Detection and Subversion of Virtual Machines

[Nytro]

Detection and Subversion of Virtual Machines

Dan Upton

University of Virginia

CS 851 - Virtual Machines

Abstract

Recent virtual machines have been designed to take

advantage of run-time information to provide various

services including dynamic optimization, instrumenta-

tion, and enforcement of security policies. While these

systems must run in the same user space as the pro-

gram running under their control, they must remain as

transparent as possible so as to prevent aecting the

correctness of the guest program. However, the virtual

machine must store its own code and program state as

well as information about the guest program. This data,

stored in the program's user space, may lead to gaps

in transparency that can be used to detect their pres-

ence. Additionally, while many virtual machines have

a smaller code base than operating systems, they may

still contain their own unique errors and security holes.

This research shows that it is possible to use dierent

run-time clues to detect the existence of several com-

mon virtual machines. Further, information about the

existence of these virtual machines can be used to at-

tack the system. As a result, this paper presents coun-

termeasures that should be taken by designers of these

systems to prevent detection and attacks.

Download:

www.cs.virginia.edu/~dsu9w/upton06detection.pdf