev March, 2013 Paravirtualization: Xen Full virtualization Complete illusion of physical hardware Trap _all_ sensitive instructions Virtualized

More information

UNCLASSIFIED Version 1.0 May 2012

UNCLASSIFIED Version 1.0 May 2012 Secure By Default: Platforms Computing platforms contain vulnerabilities that can be exploited for malicious purposes. Often exploitation does not require a high degree of expertise, as tools and advice

More information

Secure In-VM Monitoring Using Hardware Virtualization

Secure In-VM Monitoring Using Hardware Virtualization Secure In-VM Monitoring Using Hardware Virtualization Monirul Sharif Georgia Institute of Technology Atlanta, GA, USA msharif@cc.gatech.edu Wenke Lee Georgia Institute of Technology Atlanta, GA, USA wenke@cc.gatech.edu

More information

FRONT FLYLEAF PAGE. This page has been intentionally left blank

FRONT FLYLEAF PAGE. This page has been intentionally left blank FRONT FLYLEAF PAGE This page has been intentionally left blank Abstract The research performed under this publication will combine virtualization technology with current kernel debugging techniques to

More information

Kernel Virtual Machine

Kernel Virtual Machine Kernel Virtual Machine Shashank Rachamalla Indian Institute of Technology Dept. of Computer Science November 24, 2011 Abstract KVM(Kernel-based Virtual Machine) is a full virtualization solution for x86

More information

Hybrid Virtualization The Next Generation of XenLinux

Hybrid Virtualization The Next Generation of XenLinux Hybrid Virtualization The Next Generation of XenLinux Jun Nakajima Principal Engineer Intel Open Source Technology Center Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL

More information

Virtualization System Vulnerability Discovery Framework. Speaker: Qinghao Tang Title:360 Marvel Team Leader

Virtualization System Vulnerability Discovery Framework. Speaker: Qinghao Tang Title:360 Marvel Team Leader Virtualization System Vulnerability Discovery Framework Speaker: Qinghao Tang Title:360 Marvel Team Leader 1 360 Marvel Team Established in May 2015, the first professional could computing and virtualization

More information

Subverting the Xen hypervisor

Subverting the Xen hypervisor Subverting the Xen hypervisor Rafał Wojtczuk Invisible Things Lab Black Hat USA 2008, August 7th, Las Vegas, NV Xen 0wning Trilogy Part One Known virtulizationbased rootkits Bluepill and Vitriol They install

More information

MODULE 3 VIRTUALIZED DATA CENTER COMPUTE

MODULE 3 VIRTUALIZED DATA CENTER COMPUTE MODULE 3 VIRTUALIZED DATA CENTER COMPUTE Module 3: Virtualized Data Center Compute Upon completion of this module, you should be able to: Describe compute virtualization Discuss the compute virtualization

More information

Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16

Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16 Virtualization P. A. Wilsey The text highlighted in green in these slides contain external hyperlinks. 1 / 16 Conventional System Viewed as Layers This illustration is a common presentation of the application/operating

More information

EE282 Lecture 11 Virtualization & Datacenter Introduction

EE282 Lecture 11 Virtualization & Datacenter Introduction EE282 Lecture 11 Virtualization & Datacenter Introduction Christos(Kozyrakis( ( h.p://ee282.stanford.edu( EE282$ $Spring$2013$ $Lecture$11$ Announcements Project 1 is due on 5/8 th HW2 is due on 5/20 th

More information

Distributed System Monitoring and Failure Diagnosis using Cooperative Virtual Backdoors

Distributed System Monitoring and Failure Diagnosis using Cooperative Virtual Backdoors Distributed System Monitoring and Failure Diagnosis using Cooperative Virtual Backdoors Benoit Boissinot E.N.S Lyon directed by Christine Morin IRISA/INRIA Rennes Liviu Iftode Rutgers University Phenix

More information

Virtualization. ! Physical Hardware. ! Software. ! Isolation. ! Software Abstraction. ! Encapsulation. ! Virtualization Layer. !

Virtualization. ! Physical Hardware. ! Software. ! Isolation. ! Software Abstraction. ! Encapsulation. ! Virtualization Layer. ! Starting Point: A Physical Machine Virtualization Based on materials from: Introduction to Virtual Machines by Carl Waldspurger Understanding Intel Virtualization Technology (VT) by N. B. Sahgal and D.

More information

Virtualization Technologies

Virtualization Technologies 12 January 2010 Virtualization Technologies Alex Landau (lalex@il.ibm.com) IBM Haifa Research Lab What is virtualization? Virtualization is way to run multiple operating systems and user applications on

More information

Virtualization Technology

Virtualization Technology Virtualization Technology A Manifold Arms Race Michael H. Warfield Senior Researcher and Analyst mhw@linux.vnet.ibm.com 2008 IBM Corporation Food for Thought Is Virtual Reality an oxymoron or is it the

More information

Abstract. 1. Introduction. 2. Threat Model

Abstract. 1. Introduction. 2. Threat Model Beyond Ring-3: Fine Grained Application Sandboxing Ravi Sahita (ravi.sahita@intel.com), Divya Kolar (divya.kolar@intel.com) Communication Technology Lab. Intel Corporation Abstract In the recent years

More information

Virtualization System Security

Virtualization System Security Virtualization System Security Bryan Williams, IBM X-Force Advanced Research Tom Cross, Manager, IBM X-Force Security Strategy 2009 IBM Corporation Overview Vulnerability disclosure analysis Vulnerability

More information

Too Young to be Secure: Analysis of UEFI Threats and Vulnerabilities

Too Young to be Secure: Analysis of UEFI Threats and Vulnerabilities St. Petersburg State University of Aerospace Instrumentation Department of Information Systems Security Too Young to be Secure: Analysis of UEFI Threats and Vulnerabilities Anton Sergeev Vladimir Bashun

More information

Frontiers in Cyber Security: Beyond the OS

Frontiers in Cyber Security: Beyond the OS 2013 DHS S&T/DoD ASD (R&E) CYBER SECURITY SBIR WORKSHOP Frontiers in Cyber Security: Beyond the OS Clear Hat Consulting, Inc. Sherri Sparks 7/23/13 Company Profile CHC was founded in 2007 by S. Sparks

More information

Virtualization for Security

Virtualization for Security Virtualization for Security t j Including Sandboxing, Disaster Recovery, High Availability, Forensic Analysis, and Honeypotting John Hoopes Technical Editor Aaron Bawcom Paul Kenealy Wesley J. Noonan Craig

More information

IOS110. Virtualization 5/27/2014 1

IOS110. Virtualization 5/27/2014 1 IOS110 Virtualization 5/27/2014 1 Agenda What is Virtualization? Types of Virtualization. Advantages and Disadvantages. Virtualization software Hyper V What is Virtualization? Virtualization Refers to

More information

On the Feasibility of Software Attacks on Commodity Virtual Machine Monitors via Direct Device Assignment

On the Feasibility of Software Attacks on Commodity Virtual Machine Monitors via Direct Device Assignment On the Feasibility of Software Attacks on Commodity Virtual Machine Monitors via Direct Device Assignment Gábor Pék CrySyS Lab, BME Budapest, Hungary pek@crysys.hu Davide Balzarotti Eurecom Sophia Anitpolis,

More information

Intel Trusted Platforms Overview

Intel Trusted Platforms Overview Intel Trusted Platforms Overview Greg Clifton Intel Customer Solutions Group Director, DoD & Intelligence 2006 Intel Corporation Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION

More information

kvm: Kernel-based Virtual Machine for Linux

kvm: Kernel-based Virtual Machine for Linux kvm: Kernel-based Virtual Machine for Linux 1 Company Overview Founded 2005 A Delaware corporation Locations US Office Santa Clara, CA R&D - Netanya/Poleg Funding Expertise in enterprise infrastructure

More information

Hardware virtualization technology and its security

Hardware virtualization technology and its security Hardware virtualization technology and its security Dr. Qingni Shen Peking University Intel UPO Supported Main Points VMM technology Intel VT technology Security analysis of Intel VT-d Virtual Machine

