Applications of Virtualization to Digital Forensics Education

Transcription

1 Applications of Virtualization to Digital Forensics Education Brian Hay Department of Computer Science University of Alaska Fairbanks Abstract Educators in digital forensics struggle with the desire to provide their students with realistic learning environments while protecting production systems from undesirable and potentially illegal interference. This paper describes methods in which virtualization technology can be used to create realistic learning environments for digital forensics that reduce cost and space requirements while saving students and instructors time. Host-based, network-based, and server-based approaches to virtualization are presented and analyzed. The issues associated with developing an image library for digital forensics are presented as well as the direction of future developments in the field including a vision for sharing virtual environments across institutions. At the recent Colloquium for Information Systems Security (CISSE 2009) approximately 60 attendees participated in virtualization bootcamps and working lunches, and the overwhelming level of interest in the group was determining how to deploy virtualization to provide high quality information assurance, computer security, and digital forensics lab exercises at their institutions. 1. Introduction Computer systems have traditionally consisted of physical desktop and server systems, but this model is rapidly changing to include the embedding of digital technologies in many other arenas, including cell phones, PDAs, digital music players, automobiles, and home automation. In many of these cases the added functionality includes processing capabilities in addition to data storage and network connectivity. As a result of this rapid expansion of computing platforms into non-traditional roles, digital forensics is becoming an increasingly relevant component of investigative efforts, including those conducted by law enforcement, intelligence and military agencies, corporate IT administrators, forensic accountants, and civil litigators. To support the digital forensics data collection and analysis effort there are many tools available, ranging from enterprise level commercial offerings such as Encase and FTK [1], to Linux distributions such as the Helix live CD [6] which includes many forensicallyoriented open-source tools. Although these tools are readily and publicly available, they still require a knowledgeable user to ensure that meaningful and relevant evidence is located and collected, is not corrupted or compromised during the acquisition process, and can be interpreted correctly. The increasing amount of data gathered from each target system, and the increasing number of target systems involved in any investigation means that highly skilled investigators are in short supply, and this is a challenge that the educational system must quickly address. While a strong theoretical background in areas such as file systems and operating systems is an important component of an education in digital forensics, computer science programs are already providing classes that address these needs as part of their undergraduate and graduate curricula. For some applications, particularly those involving the use of an investigation s results in a legal proceeding, a detailed understanding of the process by which data should be collected, stored, transferred, and analyzed is important, although this is an area in which CS programs are generally ill-equipped to provide. The application of theoretical concepts has been shown to be an important factor in ensuring that students fully grasp a subject, in addition a providing practical experience that can allow a student to more easily transition to a real work environment. However, actually providing high quality practical exercises for students is not an easy task. For educators seeking to provide such an experience in digital forensics, there are several goals for the learning environment which can be challenging to attain in the traditional computing lab environments, such as: Creating an interesting scenario at the host level. In the case of a single system, such as a server or workstation, this may involve deploying and configuring an operating /10 $ IEEE 1

2 system, applications, and services/daemons, then seeding the system with applicable and interesting files such as images, documents, and messages. More involved scenarios may include ensuring that forensically relevant data is deleted from the filesystem, or even the installation of rootkits, encryption software, or anti-forensics tools to provide students with a wide range of experiential activities. Creating an interesting network environment. An increasing number of computing devices today have built-in network connectivity, including almost all consumer computing devices, so including a network component in the learning scenarios can be an important addition. Not only do the systems need to be configured to allow network access, but some interesting traffic must also be present on the network, which may require that other systems, such as servers and clients or traffic generators are configured and deployed. Making the exercise available to students. Once the learning environment has been defined, it must be deployed for student use, which may require copies of the relevant systems to be installed on lab workstations. While this process can be simplified using utilities such as Symantec Ghost [11], the process can be time consuming and generally requires administrator intervention (i.e., the students typically can t deploy the system themselves). This also assumes that students are actually physically present, and doesn t provide for students who are involved in distance learning, or who prefer to work on personal workstations with their own suite of tools. Resetting the scenario systems for subsequent groups. At the end of an exercise it is usually necessary to reset the exercise systems to a known state for use in future exercises. Again, systems such as Symantec Ghost can simplify this process, although the previously discussed limitations of such utilities apply in this case too. Production systems, such as lab computers, could technically be used as targets for forensic investigation exercises. While this could potentially simplify the setup phase, the likelihood of sensitive or personal data belonging to lab users being discovered makes this approach at least undesirable, and likely a violation of acceptable use policies or even legal restrictions such as those required for FERPA compliance. Similarly the use of production networks is likely to have undesirable legal implications, even if it only involves students collecting and analyzing production network traffic. More serious problems can occur if any active network scanning is a component of the exercise on a production network, as it is easy for even experienced users to mistakenly target non-exercise systems, which again can have very serious legal implications. In addition to the legal risks, production systems are likely to be too complex to be useful as education exercises for novice students and difficult for the instructor to control the environment. For example, modern hard disks sizes have grown dramatically, making data acquisition more time consuming than is generally possible in a typical class lab session, and networks are likely to have an overwhelming large amount of traffic. This complexity combined with the lack of control that the students and educators encounter make this environment less-than-suitable for digital forensics education. 2. Virtualization Virtualization can be defined as an abstraction layer that decouples the physical hardware from the operating system to deliver greater IT resource utilization and flexibility [13]. Virtualization has long been a feature of high end, multi-processor mainframe systems, allowing multiple copies of the operating system to execute in isolation. However, x86 virtualization has been a more recent development. With multi-processor and multi-core systems and ever larger amounts of RAM and hard disk space becoming commonplace on x86 systems, virtualization on commodity hardware is now a very real, and increasingly mainstream, approach to more fully utilizing x86 desktop and server systems. Not only is virtualization becoming increasingly common, but the virtualization software offerings, which allows multiple virtual machines (VMs) to run concurrently on a single system, are becoming more powerful and user friendly, while simultaneously becoming less expensive, and in many cases are distributed freely. VMware is the current market leader in this arena, and has a wide selection of products, ranging from those targeted towards the home user to enterprise level server virtualization products [14]. In all cases except the enterprise level VMware Infrastructure and recently released vsphere products, VMware software is installed as a program within a host operating system (Windows or Linux). Once the software is installed, one or more guest operating systems can then be installed and executed concurrently, each of which 2

3 functions no differently from the user s perspective than a separate physical system. Supported guest operating systems include many Windows and Linux variants, in addition to other x86 operating systems such as Solaris x86 and BSD versions. VMware offers three free products to the public in addition to their commercial offerings, but for some academic uses all products are offered free of charge through the VMware Academic Program. [12] Xen is a virtualization program which grew out of a research project at Cambridge University. [15] A modified Linux kernel is installed as the virtualization hypervisor, after which other operating systems, known as domains, can be installed. Until recently Xen required that the guest operating system be modified in order to operate as a virtual machine, which made running closed-source operating systems, such as Windows, challenging. Support in Xen 3.x for the virtualization extensions in the latest Intel and AMD processors removed this requirement. While the management tools used with Xen are not as fully developed as those offered by VMware, two major Linux vendors (Red Hat and SUSE) have included Xen as an integral component of their latest enterprise distributions, and the products are being actively developed and improved. Xen is available at no charge, including in source form, and is also supported by a commercial company, XenSource [15]. Kernel-based Virtual Machine (KVM) is another product in the virtualization market, although it is based on the older QEMU [7, 10]. KVM installs as a kernel module on a Linux system, but unlike VMware and Xen, KVM requires the use of Intel or AMD processor virtualization extensions, which currently limits it to relatively new hardware. KVM is now integrated into version 2.6 of the Linux mainline kernel, and while it lacks some advanced functionality, particularly for use in high performance server environments, it is under active development and is likely to be a realistic option in the near future. QEMU, on which KVM is based, is another open source virtualization product, and while it tends to be less user friendly than some of the other products, it has one distinct advantage, namely that it can emulate other processor types, whereas the other products discussed can only run x86 virtual machines. While there are clearly performance implications involved in this emulation, the option to emulate non-x86 processors allows for a much wider range of devices, allowing for exercises involving less-common hardware platforms [10]. Microsoft has provided some basic virtualization software for some time, but those offerings were typically limited with respect to functionality and supported guest operating systems. The host based Virtual PC product is still available, but MS now also offers a true server-based virtualization product, named Hyper-V which may prove to be a serious challenger to VMware vsphere in terms of performance and functionality [8, 9]. 