VMPCS-OGC Virtual Machine Protection and Checking System using Out-of-Guest Control ferify

Why cant we have synergy between the Hypervisor and VM Guest? Since a Hypervisor (Bare Metal) has less processes … and Since a Hypervisor is at arms length from the end users … and Since a Hypervisor is administered by an admin, with no web browsers and user based processes … and Since a Hypervisor can have a small code base (<50k lines or code), there is less of a chance of errors in the code running on the hypervisor ...and… Since a VM Guest can have great usability … but Since with a great usability VM Guest OS has greater chance of many process .. and Since it has a greater chance of having many applications … and Since it has many applications, it has a better chance of having more developers and therefor due to all of the above, the VM Guest OS has a greater chance of being low assurance, …

Scenario Remotely accessible Virtual Machine Legitimate Secure user1 account Compromised legitimate user2 account Root access gained from user2 account or root privilege gained through a poorly created application Many Virtual Machine Introspection solutions protect the kernel and the OS from corruption

Why cannot the Hypervisor better protect the VM Guest, perhaps it can protect the VM Guests files VM Guest OS must access its files from the Hypervisor Hypervisor security code determines if access is granted or not from a file table of file attributes No matter what happens on the VM Guest, access is determined by the Hypervisor Hypervisor Hypervisor security code VM Guest file access File Memory Location

Introduction to ferify Goal: Prevent unauthorized access to user’s files from other users/processes including root. Protect the user’s files directly from the hypervisor. ferify is based on DRAKVUF, “…a virtualization based agentless black-box binary analysis system…” The VM Guest should not affect the security measures Minimal footprint that is nearly undetectable Linux based protection system using system call interrupts

Methodology

What is monitored All processes, current and future All file access requests through the trapped system calls are compared to an ACL table on the Hypervisor Credentials of running processes User process changes (fork-as-user, then access a file) All execution requests are trapped via system calls and compared to ACLs on the Hypervisor with a denied by default / white listing Attempts at kernel modification are trapped via system calls and denied The kernel system call memory locations are compared when used

Future Work for VMPCS-OGC How can ferify be used as a Honeypot and can we lean real time what are the vectors of malware insertion? How can Red Teaming be performed on ferify? How can ferify be enhanced to perform extended messaging (using drakvuf/libvmi/altp2m there is great access to all processes and users) and what kind of messaging should be enabled? Can ferify be extended to perform file privacy even when the file protected is accessible by legitimate users, such as database files (can we create extended groups for obfuscation, or a file prevention mechanism based on fork-as-user, then file access)? Can we use drakvuf to extend Windows7 or Windows10 to protect files?