ReVirt: Enabling Intrusion Analysis Through Virtual-Machine Logging and Replay By Dunlap, King, Cinar, Basrai, Chen Presented by Seth Goldstein and Nathan Immerman EECS 582 – W16

Outline Attacks Current Systems UMLinux Trusted Computing Base ReVirt Evaluation Conclusion

Attacks Use unintended consequences of non-deterministic events Attempt to gain root access Change code

Current Systems Security Completeness Logs can be modified by a malicious kernel Completeness Don’t log external events

UMLinux OS-on-OS Diagram Using UMLinux VMM loadable kernel module OS-on-OS Provides software analog for peripherals OS-on-OS Diagram Using UMLinux

Trusted Computing Base (TCB) Everything in a computing system that provides a secure environment OS-on-OS “The trusted computing base (TCB) of a computer system is the set of all hardware, firmware, and/or software components that are critical to its security, in the sense that bugs or vulnerabilities occurring inside the TCB might jeopardize the security properties of the entire system.” ~Wikipedia

ReVert: Details Deterministic and Non-Deterministic Events Cooperative Logging Analyzing Attacks

Deterministic / Non-Deterministic Events Most normal instructions do not need to be logged Non-Deterministic Events Time (interrupts) and external input (ex. human input) Only need to log events that affect actions of VM Use “branch_retired” to monitor branching and interrupts

Cooperative Logging One computers outgoing message is another computer’s incoming Multiple computers can use ReVirt and perform a replay together

Analysis of Attacks Allows administrators to replay attacks Run inside the guest OS Debuggers and disk analyzer Input packets from log

Evaluation Virtualization Overhead Correctness Replay Overhead

Virtualization Overhead Very little overhead added for computationally heavy tasks High overhead for tasks that have a lot of kernel calls - more VMM involvement

Correctness Saved register values and branch_retired to validate replay Validates interprocess interaction and external inputs It works.

Logging and Replay Overhead Logging and replay time overhead manageable Daily use - 0.2GB/day * 365 days/year = 73GB per year!

Conclusion ReVirt successfully allows administrators to replay long-term instruction by instruction execution of a computer system

Discussion