1. Attacks on Virtual Machine Emulators Peter Ferrie, Senior Principal Researcher 12 April, 2007

2. 2 Agenda Attack Types1 Types of Virtual Machine Emulators2 Detection of Hardware VMEs3 Detection of Software VMEs4 What can we do?5

3. 3 Attack Types Detection Denial-of-service Escape!

4. 4 Attack Types : Detection

5. 5

6. 6 Attack Types : Denial-of-Service

7. 7 Attack Types : Escape!

8. 8

9. 9 Types of Virtual Machine Emulators Virtual Machine Emulators Hardware-Bound Pure Software Hardware-Assisted Reduced-Privilege Guest

10. 10 Reduced-Privilege Guest VMEs Software-based virtualization of important data structures and registers Guest runs at lower privilege level than before No way to avoid notification of all CPU events

11. 11 Reduced-Privilege Guest VMEs VMware Xen Parallels VirtualBox

12. 12 Hardware-Assisted VMEs Uses CPU-specific instructions to place system into virtual mode Guest privileges unchanged Separate host and guest copies of important data structures and registers Guest copies have no effect on the host Host can request notification of specific CPU events

13. 13 Hardware-Assisted VMEs BluePill Vitriol Xen 3.x Virtual Server 2005 Parallels

14. 14 Detection of Hardware VMEs : TSC Method Physical Hardware Virtual Hardware T1……Instruction 1 T1.……..Instruction 1 T1+1...Instruction 2 T1+1…..Instruction 2 T1+2...Instruction 3 T1+2…..[VM fault] T1+N….Instruction 3 where N is a large number

15. 15 Detection of Hardware VMEs : TLB Method (Intel) T1………read memory 1 T1+X1…read memory 2 T1+X2…read memory 3 T1+X3…read memory 4 FT (Fill Time) = ((T1+X3)-T1)/4 T2………read memory 1 T2+Y1…read memory 2 T2+Y2…read memory 3 T2+Y3…read memory 4 CT (Cached Time) = ((T2+Y3)-T2)/4 1 2

16. 16 Detection of Hardware VMEs : TLB Method (Intel) Execute CPUID T3………read memory 1 T3+Z1…read memory 2 T3+Z2…read memory 3 T3+Z3…read memory 4 DT (Detect Time) = ((T3+Z3)-T3)/4 If DT ~= CT, then physical If DT ~= FT, then virtual 3 4 5

17. 17 Detection of Hardware VMEs : L2 and MSRs L2 cache fill via PREFETCH Last Branch Record MSR Last Exception Record MSR Fixed-Function Performance Counter Register 0 (Core 2)

18. 18 Pure Software VMEs CPU operation implemented entirely in software Emulated CPU does not have to match physical CPU Portable Can optionally support multiple CPU generations Examples –Hydra –Bochs –QEMU

19. 19 Pure Software VMEs (Hybrid model) Commonly used by anti-virus software Emulates CPU and partial operating system CPU operation implemented entirely in software Examples –Atlantis –Sandbox

20. 20 Malicious VMEs (SubVirt) Reduced-privilege guest Installs second operating system Runs on Windows and Linux Carries VirtualPC for Windows Carries VMware for Linux Difficult to detect compromised system

21. 21 Detecting VMware IDT/GDT at high memory address Non-zero LDT Port 5658h Windows registry Video and ROM BIOS text strings Device names MAC address ranges

22. 22 Detecting VirtualPC IDT/GDT at high memory address Non-zero LDT 0F 3F opcode 0F C7 C8 opcode Overly long instruction Device names

23. 23 Detecting Parallels IDT/GDT at high memory address Non-zero LDT Device names

24. 24 Detecting VirtualBox CPUID K7 Easter Egg CMPXCHG8B memory write Double-faulting CPU

25. 25 Detecting Bochs [WB] INVD flushes TLBs REP CMPS/SCAS flags CPUID processor name CPUID AMD K7 Easter Egg 32-bit ARPL register corruption 16-bit segment wraparound Device names Undocumented opcodes and opcode maps

26. 26 Attacking Bochs Bochs denial-of-service –Floppy with >18 sectors per track –Floppy with >512 bytes per sector –Non-ring0 SYSENTER CS MSR

27. 27 Detecting Hydra REP MOVS/SCAS integer overflow 16-bit segment wraparound

28. 28 Detecting QEMU CPUID processor name CPUID K7 Easter Egg CMPXCHG8B memory write Double-faulting CPU

29. 29 Detecting Atlantis and Sandbox Unimplemented APIs Incorrectly-emulated APIs –Example: Beep() in Windows 9x vs Windows NT Unfortunately correct emulation –Example: not crashing on corrupted WMFs

30. 30 Detecting Sandbox IDT at high memory address GDT in low memory address Non-zero LDT Misaligned IDT/GDT limits Unsupported common instructions Unexpected CPUID presence and behaviour CMPXCHG memory write

31. 31 Detecting CWSandbox cws_[pid]_mutex cws_[pid]_event_data cws_[pid]_event_result cws_[pid]_mapping 290 hooked APIs! 10 hooked methods

32. 32 Escaping from CWSandbox Step 1. FreeLibrary(GetModuleHandleA("cwmonitor")) Step 2. …that’s it.

33. 33 What can we do? Reduced-privilege guests –Nothing VirtualPC –Intercept SIDT –Check for maximum instruction length –Remove custom CPUID processor name Bochs, Hydra, QEMU –Bug fixes Full stealth should be possible

34. 34 Copyright © 2007 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Thank You! Peter Ferrie peter_ferrie@symantec.com