Penetration Test Methodology on Information-Security Product Utilizing the Virtualization Technology



Similar documents
Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies


The Value of Physical Memory for Incident Response

A Study on the Live Forensic Techniques for Anomaly Detection in User Terminals

Mobile Application Hacking for Android and iphone. 4-Day Hands-On Course. Syllabus

An overwhelming majority of IaaS clouds leverage virtualization for their foundation.

EC-Council. Certified Ethical Hacker. Program Brochure

PROTECTION FOR SERVERS, WORKSTATIONS AND TERMINALS ENDPOINT SECURITY NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY

RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst

WildFire. Preparing for Modern Network Attacks

LASTLINE WHITEPAPER. In-Depth Analysis of Malware

Windows Operating Systems. Basic Security

A Study on Detection of Hacking and Malware Codes in Bare Metal Hypervisor for Virtualized Internal Environment of Cloud Service

FORENSIC ANALYSIS Aleš Padrta

5 Steps to Advanced Threat Protection

Computer Science. About PaaS Security. Donghoon Kim Henry E. Schaffer Mladen A. Vouk

ICTN Enterprise Database Security Issues and Solutions

Memory Forensics & Security Analytics: Detecting Unknown Malware

KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES.

How To Stop A Malicious Process From Running On A Hypervisor

Session ID: Session Classification:

2. From a control perspective, the PRIMARY objective of classifying information assets is to:

NETWORK PENETRATION TESTS FOR EHR MANAGEMENT SOLUTIONS PROVIDER

GRC & Cyber Security Conference - Bringing the Silos Together ISACA Ireland 3 Oct 2014 Fahad Ehsan

Cloud Services Prevent Zero-day and Targeted Attacks

Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits)

Ethical Hacking Penetrating Web 2.0 Security

Virtual Switching Without a Hypervisor for a More Secure Cloud

Ed Ferrara, MSIA, CISSP Fox School of Business

Network Incident Report

Tamper-Resistant, Application-Aware Blocking of Malicious Network Connections

Web Application Hacking (Penetration Testing) 5-day Hands-On Course

Center of Academic Excellence Cyber Operations Program 2013 Application

Search and Destroy the Unknown FROM MALWARE ANALYSIS TO INDICATIONS OF COMPROMISE

That Point of Sale is a PoS

How to Reduce Web Vulnerability Scanning Times

KASPERSKY FRAUD PREVENTION FOR ENDPOINTS

Penetration Testing Report Client: Business Solutions June 15 th 2015

Deep Discovery. Technical details

Software Execution Protection in the Cloud

FORBIDDEN - Ethical Hacking Workshop Duration

BLACKJACKING: SECURITY THREATS TO BLACKBERRY DEVICES, PDAS, AND CELL PHONES IN THE ENTERPRISE

Security Intelligence Services. Cybersecurity training.

egambit Forensic egambit, your defensive cyber-weapon system. You have the players. We have the game.

Detecting Unknown Malware: Security Analytics & Memory Forensics. Fahad Ehsan. Cyber Security #RSAC

CEH Version8 Course Outline

A Survey on Virtual Machine Security

CRYPTUS DIPLOMA IN IT SECURITY

Virtualization for Cloud Computing

ArcGIS Server Security Threats & Best Practices David Cordes Michael Young

Endpoint Business Products Testing Report. Performed by AV-Test GmbH

Best Practices for Deploying Behavior Monitoring and Device Control

A8.1 Asset Management Responsibility for assets: To identify organisational assets and define appropriate protection responsibilities.

Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs

Malicious Programs. CEN 448 Security and Internet Protocols Chapter 19 Malicious Software

Security Model for VM in Cloud

Post-Access Cyber Defense

Cloud Security Through Threat Modeling. Robert M. Zigweid Director of Services for IOActive

DDoS Attacks & Defenses

Post-Stuxnet Industrial Security: Zero-Day Discovery and Risk Containment of Industrial Malware

PERDIX: A FRAMEWORK FOR REALTIME BEHAVIORAL EVALUATION OF SECURITY THREATS IN CLOUD COMPUTING ENVIRONMENT

The SCADA That Didn t Cry Wolf: Who s Really Attacking Your SCADA Devices

IOS110. Virtualization 5/27/2014 1

Hi and welcome to the Microsoft Virtual Academy and

Adjusting Prevention Policy Options Based on Prevention Events. Version 1.0 July 2006

Evolving Threat Landscape

NoHype: Virtualized Cloud Infrastructure without the Virtualization

The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.

