Compatibility is not transparency: VMM detection myths and realities

Proceedings of HotOS 2007 - 11th Workshop on Hot Topics in Operating Systems

Volumn , Issue , 2007, Pages

  Garfinkel, Tal ^a   Adams, Keith ^a   Warfield, Andrew ^a   Franklin, Jason ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ENGINEERING STANDPOINT; HONEYPOTS; VIRTUAL HARDWARE;

EID: 53349091372     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (24)

1. K. Adams and O. Agesen. A Comparison of Software and Hardware Techniques for x86 Virtualization. In Proceedings of the 12th International Conference on Architectural Support for Programming Languages and Operating Systems, Oct. 2006.
2. AMD. AMD64 Virtualization Codenamed “Pacifica” Technology: Secure Virtual Machine Architecture Reference Manual, May 2005.
3. AMD. AMD I/O Virtualization Technology (IOMMU) Specification, Feb. 2006.
4. Z. Amsden, D. Arai, D. Hecht, and P. Subrahmanyan. Paravirtualization API Version 2.5. www.vmware.com/pdf/ vmi specs.pdf.
5. K. Asrigo, L. Litty, and D. Lie. Using VMM-based Sensors to Monitor Honeypots. In Proceedings of the 2nd International Conference on Virtual Execution Environments, June 2006.
6. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the Art of Virtualization. In Proceedings of the 19th ACM Symposium on Operating Systems Principles, Oct. 2003.
7. Intel Corporation. Intel™ Virtualization Technology Specification for the IA-32 Intel™ Architecture, April 2005.
8. X. Jiang and D. Xu. Collapsar: A VM-Based Architecture for Network Attack Detention Center. In Proceedings of 13th USENIX Security Symposium, Aug. 2004.
9. E. Jonsson, A. Valdes, and M. Almgren. HoneyStat: Local Worm Detection Using Honeypots. In Proceedings of Seventh International Symposium on Recent Advances in Intrusion Detection, Sept. 2004.
10. S. T. King, P. M. Chen, Y.-M. Wang, C. Verbowski, H. J. Wang, and J. R. Lorch. SubVirt: Implementing Malware with Virtual Machines. In Proceedings of the IEEE Symposium on Security and Privacy, May 2006.
11. T. Liston and E. Skoudis. On the Cutting Edge: Thwarting Virtual Machine Detection. http://handlers.sans.org/tliston/ThwartingVMDetection Liston Skoudis. pdf, July 2006.
12. Microsoft. CPU Virtualization Extensions: Analysis of Rootkit Issues. http://www.microsoft.com/whdc/system/platform/virtual/CPUVirtExt.mspx. Windows Hardware Developer Central, October 20, 2006.
13. G. Neiger, A. Santoni, F. Leung, D. Rodgers, and R. Uhlig. Intel Virtualization Technology: Hardware Support for Efficient Processor Virtualization. Intel Technology Journal, 10(3), Aug. 2006.
14. PCI SIG. PCI I/O Virtualization Specifications.
15. J. Robin and C. Irvine. Analysis of the Intel Pentium's Ability to Support a Secure Virtual Machine Monitor. In Proceedings of the 9th USENIX Security Symposium, Aug. 2000.
16. M. Rosenblum, S. A. Herrod, E. Witchel, and A. Gupta. Complete computer system simulation: The SimOS approach. IEEE Parallel and Distributed Technology: Systems and Applications, 3(4):34-43, Winter 1995.
17. J. Rutkowska. Subverting Vista Kernel for Fun and Profit. Presented at Black Hat USA, Aug. 2006.
18. S. Sidiroglou, J. Ioannidis, A. D. Keromytis, and S. J. Stolfo. An Email Worm Vaccine Architecture. In Proceedings of the First Information Security Practice and Experience Conference, 2005.
19. M. Vrable, J. Ma, J. Chen, D. Moore, E. Vandekieft, A. C. Snoeren, G. M. Voelker, and S. Savage. Scalability, Fidelity, and Containment in the Potemkin Virtual Honeyfarm. In Proceedings of the 20th ACM Symposium on Operating Systems Principles, Oct. 2005.
20. C. A. Waldspurger. Memory Resource Management in VMware ESX Server. In Proceedings of the 5th USENIX Symposium on Operating Systems Design and Implementation, Dec. 2002.
21. Y.-M. Wang, D. Beck, X. Jiang, R. Roussev, C. Verbowski, S. Chen, and S. T. King. Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities. In Proceedings of Network and Distributed Systems Security Symposium, Feb. 2006.
22. A. Whitaker, M. Shaw, and S. D. Gribble. Scale and Performance in the Denali Isolation Kernel. In Proceedings of the 5th USENIX Symposium on Operating Systems Design and Implementation, Dec. 2002.
23. L. Zeltser. Virtual Machine Detection in Malware via Commercial Tools. http://isc.sans.org/diary.php?storyid=1871. Handlers Diary, November 19, 2006.
24. D. D. Zovi. Hardware Virtualization-Based Rootkits. Presented at Black Hat USA, Aug. 2006.