Virtual Machine Extrospection: a Reverse Information Retrieval in Clouds 1P.Vijay Bhaskar Reddy2n.Venkateswarlu
Total Page：16
File Type：pdf, Size：1020Kb
International Journal of Research in Engineering, IT and Social Science, ISSN 2250-0588, Impact Factor: 6.565, Volume 09, Special Issue 4, May 2019, Page 239-253 Virtual Machine Extrospection: A Reverse Information Retrieval in Clouds 1P.Vijay Bhaskar Reddy2N.Venkateswarlu 2 Scholar, Dept. of Master of Computer Applications, Narayana Engineering College, Gudur. 1 Assistant Professor, Dept. of Master of Computer Applications, Narayana Engineering College, Gudur. Abstract—In a virtualized environment, it is not Asthehypervisor runsatamoreprivilegedlevelthan difficult to retrieve guest OS information from its its guest OSes, at this level, one can control hypervisor. However, it is very challenging to physical resources, monitor their access, and be retrieve information in the reverse direction, i.e., isolated from tampering against attackers from the retrieve the hypervisor information from within a guest OS. Monitoring offline-grained information guest OS, which remains an open problem and of the guest OSes from the underlying hypervisoris has not yet been comprehensively studied before. called virtual machine introspection (VMI)[1]. In this paper, we take the initiative and study this However, at the guest OS level retrieving reverse information retrieval problem. In information about the underlying hypervisor particular, we investigate how to determine the becomes very challenging, if not impossible. In host OS kernel version from within a guest OS. thispaper,welabelthereverseinformationretrievalwit We observe that modern commodity hypervisors h the coined term virtual machine introduce new features and bug fixes in almost extrospection(VME).While VMI has been widely every new release. Thus, by carefully analyzing used for securitypurposesduring the past decade, the seven-year evolution of Linux KVM the reverse directionVME—theprocedurethat development (including 3485 patches), we can retrieves the hypervisor information from identify 19 features and 20 bugs in the hypervisor theguestOS level—is a new topic and has not detectable from within a guest OS. Building on beencomprehensively studied before. our detection of these features and bugs, we VME can be critically important for both malicious at- tackers and regular users. On one present a novel framework called Hyperprobe hand, from the attackers’ perspective, when an that for the first time enables users in a guest OS attacker is in control of a virtual machine (VM), to automatically detect the underlying host OS either as a legal resident or after a successful kernel version in a few minutes. We implement a compromise of the victim’s VM, the underlying prototype of Hyperprobe and evaluate its hypervisor becomes its attacking target. This threat effectiveness in six real world clouds, including has been demon- strated in [8], [9], where an Google Compute Engine (a.k.a. Google Cloud), attacker is able to mount a privilege escalation HP Helion Public Cloud, ElasticHosts, Joyent attack from within a VMware virtual machine and Cloud, CloudSigma, and VULTR, as well as in a a KVM-based virtual machine, respectively, and controlled testbed environment, all yielding then gains some control of the host machine. promising results. Although these works demonstrate the possibility of such a threat, successful escape attacks from the Index Terms—Virtualization, Hypervisor, guest to the host are rare. The primary reason is Extrospection, Linux, KVM. that most hypervisors are, by design, invisible to the VMs. Therefore, even if an attacker 1.INTRODUCTION gainsfull control of a VM, a successful attempt to prevalent,a variety of security methodologies break out of theVM and break into the hypervisor havebeende- veloped at the hypervisor level, requires an in-depth knowl- edge of the underlying includingintrusionand hypervisor, e.g., type and version of the malwaredetection[1],[2],honeypots[3],[4],kernelro hypervisor. However, there is no straightforward otkitdefense [5], [6], and detection of way for attackers to obtain suchknowledge. covertlyexecutingbinaries[7]. These security On the other hand, benign cloud users services depend on the key may also need to know the factorthatthehypervisorisisolatedfromitsguestOSes. underlyinghypervisor information. It is com- http://indusedu.org Page 239 This work is licensed under a Creative Commons Attribution 4.0 International License International Journal of Research in Engineering, IT and Social Science, ISSN 2250-0588, Impact Factor: 6.565, Volume 09, Special Issue 4, May 2019, Page 239-253 monly known that hardware and software Hyperprobe, we per- form experiments in a systems both have various bugs and controlled testbedenviron- ment. For 11 of the 35 