Upload File

subvirt: implementing malware with virtual machines

  • Home
  • Documents
  • SubVirt: Implementing malware with virtual machines
26
SubVirt: Implementing malware with virtual machines Yi-Min Wang Chad Verbowski Helen J. Wang Jacob R. Lorch Microsoft Research Samuel T. King Peter M. Chen University of Michigan

Upload: hedy-gilmore

Post on 31-Dec-2015

32 views

Category:

Documents


3 download

Report

DESCRIPTION

Yi-Min Wang Chad Verbowski Helen J. Wang Jacob R. Lorch Microsoft Research. SubVirt: Implementing malware with virtual machines. Samuel T. King Peter M. Chen University of Michigan. Attackers. Defenders. Motivation. Attackers and defenders strive for control - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: SubVirt: Implementing malware with virtual machines

SubVirt: Implementing malware with virtual

machines

Yi-Min WangChad VerbowskiHelen J. WangJacob R. Lorch

Microsoft Research

Samuel T. KingPeter M. Chen

University of Michigan

Page 2: SubVirt: Implementing malware with virtual machines

2/23

Motivation

• Attackers and defenders strive for control– Attackers monitor and perturb execution

• Avoid defenders

– Defenders detect and remove attacker– Control by lower layers

Hardware

Operating system

App1 App2Attackers Defenders

Page 3: SubVirt: Implementing malware with virtual machines

3/23

Virtual-machine based rootkits (VMBRs)

• VMM runs beneath the OS– Effectively new processor privilege

level

• Fundamentally more control• No visible states or events• Easy to develop malicious services

Page 4: SubVirt: Implementing malware with virtual machines

4/23

Virtual-machine based rootkits (VMBRs)

Hardware

Target OS

App1 App2

Beforeinfection

Hardware

Target OS

App1 App2

VMM

Attacksystem

Afterinfection

Page 5: SubVirt: Implementing malware with virtual machines

5/23

Outline

• Installing a VMBR• Maintaining control• Malicious services

• Defending against this threat

• Proof-of-concept VMBRs

Attacker’sperspective

Defender’sperspective

Page 6: SubVirt: Implementing malware with virtual machines

6/23

Installation

• Assume attacker has kernel privilege– Traditional remote exploit– Bribe employee– Malicious bootable CD-Rom

• Install during shutdown– Few processes running– Efforts to prevent notification of activity

Page 7: SubVirt: Implementing malware with virtual machines

7/23

Installing a VMBR

• Modify the boot sequence

BIOS

Masterboot

recordBoot

sector OS

Page 8: SubVirt: Implementing malware with virtual machines

8/23

Installing a VMBR

• Modify the boot sequence

BIOS

BIOS

Masterboot

recordBoot

sector OS

VMBRloads

Page 9: SubVirt: Implementing malware with virtual machines

9/23

Maintaining control

• Hardware reset VMBR loses control• Illusion of reset w/o losing control• Reboot easy, shutdown harder

BIOS

BIOS

Masterboot

recordBoot

sector OS

VMBRloads

Page 10: SubVirt: Implementing malware with virtual machines

10/23

Maintaining control

• ACPI BIOS used for low power mode– Spin down disks– Display low power mode– Change power LED

• Illusion of power off, emulate shutdown

• Control the power button

• System functionally unchanged

Page 11: SubVirt: Implementing malware with virtual machines

11/23

Malicious services

• Advantages of high and low layer malware– Provides low layer implementation– Still easy to implement services

• Use a separate attack OS to implement

Hardware

Target OS

App1 App2

VMM

Attack OS

App

Page 12: SubVirt: Implementing malware with virtual machines

12/23

Malicious services

• Zero interaction malicious services– E.g., phishing web server

• Passive monitoring– E.g., keystroke logger, file system

scanner

• Active execution modifications– E.g., defeat VM detection technique

• All easy to implement

Page 13: SubVirt: Implementing malware with virtual machines

13/23

Defending against VMBRs

• Detecting VMBRs– Perturbations

• Where to run detection software

Page 14: SubVirt: Implementing malware with virtual machines

14/23

VMBR perturbations

• Inherent– Timing of key events– Space

• Hardware artifacts– Device differences– Processor not fully virtualizable– See paper for more details

• Software artifacts– VM icon– Device names

Easy tohide

Hard tohide

Page 15: SubVirt: Implementing malware with virtual machines

15/23

Security software above

• Attack state not visible– Can only detect side effects, e.g.,

timing

• VMBR can manipulate execution– Clock controlled by VMBR– Prevent security service from running– Turn off network– Disable notification of intrusion