More information

Post-Access Cyber Defense

Post-Access Cyber Defense Post-Access Cyber Defense Dr. Vipin Swarup Chief Scientist, Cyber Security The MITRE Corporation November 2015 Approved for Public Release; Distribution Unlimited. 15-3647. 2 Cyber Security Technical Center

More information

Guardian: Hypervisor as Security Foothold for Personal Computers

Guardian: Hypervisor as Security Foothold for Personal Computers Guardian: Hypervisor as Security Foothold for Personal Computers Yueqiang Cheng, Xuhua Ding Singapore Management University (SMU) The International Conference on Trust & Trustworthy Computing (TRUST),

More information

CS 695 Topics in Virtualization and Cloud Computing. More Introduction + Processor Virtualization

CS 695 Topics in Virtualization and Cloud Computing. More Introduction + Processor Virtualization CS 695 Topics in Virtualization and Cloud Computing More Introduction + Processor Virtualization (source for all images: Virtual Machines: Versatile Platforms for Systems and Processes Morgan Kaufmann;

More information

Intro to Virtualization

Intro to Virtualization Cloud@Ceid Seminars Intro to Virtualization Christos Alexakos Computer Engineer, MSc, PhD C. Sysadmin at Pattern Recognition Lab 1 st Seminar 19/3/2014 Contents What is virtualization How it works Hypervisor

More information

Virtualization with Windows

Virtualization with Windows Virtualization with Windows at CERN Juraj Sucik, Emmanuel Ormancey Internet Services Group Agenda Current status of IT-IS group virtualization service Server Self Service New virtualization features in

More information

Poacher turned gamekeeper: Lessons learned from eight years of breaking hypervisors

Poacher turned gamekeeper: Lessons learned from eight years of breaking hypervisors Poacher turned gamekeeper: Lessons learned from eight years of breaking hypervisors Rafal Wojtczuk rafal@bromium.com 27 Jul 2014 Summary Hypervisors have become a key element of both cloud and client computing.

More information

Hypervisor-Based Systems for Malware Detection and Prevention

Hypervisor-Based Systems for Malware Detection and Prevention Hypervisor-Based Systems for Malware Detection and Prevention Yoshihiro Oyama ( 大 山 恵 弘 ) The University of Electro-Communications ( 電 気 通 信 大 学 ), Tokyo, Japan This Talk I introduce two hypervisor-based

More information

Hypervisors and Virtual Machines

Hypervisors and Virtual Machines Hypervisors and Virtual Machines Implementation Insights on the x86 Architecture DON REVELLE Don is a performance engineer and Linux systems/kernel programmer, specializing in high-volume UNIX, Web, virtualization,

More information

x86 Virtualization Hardware Support Pla$orm Virtualiza.on

x86 Virtualization Hardware Support Pla$orm Virtualiza.on x86 Virtualization Hardware Support Pla$orm Virtualiza.on Hide the physical characteris.cs of computer resources from the applica.ons Not a new idea: IBM s CP- 40 1967, CP/CMS, VM Full Virtualiza.on Simulate

More information

VMware and CPU Virtualization Technology. Jack Lo Sr. Director, R&D

VMware and CPU Virtualization Technology. Jack Lo Sr. Director, R&D ware and CPU Virtualization Technology Jack Lo Sr. Director, R&D This presentation may contain ware confidential information. Copyright 2005 ware, Inc. All rights reserved. All other marks and names mentioned

More information

ELI: Bare-Metal Performance for I/O Virtualization

ELI: Bare-Metal Performance for I/O Virtualization ELI: Bare-Metal Performance for I/O Virtualization Abel Gordon Nadav Amit Nadav Har El Muli Ben-Yehuda, Alex Landau Assaf Schuster Dan Tsafrir IBM Research Haifa Technion Israel Institute of Technology

More information

KVM Security Comparison

KVM Security Comparison atsec information security corporation 9130 Jollyville Road, Suite 260 Austin, TX 78759 Tel: 512-349-7525 Fax: 512-349-7933 www.atsec.com KVM Security Comparison a t s e c i n f o r m a t i o n s e c u

