Slashdot Mirror
Virtual Machines for Security
k-hell writes "Researchers from the University of Michigan are using virtual machines to 'to provide security in an operating-system-independent manner.' They have designed and implemented a replay service for virtual machines called
ReVirt, which 'logs enough information to replay a long-term execution of a virtual machine instruction-by-instruction.' A system called BackTracker 'automatically identifies potential sequences of steps that occurred in an intrusion,' and they provide a nice example of BackTracker's output for an attack against a machine that they set up as a honeypot, where an attacker gained access through httpd. Here's the source code."
See an attack and have it try the same one right afterwards on the source ip. Oh wait - that's probably a box they hacked first. d'oh!
Using a Virtual Machine as a honeypot? Why didn't I think of that? ;)
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
what if the virtual machine is not secure?
Great Linux Site
Isn't this called Java?
Never trust a man in a blue trench coat, Never drive a car when you're dead
They seems make a big point that they want OS independence for their system but they built it using User Mode Linux. How will this be OS independent?
Seems like this is a solution for recording the every move a computer makes, so when it is hacked you can play back moment-by-moment what exactly happened.
The only problem... by the time you realize it's time to look at the playback, the "virtual machine" is already 0wned. Useful for honeypots, but this isn't going to secure a production system... it's not a line of defense, it's a just a very detailed logging of what happened.
That's the first time i've ever seen a story on slashdot simultaneously sitting at the top of both the main story page and the "Older Stuff" box.
Neat effect, that.
We hardly care about stuff like that in the tech industry. Not when there are buzzwords like "wifi" or "honeypot" to be bandied about.
I don't need no instructions to know how to rock!!!!
The virtual machine that ReVirt and its predecessor are built on is called UMLinux. I used it for a school project that analyzed a virtual kernel that had been minimized to achieve improved performance. The current incarnation of UMLinux, now called FAUmachine, is available from the FAUmachine project site.
I think they're talking about a hairless honeypot.
There is some validity to your point. However you underime this project and all honey pots/nets when you say they are not a line of defense. They provide very valuable information that then goes into that line. Not to mention if you have a Decoy (one configured exaclty as the real and thought to be secure, except it has no valuable data) honey machine that gets hacked before your production one is. You now know how to prevent the intrider from attacking the real machine.
The JVM itself is not as secure as its architects would like it to be. When you program for the JVM, you're supposed to use a Java compiler, and actually a lot of the safeguard features come from the compilation process and the specification of the Java language.
However, in the doc it is stated that the JVM may interpret *every* valid
Anyway, this VM guys have an interesting idea...
PS: I'm currently working on a JVM assembler(nothing to take from Jasmin, but the inspiration), that'll have no practical use, of course, but I still hope that there're some people that'll find it interesting......
1. No sig. 2. ???? 3. Profit!!!
I would have a virtual machine hosting another virtual virtual machine. If the virtual virtual machine gets owned, the real virtual machine will log on.
"We believe that even an overhead of 58% is not prohibitive for sites that value security."
I really wonder if 58% overhead is worth it. It seems to me this is still a little massive for this kind of thing. ReVirt and VMWare both do a good job of keeping the overhead down but I think there will have to be innovations in areas other than virtual machines for this kind of thing.
___ Shout Central - Crushes your nuts!
hypothetically...
if i ran virtual pc on my mac and used outlook--i could still be compromised by bugbear... and that's secure?
is this what they're trying to do? or am i on the wrong track?
----
http://www.hellection.com
Joel Spolsky had a similar thought on Monday about using VMWare to run webservers in a virtual machine, and to always have similar virtual machines ready, in case the server is hacked etc. (See his June 2, 2003 entry)
Hosting: as low as $5.95/Mo
Sure, but there's a lot of peace in mind in knowing nobody has rootkitted your production server, not to mention knowing the exact hole used to obtain access. Even better than sending your logs to a line printer ;)
Also, I bet, if you're already going to the trouble of monitoring every branch your cpu takes, and all your vmkernel system calls, you could go the extra mile and proactively look for suspicious behavior (odd binaries being called, weird IP traffic, overwriting system files, etc.,) and trigger a silent alarm somewhere. Think 'proactive canary'.
- Blenderfish
Ah, but you seem to miss the advantages of a VM. If you can see exactly how you were compramised, you can then repeat the attack after going back and securing the vulnerability. Thus enabling you to have a fast and easy way to determine vulnerabilities in your code execution. Another great advantage of a virtual machine is that you can very simply and easily revert to a "clean" copy of your machine, before the attack, and have an effective downtime of 3 seconds (the time it takes to stop the VM, select the clean copy, and boot the VM again). So in a production enviornment, you have an added layer of redundancy.
Take a database as an example. You have your tape backups, your transaction logs, etc. etc, but what if your registry (I'm talking people running MSSQL, but for other platform, think of what happens when someone crafts an improper looping arguement into an SQL write query, hosing your data structures) gets completely foobared. What do you do? Do you a) pull out the tape and have a whole bunch of downtime? Or do you just boot an older VM and apply the transaction logs to the database just before the point where everything went stupid? I think the VM would be a much faster recovery (if you consider that you are running a database that stores several hundred gigs of data, this makes more and more sense). Anyway. It's just a question of whether you feel you can implement and manage it.
Don't Ask Questions. I don't know the answers and even if I did I wouldn't tell you.
VM within a VM. You know.. just in case attackers who can bend rules start popping up. Can attackers find out whether or not they're in a VM, or can that happen only after december?
Give hackers and virus authors virtual computers made of cardboard :)
If you run xxx OS within yyy OS within zzz OS, you WILL be hit at all three OS's at the same time.
Let's see, I know if I run xxx OS it'll be compromised 50% of the time, let's improve security by running it within the yyy OS that is compromised 2% of the time to improve security.
Smith: "Surprised to see me hack your box?"
Neo: "No, but you must only realize the truth..."
Smith: "What truth?"
Neo: "There is no box" *Click*
But not in exactly the same manner:
I am reminded of the book "The Cuckoo's Egg" where a system admin at a university tracks down a hacker using teletype machines to monitor the hacker's tracks. Highlights include the reading of reams of teletype hardcopies, and the creation of a honeypot: At one point the author types responses to the hacker, simulating the UNIX box. Wacky!
Isn't this how IBM has been running Linux on it's S390 mainframes? They can virtualize just about anything because of VM. I remember a disaster recovery simulation at IBM where we restored a copy of our MVS/S390 mainframe within their VM system from our backup tapes. For all intents and purposes, it was our mainframe running inside another OS, and the other OS (VM) logged all of our activity too. We even joked with the IBMers about being able to run VM within VM and MVS within that. This is not new technology, it's just new(ish) to the smaller architectures and a new implementation of the idea.
US Democracy:The best person for the job (among These pre-selected choices...)
the more things change, the more they stay the same. virtual machines were used extensively in the '60s and '70s at time-sharing service (both service bureaus and various kinds of institutional in-house) operations .... in part because of the paradigm's isolation capability
in the early '70s had an operation that had the most sensitive of a large corporation financial & business operations being run on the same online computer that also had significant number of BU and MIT students.
Flip the lightswitch ON and OFF repeatidly :D
that's not really how a vm would work.
unless you have a couple spare disk arrays with hundreds of gigs of free space, you can't just "boot a clean VM" and be back were you were before.
and if you have hundreds of gig free, why not just copy the backup in place and go?
this virtual machine stuff doesn't help here it just gets in the way
Not entirely on topic, but I don't have anything really to add to this subject. Back in my Kazaa days, I was a little concerned about viruses etc getting me. So I set up a VM in VM-Ware and ran Kazaa on that. It did lag my computer considerably, but if Kazaa were to infect my machine, it would (in theory) be contained. Sadly, I didn't get infect with anything so I couldn't tell you how effective that was. I was kinda hoping it would be infected so I could analyze what happened. The funny result of this setup was that if you scanned my hard drive, you couldn't find any of the stuff I downloaded unless you fired up VM-Ware.
Is this similar to the concept of sandboxing, in which a process is executed in a VM where it is isolated from the rest of the system while the OS outside watches to make sure nothing bad happens?
:)
I've read of this as a potential antivirus solution, but it sounds like a bit much overhead to me. It's still at least reasonably quick to do pattern scanning. Anyway, off topic... heheh
This seems like it could be an interesting technique for debugging systems as a whole. Like when my Windows PC hangs randomly for 30 seconds, or does something quirky, it'd be nice if I (or preferably, Microsoft) can understand *why* so that the problem can be corrected. Bit rot sucks.
Virtual PC environments, complete with IP networking and various common protocols are already being used to catch viral behaviour in software before signature files for a new virus are available. New, unknown viruses will actually spread and send mail from one virtual PC to another inside your PC. There's a paper about it here, which was presented at the Virus Bulletin conference last year: /documents/nvc5_sandbox_technology_2002.pdf
http://www.norman.com
The technology is available as part of a commercial AV product from this vendor.
Virtual machines are inherantly insecure. Because the internal virtual address space is accessable externally, it can be modified, tampered with, or viewed at will. Regardless of the cryptography, the process can be slowed down, stepped through, and have any protections disabled, or even reversed.
While it's a nice thought, it doesn't add too much in terms of security, a virtual machine compromised still allows access to the rest of the virtual machine. Raw harware access is not needed to wreak havoc.
Contact Me (got tired of viruses emailing me).
The CoVirt Project
The CoVirt project is investigating how to use virtual machines to provide security in an operating-system-independent manner. Virtual-machine security services can work even if an attacker gains complete control over the guest operating system.