3. Virtual Laboratory Environments Virtualization can be used to address many of the challenges faced by educators attempting to provide their students with high quality digital forensics experience including the following: Creating an interesting scenario at the host level. Although virtualization does not remove the need to create interesting systems, the resulting virtual machines then exist as a small collection of files in a directory on the host system. VMs can be archived or deployed by simply copying the files (or in the enterprise level products through the use of templating and cloning functionality) Creating an interesting network environment. Virtual machines can connect to physical networks in the same manner that physical hosts can, allowing them to participate in exercises based on a physical network. However, multiple VMs running on a physical host can also be connected to a virtual network, allowing realistic networking exercises to be conducted in a completely isolated virtual environment. Making the exercise available to students. Deployment of VMs generally means making a few files available to the physical host. Although the files that comprise the VM can be large (depending on the VM configuration), one or more carefully configured VMs can commonly be stored on a CD or DVD, and made available for use by students anywhere that the associated virtualization software is available. Free software that provides sufficient capabilities for students to run most exercises is available from all of the major vendors. Resetting the exercise systems for subsequent groups. Restoring a known state for a virtual machine requires nothing more than restoring a file, which can either be done manually, or more commonly, can be accomplished in essentially zero time from within the virtualization software. This allows exercises to be configured to one of multiple known states with almost no delay. 3

4 3.1. Host-based Images Over the past 7 years, the University of Alaska Fairbanks (UAF) Advanced System Security Education, Research, and Training (ASSERT) Center [2, 5] has created several evolutionary virtualization lab configurations, based in part on the level of funding that was available and the state of the art in virtualization at the time. Each of these configurations can be used today as feasible roadmap for the deployment of a virtual lab at a given institution, depending on the needs and resources available. The first version involved the deployment of several high performance workstations, each running Microsoft Windows as the host OS, and VMware workstation as the virtualization software. In this version, a single wired network was provided in the lab, and a single basic server, acquired at no charge from the UAF surplus equipment was attached to the network and configured to provide domain (SAMBA) DHCP, DNS, NTP, HTTP, SMTP, and POP service to the workstations and their associated virtual machines. With this configuration, students were able to create and store VMs on the local hard drives on any of the workstations, and the workstations were sufficiently powerful that six VMs could easily be concurrently running on any given workstation, which was sufficient for even the most complex exercises at that time. The lab itself was completely physically isolated from any external network to ensure that no action, either accidental or deliberate, on any of the lab systems was capable of impacting any production host or network. While this architecture did offer many of the benefits associated with the use of virtualization, including the ability to relatively easily restore known configurations and perform exercises in isolated virtual networked environments, there were also several significant drawbacks. The first issue was that students were essentially tied to a specific workstation, as their VM files were too large to easily transfer between machines. As a result, if two students both created VMs on the same workstation, then they could not use the lab environment simultaneously, even if all other workstations were unused. In addition, there was no easy mechanism to allow an instructor to propagate a given VM to all students in the class, other than copying gigabytes of data across a single 100Mb network connection to multiple workstations Network-based Images The next iteration of the lab architecture attempted to address some of the shortcomings of the original version, in that all of the virtual machines were stored on a server. All students were allocated their own space on the server, and their VM directories were mapped onto whatever workstation they chose to login to. This architecture required reorganizing the network so that workstation authentication and VM directory mapping were performed using a dedicated gigabit Ethernet network, whereas the virtual machines were given access to a separate 100Mb Ethernet network, on which the DHCP, DNS, NTP, HTTP, SMTP and POP services were accessible. Using three gigabit connections in a bonded channel for the server connection and gigabit to each workstation proved to provide sufficient bandwidth to support the execution of six VMs per workstation with no noticeable lag time, other than occasionally when several users powered on VMs simultaneously, such as at the start of a lab session. This configuration did solve some of the problems encountered in the initial design, such as the issue of users being tied to a specific workstation. Basic scripts were also written to allow an instructor to copy