VMware escape and firmware viruses

30 Pages·2007·2.01 MB·English

by  Arrigo Triulzi

VMware escape and
firmware viruses
or
“Are you sure that it is your network
card running under the hypervisor?”
Arrigo Triulzi
[email protected]
30th October 2007 © Arrigo Triulzi, 2007 1
Overview
• Historical background
• Escaping Virtual Machines
• Escaping VMware
• Altering the landscape
• Beyond escaping
• Conclusions
30th October 2007 © Arrigo Triulzi, 2007 2
Historical background
• Virtual Machines (VMs) are an old
concept:
– Pioneered by IBM in 1968 (System/36 and
OS/VM).
– Evolved by IBM to the point of testing new
releases of OS/VM under OS/VM itself.
– Used also for programming languages
(Pascal p-code, Java, etc.).
30th October 2007 © Arrigo Triulzi, 2007 3
Historical background
• The “industrial strength” VMs were
IBM!s forte. The concept of “LPAR
escape” is still viewed as heresy.
• Weaker forms of VMs exist: BSD jails,
Solaris containers, etc.
• In programming languages they are
very fashionable: Java, C#, etc.
30th October 2007 © Arrigo Triulzi, 2007 4
Escaping Virtual Machines
• Escaping a VM is obviously attractive:
– Prevent virus/bot analysis,
– Take over a virus analyst!s console,
– Modify the host operating system,

– Walk away with the VMware disk images
and demand a ransom,
– Subvert “secure” software environments…
30th October 2007 © Arrigo Triulzi, 2007 5
Escaping Virtual Machines
Let us consider the JVM…
• Initial design:
– Bytecode was always interpreted
– Bytecode was verified on load
– Ran (almost) everywhere
– Was terribly slow!
30th October 2007 © Arrigo Triulzi, 2007 6
Escaping Virtual Machines
• Enter the Just-In-Time compiler:
– Selected bytecode is compiled into
machine code for the architecture
– By carefully choosing the bytecode to be
compiled the JVM obtains substantial
speed improvements
– So, everyone is happy, right?
30th October 2007 © Arrigo Triulzi, 2007 7
Escaping Virtual Machines
• The JIT is a complex piece of code, far
more complex than the bytecode
interpreter itself.
• The bytecode interpreter is “provably
correct”.
• The JIT isn!t.
• Therefore the JIT is “interesting”.
30th October 2007 © Arrigo Triulzi, 2007 8
Escaping Virtual Machines
data code
JVM
bytecode
JIT
The JVM now has a fast path
“hotspot”
which assumes that the hotspot
code is safe and correct.
30th October 2007 © Arrigo Triulzi, 2007 9
Escaping Virtual Machines
• The JIT converts data (the bytecode)
into code (the “hotspot”) thereby
bypassing the “interpret only” security of
the JVM.
• So, if we manage to write some
bytecode which is acceptable to the
JVM bytecode verifier but triggers a bug
in the JIT we might have an escape…
30th October 2007 © Arrigo Triulzi, 2007 10