OS-SOMMELIER - The University of Texas at Dallas

74 Pages·2012·3.7 MB·English

Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
OS-SOMMELIER: Memory-Only Operating
System Fingerprinting in the Cloud
YufeiGu†,YangchunFu†,AravindPrakash‡
Dr. ZhiqiangLin†,Dr. HengYin‡
†UniversityofTexasatDallas ‡SyracuseUniversity
October16th,2012
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Outline
1 Motivation
2 State-of-the-Art
3 DetailedDesign
4 Evaluation
5 Conclusion
OSFingerprintingintheCloud
Givenavirtualmachine(VM)
image(orarunninginstance),
preciselyinferitsspecificOS
kernelversions
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
What is OS Fingerprinting
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
What is OS Fingerprinting
OSFingerprintingintheCloud
Givenavirtualmachine(VM)
image(orarunninginstance),
preciselyinferitsspecificOS
kernelversions
1 VirtualMachine
Introspection[Garfinkeland
Rosenblum,NDSS’03]
2 PenetrationTesting
3 VMManagement(Kernel
Update)
4 MemoryForensics
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Why we need OS Fingerprinting in the Cloud
2 PenetrationTesting
3 VMManagement(Kernel
Update)
4 MemoryForensics
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Why we need OS Fingerprinting in the Cloud
1 VirtualMachine
Introspection[Garfinkeland
Rosenblum,NDSS’03]
3 VMManagement(Kernel
Update)
4 MemoryForensics
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Why we need OS Fingerprinting in the Cloud
1 VirtualMachine
Introspection[Garfinkeland
Rosenblum,NDSS’03]
2 PenetrationTesting
4 MemoryForensics
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Why we need OS Fingerprinting in the Cloud
1 VirtualMachine
Introspection[Garfinkeland
Rosenblum,NDSS’03]
2 PenetrationTesting
3 VMManagement(Kernel
Update)
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Why we need OS Fingerprinting in the Cloud
1 VirtualMachine
Introspection[Garfinkeland
Rosenblum,NDSS’03]
2 PenetrationTesting
3 VMManagement(Kernel
Update)
4 MemoryForensics
Usingatrusted,isolated,dedicated
VMtomonitorotherVMs
BinaryCodeReusebasedVMI
Virtuoso[Dolan-Gavittetal,
Oakland’11]: usingtrained
existinglegacycodeto
performVMI
VMSpaceTraveler[FuandLin,
Oakland’12]: dynamically
instrumentinglegacybinary
codetoperformVMI
Motivation State-of-the-Art DetailedDesign Evaluation Conclusion
Virtual Machine Introspection (VMI)
[GarfinkelandRosenblum,NDSS’03]
A Trusted OS Linux Win‐7
..
Secure‐VM Product‐VM Product‐VM
Introspect
Virtualization Layer
Hardware Layer