any of the virtual machines created in an instructor directory to a group of students, which, since all VM files were stored on a single server merely required a copy operation on the server rather than network traffic. The lab network remained completely isolated from any external networks as a protective measure. While this was acceptable initially when class sizes were small, the opportunity to use the lab led to increased interest in courses such as digital forensics, and the physical limitations of the lab became a problem. Students could not use the lab from home, nor could the much larger CS or general use laboratory be used for these exercises as class sizes grew, and this led to scheduling issues and overcrowding Server-based Virtualization The third major iteration of the laboratory environment focused on addressing the need for extra capacity, while ensuring that the VMs have no ability to impact production networks. In this case the execution of the VMs was moved from the user workstations to a rack of servers, each of which was initially running VMware Server. Management of the system was performed using the VMware Virtual Center, which was at that point the only non-free virtualization software component in the lab, and the virtual machines were confined to any of 99 isolated virtual networks, or one of the physically isolated wired networks. Virtual machine files were stored on a 4

5 SAN, attached to each server using a Fibre Channel connection. Users connected to the lab using the freely available Virtual Center client, allowing them to monitor the state of their own VMs, which are manually load balanced across the available servers. They could also perform power actions, such as power on and shutdown from this interface. Users could also connect to the console of any of their virtual machines, allowing them to have the same ability to interact with their VMs as they would having sitting at the keyboard of a physical system. Users could attach to the console of several of their VMs running on the servers. While this console view may appear no different from other remote access methods, such as Remote Data Protocol (RDP) for example, it has one important distinction in that it does not require the VM to have any network connection on the external network, as would be required by RDP or Secure Shell (SSH). Without this capability the VMs would no longer be solely on isolated networks, violating the principle that no VM should be able to impact a production network. 3.4 Server-based Virtualization Using Enterprise Software The VMware Academic Program provided UAF with access to the enterprise level products, including VMware ESX, and in 2007 the ASSERT Lab was transitioned to use VMware Infrastructure (ESX) instead of VMware Server, VMware Infrastructure has some similarity to VMware Server from a cosmetic perspective. However it runs as its own OS, rather than requiring a host operating system such as Linux to be installed as is the case with VMware Server. One limitation in this case is that Infrastructure supports a limited range of server hardware, network cards, and storage devices, but the Infrastructure suite supports many additional capabilities, such as a high performance filesystem specifically tuned to the efficient storage of virtual machines disk files, and automated load balancing of virtual machines between physical servers, even while the VMs are running. As the virtualization field continues to evolve, we are also periodically reassessing the suitability of alternatives to the VMware tools, such as Xen and Hyper-V, to digital forensics education environments. 4. Digital Forensics Image Library developing high quality systems to investigate, whether virtual or physical, is a challenging and time consuming process. However, because virtual machines can be duplicated simply by copying a small set of files, VMs can easily be stored in a central library, and easily shared between educators using a web site, or even mailed CDs and DVDs if necessary. Using this approach, the workload of creating a set of virtual machines which are suitable for digital forensics exercises can be shared across the entire community. UAF has created such a repository, and is populating it with example virtual machines at his time Challenges Related to the Image Library There are at least two major challenges related to building such a library, the first of which relates to the size of the virtual machine files, on which the entire hard disk for the virtual machine is stored. Even the most basic operating system installations require several hundred megabytes of disk storage, and more complex systems could have virtual machine files that are gigabytes in size. In order to deliver these VMs to interested institutions, all of that data must either be delivered across the network, or alternatively mailed on some physical media, such as a DVD. Even using the fast networks commonly found in campus environments, downloading several gigabytes of data can be a time consuming task. The second major challenge relates to software licensing issues. If institution A creates a virtual machine which includes an operating system or software for which they have a valid license, there are many cases where it is at least unclear whether they can then share that VM, even with other institutions who also have licenses for the operating system or software in question. In some cases, such as VMs using some of the freely available Linux operating systems, this does not appear to be an issue, but in other cases, such as those involving the commercial Linux systems like Red Hat Enterprise Linux, or any of the Windows operating systems, the issue of sharing images without violating license agreements is much more problematic. UAF faculty are currently in contact with Microsoft staff in an attempt to address this issue, and while initial interactions have been promising, and there is a general agreement that the ability to share such images would benefit the digital forensics community, no specific solution has yet been agreed upon. Building labs using virtualization solves many of the problems that are faced by digital forensics educators, but it does not directly address the issue that 5

