• Home

  • Documents

  • SubVirt: Implementing malware with virtual machines
15
SubVirt: Implementing malware with virtual machines Authors: Samuel T. King, Peter M. Chen University of Michigan Yi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R.Lorch Microsoft Research Publication: Security and Privacy, 2006 IEEE Symposium. Presenter: Radha Maldhure

SubVirt: Implementing malware with virtual machines

Tags:

Embed Size (px)

DESCRIPTION

SubVirt: Implementing malware with virtual machines. Authors: Samuel T. King, Peter M. Chen University of Michigan Yi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R.Lorch Microsoft Research Publication: Security and Privacy, 2006 IEEE Symposium. Presenter: Radha Maldhure. Goal. - PowerPoint PPT Presentation

Citation preview

Page 1: SubVirt: Implementing malware with virtual machines

SubVirt: Implementing malware with virtual machines

Authors: Samuel T. King, Peter M. Chen

University of MichiganYi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R.Lorch

Microsoft Research

Publication: Security and Privacy, 2006 IEEE Symposium.

Presenter: Radha Maldhure

Page 2: SubVirt: Implementing malware with virtual machines

Goal

Attacker run malicious software and avoid detection

understand and defend against threat

Attacker Defender

More control

OS

Hardware

App1 App2

Attacker

Defender

Attacker Defender

Page 3: SubVirt: Implementing malware with virtual machines

VMM

Fig: architecture of VMM ( used by VMware and VirtualPC )

VM

VM runs guest OS and guest application

Host application and host OS provides convenient access to I/O devices and run VM services

VMI = set of techniques that enable VM service to understand & modify states\ events in guest

Page 4: SubVirt: Implementing malware with virtual machines

What is the presentation about?

• Virtual-machine based rootkit (VMBR)– installation– malicious services– maintaining control

• Defending against VMBR– control below VMBR– control above VMBR

Page 5: SubVirt: Implementing malware with virtual machines

VMBR

Hardware

Target OS

App1 App2

VMM

Attacksystem

Afterinfection

Hardware

Target OS

App1 App2

Beforeinfection

Attack system = Attack OS + malware

invisible User mode

Page 6: SubVirt: Implementing malware with virtual machines

Installation

Gain sufficient privileges

Install VMBR’s state on persistent storage

Modify system’s boot sequence ( VMBR loads before target OS )

Insert VMBR beneath target OS

Manipulate boot sequence

Attain privileged level(= modifying boot records)

!! Need to be done at final stage of shutdown

Page 7: SubVirt: Implementing malware with virtual machines

Malicious services (MS)There are three types

2.MS observes data from target system e.g. use keystroke loggers to obtain sensitive info like password

3.MS modifies the execution of the target

system e.g. delete email

1.MS with no communication with target systeme.g. phishing web servers

Page 8: SubVirt: Implementing malware with virtual machines

Maintaining Control

System powers-up

BIOS

VMBR stateCode

VMBR!!! Avoid reboots and shutdowns

Handle reboots: restarting the virtual hardware rather than resetting the underlying physical hardware

Handle shutdowns: use ACPI sleep states to emulate system shutdown

Fig: Booting the System

System is compromised

Page 9: SubVirt: Implementing malware with virtual machines

DefenseCan see only virtualized state

Security Software

VMBR

Security Software

Can see the actual state and state of VMBR

Page 10: SubVirt: Implementing malware with virtual machines

Security Softwarebelow VMBR

Basic idea: Detector’s view of system does not go through

VMBR’s virtualization layer

Ways:– Boot from safe medium such as CD-ROM,

USB + physically unplug before booting– Use secure VMM

Page 11: SubVirt: Implementing malware with virtual machines

Security Softwareabove VMBR

Basic idea: Security Software below VMBR is inconvenient

Ways:– Compare running time of software in VM with

benchmarks against wall-clock time– Run a program that requires entire memory or

disk space

Page 12: SubVirt: Implementing malware with virtual machines

Contribution

• Explored the design and implementation of VMBR

• Explored techniques for detecting VMBR

Page 13: SubVirt: Implementing malware with virtual machines

Weakness

• VMBR is difficult to install

• VMBR require reboot before they can run

• Have more impact on the overall system

Page 14: SubVirt: Implementing malware with virtual machines

Suggestions

• The Ideas suggested by paper is good but needs many implementations both on attacker’s side and defender’s side

• Defense not convenient for end users

• Some ideas are not clear

Page 15: SubVirt: Implementing malware with virtual machines

Questions?

Quote for the day

“No defeat is final until we stop trying”


Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents
How My SVM nailed your Malware - OWASP My SVM nailed your Malware Implementing Machine Learning into Android Malware Analysis Nikhil P Kulkarni | @nikchillz

How My SVM nailed your Malware - OWASP My SVM nailed your Malware Implementing Machine Learning into Android Malware Analysis Nikhil P Kulkarni | @nikchillz

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Implementing BYOD Plans: Are You Letting Malware In?

Implementing BYOD Plans: Are You Letting Malware In?

Documents
1 Automated malware audit service Automatischer Malware Audit

1 Automated malware audit service Automatischer Malware Audit

Documents
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Technology
Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Technology
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
SubVirt: Implementing malware with virtual machines

SubVirt: Implementing malware with virtual machines

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
SubVirt: Implementing malware with virtual machines Authors: Samuel T. King, Peter M. Chen University of Michigan Yi-Min Wang, Chad Verbowski, Helen J

SubVirt: Implementing malware with virtual machines Authors: Samuel T. King, Peter M. Chen University of Michigan Yi-Min Wang, Chad Verbowski, Helen J

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
Analisis dan Deteksi Malware Menggunakan Metode Malware

Analisis dan Deteksi Malware Menggunakan Metode Malware

Documents
Implementing BYOD Plans: Are You Letting Malware In? · IMPLEMENTING BYOD PLANS ARE YOU LETTING MALWARE IN? ... deliver real-time data to detect, to preempt, ... Implementing BYOD

Implementing BYOD Plans: Are You Letting Malware In? · IMPLEMENTING BYOD PLANS ARE YOU LETTING MALWARE IN? ... deliver real-time data to detect, to preempt, ... Implementing BYOD

Documents
Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R. Lorch- SubVirt: Implementing malware with virtual machines

Samuel T. King, Peter M. Chen, Yi-Min Wang, Chad Verbowski, Helen J. Wang, Jacob R. Lorch- SubVirt: Implementing malware with virtual machines

Documents
The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents
Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education