More information

Machine Virtualization: Efficient Hypervisors, Stealthy Malware

Machine Virtualization: Efficient Hypervisors, Stealthy Malware Machine Virtualization: Efficient Hypervisors, Stealthy Malware Muli Ben-Yehuda Technion & Hypervisor Technologies and Consulting Ltd Muli Ben-Yehuda (Technion & Hypervisor) Efficient Hypervisors, Stealthy

More information

A Survey on Virtual Machine Security

A Survey on Virtual Machine Security A Survey on Virtual Machine Security Jenni Susan Reuben Helsinki University of Technology jreubens@cc.hut.fi Abstract Virtualization plays a major role in helping the organizations to reduce the operational

More information

Cloud Architecture and Virtualisation. Lecture 4 Virtualisation

Cloud Architecture and Virtualisation. Lecture 4 Virtualisation Cloud Architecture and Virtualisation Lecture 4 Virtualisation TOC Introduction to virtualisation Layers and interfaces Virtual machines and virtual machine managers Hardware support Security 2 Virtualisation

More information

Under the Hood: How Actaeon Unveils Your Hypervisor

Under the Hood: How Actaeon Unveils Your Hypervisor Under the Hood: How Actaeon Unveils Your Hypervisor Eurecom, Sophia Antipolis, France, EU HITB Kuala Lumpur, October 2013 Table of Contents Eurecom S3 Security Lab What s the problem we are facing Why

More information

Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16

Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16 1 / 16 Virtualization P. A. Wilsey The text highlighted in green in these slides contain external hyperlinks. 2 / 16 Conventional System Viewed as Layers This illustration is a common presentation of the

More information

Hardware Based Virtualization Technologies. Elsie Wahlig elsie.wahlig@amd.com Platform Software Architect

Hardware Based Virtualization Technologies. Elsie Wahlig elsie.wahlig@amd.com Platform Software Architect Hardware Based Virtualization Technologies Elsie Wahlig elsie.wahlig@amd.com Platform Software Architect Outline What is Virtualization? Evolution of Virtualization AMD Virtualization AMD s IO Virtualization

More information

How Many Million BIOSes Would you Like to Infect?

How Many Million BIOSes Would you Like to Infect? How Many Million BIOSes Would you Like to Infect? Xeno Kovah & Corey Kallenberg June 11, 2015 1 Abstract This paper has two main points: Because almost no organizations in the world perform BIOS patch

More information

Operating Systems Design 23. Virtualization

Operating Systems Design 23. Virtualization Operating Systems Design 23. Virtualization Paul Krzyzanowski pxk@cs.rutgers.edu 1 Virtualization Memory virtualization Process feels like it has its own address space Created by MMU, configured by OS

More information

ERNW Newsletter 43 / May 2014

ERNW Newsletter 43 / May 2014 ERNW Newsletter 43 / May 2014 Security Assessment of Microsoft Hyper-V Version: 1.1 Date: 6/2/2014 Author(s): Felix Wilhelm, Matthias Luft Table of Content 1 INTRODUCTION... 3 2 HYPER-V ARCHITECTURE...

More information

Before we can talk about virtualization security, we need to delineate the differences between the

Before we can talk about virtualization security, we need to delineate the differences between the 1 Before we can talk about virtualization security, we need to delineate the differences between the terms virtualization and cloud. Virtualization, at its core, is the ability to emulate hardware via

More information

Virtualization. Explain how today s virtualization movement is actually a reinvention

Virtualization. Explain how today s virtualization movement is actually a reinvention Virtualization Learning Objectives Explain how today s virtualization movement is actually a reinvention of the past. Explain how virtualization works. Discuss the technical challenges to virtualization.

More information

5 Steps to Advanced Threat Protection

5 Steps to Advanced Threat Protection 5 Steps to Advanced Threat Protection Agenda Endpoint Protection Gap Profile of Advanced Threats Consensus Audit Guidelines 5 Steps to Advanced Threat Protection Resources 20 Years of Chasing Malicious

More information

Nested Virtualization

Nested Virtualization Nested Virtualization Introduction and improvements Bandan Das Karen Noel 2 Outline Introduction When things don't work Note on AMD Speeding up Wrap-up References 3 Introduction Nested Virtualization Linux

More information