vulnerabilities, and different hard- kernel versions we studied, Hyperprobe can ware/software may exhibit different correctly infer the exact version vulnerabilities. Cloud customers, when number;fortherest,Hyperprobecannarrowitdown to making decisions on the choice of a cloud within 2 to 5versions. provider, may want to know more The remainder of the paper is organized as information about the underlying hardware or follows. Section 2 describes the background of our software. This will help customers determine work. Section 3 presents the design of Hyperprobe. whether the underlying hardware/software Section 4 detailsthe implementation of Hyperprobe can be trusted, and thus help them decide with several case studies. Section 5 presents whether or not to use this cloud service. experimental results on virtual machines in the However, for security reasons, cloud cloud and our controlled testbed. Section 6 providers usually do not release such discusses some potential extensions to the sensitive information to the public framework. Section 7 sur- orcustomers. veysrelatedwork,andfinally,Section8concludesthep Whereas research efforts have been made to aper. detect the existence of a hypervisor [10], [11], [12], [13], from a guest OS, to the best of our 2 BACKGROUND knowledge, there is no literature describing how Hypervisor, also named as virtual machine to retrieve more detailed information about the monitor, is a piece of software that creates and hypervisor, e.g., the kernel version of the host manages VMs. Tradition- ally, hypervisors such as OS, the distribution of the host OS (Fedora, VMware and Virtual PC use the technique of SuSE, or Ubuntu?), the CPU type, the memory binary translation to implement virtualization. type, or any hardware informa- tion. In this Later on, x86 processor vendors including Intel paper, we make an attempt to investigate this and AMD released their architecture extensions to problem. More specifically, as a first step support virtualiza- towards VME, we study the problem of tion.Thosehypervisorsthatusebinarytranslationarec detecting/inferring the host OS kernel version alled software-only hypervisors, and recent from within a guest OS, and we expect our hypervisors that take advantage of these processor work will inspire more attention on mining the extensions are calledhardware assisted hypervisors information of a hypervisor. The major research [20]. In this paper, we focus on a popular hardware contributions of our work are summarized assisted commodity hypervisor, Linux KVM. We asfollows: develop our framework and performexperiments Wearethefirsttostudytheproblemofdetec- on a physical machine with Linux OS as the host, ing/inferring the host OS kernel version from which runs a KVM hypervisor, and a VM is within a VM. Exploring the evolution of Linux running on top of the KVM hy- pervisors, we analyze various features hypervisor.OurstudycoversLinuxkernelversionsfro and bugs introduced in the KVM hypervisor; and m then we explain how these features and bugs can 2.6.20 to 3.14. While 2.6.20, released in February be used to detect/infer the hypervisor kernel 2007, is the first kernel version that includes version. KVM, 3.14, released in March 2014, is the latest stable kernel at the time of this study. More .We design and implement a novel, practical, auto- specifically, we study the evolution of KVM over matic, and extensible framework, called the past seven years and make three major Hyperprobe, for conducting the reverse observa- tions. In this section, we briefly describe information retrieval. Hy- perprobe can help users Linux KVM and report ourobservations. in a VM to automatically detect/infer the 2.1 LinuxKVM underlying host OS kernel version in less than five minutes with highaccuracy. KVM refers to kernel-based virtual machine. Since .We perform our experiments in six real world Linux kernel version 2.6.20, KVM is merged into clouds, including Google Compute Engine [14], the Linux main- line kernel as a couple of kernel HP Helion Public Cloud [15], ElasticHosts [16], modules: an architecture JoyentCloud [17], CloudSigma [18], and VULTR [19], and our experimental results are very promising. To fur- ther validate the accuracy of http://indusedu.org Page 240 This work is licensed under a Creative Commons Attribution 4.0 International License International Journal of Research in Engineering, IT and Social Science, ISSN 2250-0588, Impact Factor: 6.565, Volume 09, Special Issue 4, May 2019, Page 239-253 Qemu Qemu emulating a CPU is hard. Since a modern CPU App App Normal User Normal User defines hundreds of registers, emulating the Process behaviors of various registers correctly is Guest Guest Process OS OS challenging. Failing to do so usually causes various unexpected results. In fact, register Linux Kernel KVM related bugs have been reported on a regularbasis.