6 4.2. Shared Image Usage The shared digital forensics images available from the online library can not only be used for classroom/lab exercise, but may also have value as reference systems for testing new digital forensics tools. In this manner, new tools could undergo preliminary testing against a set of well defined reference images to gauge their performance. The reference images may also provide a mechanism by which the applicability of tools to different types of digital forensics problems, such as identifying image files or locating encrypted content, could be gauged Shared Scenarios In addition to the VM images files, the online library can also store associated supporting materials, such as a document providing a back-story for the images, or set of images. Such a document may provide environmental information regarding the VM, such as the location of the system or the conditions under which it is being investigated, giving students a richer environment in which to conduct their exercise. Other supporting documents may include worksheets for example exercises that could be conducted using the VM, and even solution sets that describe the relevant information that students should find as part of their investigation Access Restrictions Access to library resources is likely to be restricted to support at least two goals, namely the need to ensure that licenses violations do not occur, and to ensure that students do not gain access to instructor resources. In the event the Microsoft, for example, allows virtual machines using their operating systems to be shared through this library, it is almost certain that institution downloading the VM will still need an existing valid license for Microsoft software, so access to such resources would be restricted to those institutions that had demonstrated their possession of such a license. In addition, some resource, such as the virtual machine files themselves, may be available to students, whereas other components, such as the solution sets may require more restricted access. 5. Future Considerations Although virtualization offers many benefits to academic programs, including digital forensics, there are still some challenges, including the need to administer the virtual server infrastructure, which can be a daunting task in some cases. In addition, while some institutions may be heavy users of digital forensics labs, others may simply include it as a module in a more general CS course, and as a result cannot justify hosting a specialize virtual lab. This situation is extremely similar to the problems successfully address by the supercomputing community, where there are many users of supercomputing resources nationwide, each with different usage requirements, but few institutions with the experience, funding, and expertise necessary to actually run a supercomputing facility. This issue was addressed through the deployment of a small number of NSF funded supercomputing centers throughout the nation, on which researchers and educators could request time for their projects. Such an approach gives nationwide access to supercomputing resources to all who need it, while centralizing the management of the resources themselves. By adopting a similar approach in the digital forensics and information assurance domain, where remotely accessible virtualized labs are stationed in a few institutions with the expertise necessary to manage them, but made available to students and educators nationwide, we can ensure that more institutions can gain access to high quality digital forensics lab experiences. 6. Conclusions Virtualization can provide several advantages to digital forensics educators, and can be applied to provide students with high-quality practical experience with digital forensics topics in a manner which makes efficient use of hardware resources and the time of experts who can share the burden of creating meaningful exercises. In addition, the creation of a remotely accessible virtualized laboratory can allow students to have access to resources from across campus, across the nation, or across the planet, at a time and place that fits their requirements and schedules. As the virtualization field continues to evolve, new tools and approaches are likely to expand the current capabilities leading to better opportunities for virtualization to benefit digital forensics curricula. 7. References [1] AccessData Forensic Toolkit. Retrieved June 14, 2009 from [2] ASSERT Website. Retrieved June 12, 2009 from [3] Computer Laboratory Xen Virtual Machine Monitor, Retrieved June 14, 2009 from 6

7 [4] EnCase Forensic Retrieved June 12, 2009 from [5] Evolution of the ASSERT Computer Security Lab Proceedings of the 10 th Colloquium for Information Systems Security Education. Adelphi, MD. June 6-8, 2006 [6] Helix Website. Retrieved June 12, 2009 from [7] Kernel-based Virtual Machine. Retrieved June 10, 2009 from [8] Microsoft Virtualization: Desktop Virtualization. Retrieved June 10, 2009 from op/default.mspx [9] Microsoft Virtualization: Server Virtualization. Retrieved June 10, 2009 from /default.mspx [10] QEMU. Retrieved June 10, 2009 from [11] Symantec Ghost Solution Suite. Retrieved June 10, 2009 from [12] VMware Academic Program Overview. Retrieved June 10, 2009 from [13] VMware Definition of virtualization. Retrieved June 2, 2009 from [14] VMware: Virtualization, Virtual Machine; Virtual Server Consolidation. Retrieved June 10, 2009 from [15] Citrix Systems: Citrix XenServer: Efficient Virtual Server Software. Retrieved June 10, 2009 from entid=