Page 16: SubVirt: Implementing malware with virtual machines

16/23

Security software below

• More control, direct access to resources– Could detect states or events

• Secure VMM and/or secure hardware

• Boot from safe medium– Unplug machine from wall

Page 17: SubVirt: Implementing malware with virtual machines

17/23

Proof-of-concept VMBRs

• VMware / Linux host • Virtual PC / Windows XP host• Host OS was attack OS• Malware payload ~100MB

compressed• Non fully virtualizable ISA

– To defeat would degrade performance• Software emulated devices

– Host OSes had wide range of drivers

Page 18: SubVirt: Implementing malware with virtual machines

18/23

Proof-of-concept VMBRs

• Implemented four malicious services– Phishing web server– Keystroke logger + password parser– File system scanner– Countermeasure to detection tool

• Installation scripts and modules• ACPI shutdown emulation

– Both sleep states and power button control

Page 19: SubVirt: Implementing malware with virtual machines

19/23

Related work

• Layer below attacks– Kernel layer rootkits

• VMMs for security– Trusted VMMs: Terra, NGSCB– Detect intrusions: VMI, IntroVirt– Isolation: NSA’s NetTop– Analyze intrusions: ReVirt

• Current defenses– Secure/trusted boot– Pioneer

Page 20: SubVirt: Implementing malware with virtual machines

20/23

Conclusion

• Realistic threat– Qualitatively more control– Still easy to implement service– Proof-of-concept VMBRs could be detected– HW enhancements might make more

effective

• Defending is possible– Best way it for defenders to control low

layers

Page 21: SubVirt: Implementing malware with virtual machines

21/23

Questions

Page 22: SubVirt: Implementing malware with virtual machines

22/23

Hardware artifacts

• Non fully virtualizable processor

• Computer have diverse hardware– Allow target OS to provide drivers– Device DMA unsafe, might expose VMBR– Results in different / incomplete visible HW

• Enhancements to MMU– Allow target OS to run many drivers

directly

Page 23: SubVirt: Implementing malware with virtual machines

23/23

Software artifacts

• Implementations make VMM visible

• VMware / Virtual PC hypercalls– E.g. GetVersion()

• VMware icon• Name of virtual hardware• Etc…

Page 24: SubVirt: Implementing malware with virtual machines

24/23

Performance

• Non fully virtualizable hardware tradeoff– Performance vs. perfect virtualization– Dynamic binary translation– Paravirtualization

• Simplified driver interface

• Effects of HW enhancements unknown

Page 25: SubVirt: Implementing malware with virtual machines

25/23

Impact of VM enhanced hardware

• VMBR allow target to run most HW– Only emulate devices needed for virt

• E.g., disk, network

– Target can drive everything else• Display, USB

• Better device performance• Smaller VMBR payload

Page 26: SubVirt: Implementing malware with virtual machines

26/23

Defeating the “redpill”

• Easy to detect VM on non-virt. x86 • “Redpill” uses instructions that

leak info

• Interpose on key windows functions– Fixup the “redpill” app to avoid VM

detect

• Uses virtual-machine introspection


Software and Web Security deel 1 · – malware toolkitsto create or customise malware – (CPU time on) infected machines – internet traffic (access to infected website to infect

Networks of machines compromised by malware · Networks of machines compromised by malware Estimated 16-25% of computers on Internet part of a botnet Botnet Rustock has over 1 million

Malware and Anti-Malware Seminar by Benny Czarny

Emulate virtual machines to avoid malware infections - GrrCON 2014

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Reversing malware analysis trainingpart9 advanced malware analysis

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Stochastic Identification of Malware with Dynamic Traces. · The first is via a static signature scanning ... that file as malware instantly for other machines ... Stochastic identification

Implementing malware with virtual machines

Metamorphic Malware 1 Metamorphic Malware Research

Networks of machines compromised by malware

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

SubVirt: Implementing malware with virtual machines

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Reversing malware analysis training part8 malware memory forensics

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Intrusion Detection and Malware Analysis - Malware collection

SPLIT PERSONALITY MALWARE DETECTION AND DEFEATING IN POPULAR VIRTUAL MACHINES Alwyn Roshan Pais [email protected] 1 Department of Computer Science &

SubVirt: Implementing malware with virtual machines Yi-Min Wang Chad Verbowski Helen J. Wang Jacob R. Lorch Microsoft Research Samuel T. King Peter M

Android Malware Exposed-Evolution of Android Malware

SPLIT PERSONALITY MALWARE DETECTION AND DEFEATING IN POPULAR VIRTUAL MACHINES

SubVirt: Implementing malware with virtual machines

CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

SubVirt: Implementing malware with virtual machines Authors: Samuel T. King, Peter M. Chen University of Michigan Yi-Min Wang, Chad Verbowski, Helen J

Malware Analysis and Defeating using Virtual Machines

AAnnttii--MMaallwwaarreehelp.kaseya.com/webhelp/EN/AM/9050000/EN_AMguide_R95.pdf · Anti-Malware provides Malwarebytes' Anti-Malware Pro endpoint security for managed machines. Anti-Malware

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware