1. Information Security - 2
Topic: Architectural Aid to Secure Systems Engineering
V. Kamakoti
RISE LAB, Department of Computer Science and Engineering
IIT Madras
Session – 5: virtual machine based ROOTKITs (VMBR)

2. Virtual-machine based rootkits (VMBRs)
Hardware
Target OS
App1
App2
VMM
Attack
system
After
infection
App1
App2
Target OS
Hardware
Before
infection

3. Installation Assume attacker has kernel privilege - How?
Traditional remote exploit (Stack smashing)
Bribe employee
Malicious bootable CD-Rom
Install during shutdown
Few processes running
Efforts to prevent notification of activity

4. Installing a VMBR Modify the boot sequence Master boot record Boot
sector
BIOS OS

5. Installing a VMBR Modify the boot sequence VMBR loads BIOS Master boot
record
Boot
sector
BIOS OS

6. Maintaining control Hardware reset VMBR loses control
Illusion of reset w/o losing control
Reboot easy, shutdown harder
VMBR
loads
BIOS
Master
boot
record
Boot
sector OS
BIOS

7. Malicious services due to VMBR
Zero interaction malicious services
E.g., phishing web server
Passive monitoring
E.g., keystroke logger, file system scanner
Active execution modifications
E.g., defeat VM detection technique
All easy to implement

8. End of Session-5 Thank You