Lectures 9 Advanced Operating Systems Fundamental Security. Computer Systems Administration TE2003

Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips

Example of Standard API

Universities and Schools Under Cyber-Attack: How to Protect Your Institution of Excellence

SECURITY TERMS: Advisory Backdoor - Blended Threat Blind Worm Bootstrapped Worm Bot Coordinated Scanning

BUILDING SECURITY IN. Analyzing Mobile Single Sign-On Implementations

Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)

Loophole+ with Ethical Hacking and Penetration Testing

Index. Registry Report

xassets Hosted Services Microsoft SAM Assist Audits with xassets

Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken

Lecture Embedded System Security A. R. Darmstadt, Introduction Mobile Security

Adi Hayon Tomer Teller

Reverse Engineering and Computer Security

A Hypervisor IPS based on Hardware assisted Virtualization Technology

Chapter 4 Application, Data and Host Security

All Information is derived from Mandiant consulting in a non-classified environment.

Driving Company Security is Challenging. Centralized Management Makes it Simple.

Visa Data Security Bulletin (AP)

Transcription:

Penetration Test Methodology on Information-Security Product Utilizing the Virtualization Technology JungDae Kim (jdcom@ksel.co.kr) ByongKi Park (bgbak@ksel.co.kr)

CONTENTS 1 Background Information 2 Vulnerability 3 Penetration Test Methods 4 Conclusions

Background Information 01 Computing Environment The Virtualization emerges as a core technology for optimization of limited computing resources and cloud computing environment 02 Increasing Needs The development of information-security products utilizing the virtualization technology is increased. 03 Expected to Increase CC Evaluation As more information-security products are increasingly released, it is expected to increase CC evaluation about such kind of products(information-security products utilizing virtualization technology.)

Background Information 01 More Attacks Against PC Attacks against PC, that is connected to the internal and external network at the same time, are increasing as a major target of attack because PC are more easily to be accessed than any server by attackers 02 Damages Caused by PC s Invasion A PC is infected by a malignant code through external network or is exposed against an attack, the infection will lead to serious damages like draining out or damaging some important data in the PC s organization, or destroying its internal network, and so on. 03 To Avoid such Damages To avoid such damages, We should physically separate the organization s internal network from external network. 04 Difficulties of Physically Separating Network However, there are many obstacles such as much cost, energy and a lot of inconveniences in business.

Background Information To solve these difficulty of physical separation, informationsecurity products utilizing the virtualization technology are developed. The virtualization technology physically separates the limited computing resources, and provides a virtual host environment separated from real host environment to users. As a virtual host environment(public domain) separated from real host environment(work domain) is provided in the same PC, it can protect the work domain against any invasion from an external network.

Vulnerability The information-security product utilizing the virtualization technology logically divides physically limited resources, operating systems and applications, and it provides users with some virtual host environment separated from real host environment. The real host environment and the virtual host environment share the same separated computing resources, therefore, there may be some vulnerabilities resulting from this resource-sharing feature. Vulnerability of Physical Resource (CPU, Memory, Disk) Vulnerability of OS Kernel & System File Sharing Vulnerability of Device Driver Sharing Vulnerability of Files & Registry System Sharing Vulnerability of Process Sharing Vulnerability of Network Sharing

Test of real host environment resources depletion caused by the monopolization of physical resources in the virtual host environment Test of data access to real host environment through physical dumping into the storage spaces like memory, disk and the others in the virtual host environment.

[Test Case] Monopolization of physical resource in the virtual host environment

[Test Case] Physical dumping into the storage space(disk) in the virtual host environment

Operating system s invasion test in the real host environment through modification of the operating system kernel & system files.

Test of monitoring the input & output of the real host environment s devices in the virtual host environment Test of Accessing to the storage & communication media connected to the real host environment in the virtual host environment

[Test Case] Test of monitoring the input & output of the real host environment s device(keyboard)

Test of monitoring the input & output states of the real host environment s files in the virtual host environment.

[Test Case] Test of monitoring the input & output states of the real host environment s files in the virtual host environment

Process penetration test on the real host environment through DLL injection attacks in the virtual host environment

[Test Case] Process penetration test on the real host environment through DLL injection attacks in the virtual host environment

Test of sniffing network packet of the real host environment in the virtual host environment Test of accessing to the real host environment by using the information on the real host environment in the Virtual Host Environment

[Test Case] Test of sniffing network packet of the real host environment in the virtual host environment

[Test Case] Test of accessing to the real host environment by using the information of the real host environment in the Virtual Host Environment

Modification test on the MBR & kernel memory in the virtual host environment Test of penetration to the real host environment by using the backdoor, malware, and the malicious codes in the virtual host environment

[Test Case] Penetration Test Using the IRC Server.

Conclusions This paper described vulnerability to be considered about the virtualization technology and the penetration test method on the corresponding vulnerability Dividing and controlling between the virtual host environment and the real host environment are correctly performed Many researches and tests should be performed to discover the potential vulnerabilities caused by sharing the computing resources

JungDae Kim (jdcom@ksel.co.kr) ByongKi Park (bgbak@ksel.co.kr)