One hard part of designing virtual-machine security services is the semantic gap between the virtual machine and those services. Services in the virtual machine operate below the abstractions provided by the guest operating system and applications. This can make it difficult to provide services. For example, it is difficult to provide a service that checks file system integrity without knowledge of on-disk structures.
Another potential challenge of using virtual machines is that running all applications above the virtual machine hurts performance due to virtualization overhead. Commercial virtual machine monitors such as VMware achieve excellent performance by executing (mostly) directly on the bare hardware. However, we would like to use a virtual-machine monitor that runs as a user-mode application on top of a host operating system (so-called Type II VMM), and these tend to be an order of magnitude slower than a standalone system. We modified a host OS (Linux) to enable it to better support a virtual-machine monitor. The resulting virtual-machine monitor and modified guest OS (based on UMLinux) runs even kernel-intensive applications at about 14-35% overhead. See our USENIX paper for details.
We have designed and implemented a replay service for virtual machines called ReVirt. ReVirt logs enough information to replay a long-term execution of a virtual machine instruction-by-instruction. This enables it to provide arbitrarily detailed observations about what transpired on the system, even in the presence of non-deterministic attacks and executions.
We designed and implemented a system called BackTracker that will help system administrators understand (and thereby recover from) an intrusion. BackTracker automatically identifies potential sequences of steps that occurred in an intrusion. Starting with a single detection point (e.g. a suspicious file), BackTracker identifies files and processes that could have affected that detection point and displays chains of events in a dependency graph.
Here is an example of BackTracker's output for an attack against a machine that we set up as a honeypot. It shows an attacker gaining access through httpd, downloading a tar archive using wget, then installing a set of files using tar and gzip. The attacker then ran the program openssl-too, which read the configuration files that were unpacked. We detected the intrusion when the openssl-too process began scanning other machines on our network for vulnerable ports.
Project members
Papers
Presentations
Project Sponsors
Source Code
For all you lazy people who are only reading the article cause it's copied here... don't forget to click the links!
Security cameras may not prevent a *specific* break-in, but information gained from that break-in can help to further secure a location. How did the burglar get in, how did she bypass our security mechanisms, etc. Same goes for honeypots and computer networks.
Saying "security cameras don't prevent break-ins very well" is kind of like saying "crash investigations don't prevent accidents". On a single event, you're right. But that's not the point at all.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
If I understand this correctly, this virtual machine provides logging so you can "rewind" to any previous state. That would be invaluable in debugging during software development! Sure it would be good for finding security flaws, but equally good for squashing many other kinds of bugs. Perfect for anybody who ever loaded up a core file and though "how did THAT value get in there?"
Our framework contains a bytecode interpreter written in Java.
It allows you to execute specially marked methods or classes under complete control including the execution of every opcode.
I think using such approach you can implement additional security mechanisms other then the standard JVM.
- How they broke in (what the exploit was)
- When they broke in
- What they saw (if they d/l'd any sensitive data: credit cards, company information, whatever), or
- What they changed (if they installed any backdoors, trojaned binaries, etc).
Current techniques require a lot of time, a lot of expertise, a lot of Sherlock-holmes style educted guessing, and in the end you may just not know the answer. Apply some patches, restore from backup, hope you fixed the hole and didn't miss any trojans.With our system, you will be able to go back and find out all of these things with complete confidence and accuracy (once we have the proper analysis tools in place, that is).
That's what a security camera is good for. =)
TCP: Why the Internet is full of SYN.
that seems to be it. It's like guard dogs, they give a warning, and also if the bad guys are armed, serve as expendable bullet magnets.
A slightly different idea for using VMs to enhance security....
Over the last few years, I've been developing a "thin" virtual machine that runs in user-mode. The purpose of this is to allow software to be deployed in a pre-installed state, rather than having to install a bunch of file, make registry changes, etc - just distribute a single EXE that can run directly from CDROM or a download link.
Besides simplfying the installation process and prevent conflicts with other packages (DLL Hell, etc). This method of software distribution also helps protect intellectual property - for example if you use the Macromedia Flash ActiveX component - not only can your application create object instances without having to register it in the system registry - but the macromedia code automatically goes through the virtual machine to read compress/encrypted files included in the archive.
The virtual machine only takes up about 100k on disk and 500-1MB in RAM and runs on top of any version of Windows (no linux, sorry) without drivers or reboots.
Check it out:
http://thinstall.com/help
Jonathan Clark
-- Virtual Windows Project
you just need to choose the right pill ...
US Patent 6,067,410
In 2000 Symantec proposed that a virus should be evaluated on a virtual machine in order to avoid any damage to the real machine. The patent also describes a virus identification, removal, and state restoration method. Is the proposed method infringing on their patent?
-nod- In fact, the last couple scenes in Reloaded make it seem like The Matrix is based upon just this kind of layered VM model... the world where Zion exists is a simulation running on bare metal (or is it ?), inside of which there is a virtual machine running The Matrix... and everytime The One owns it, they just roll it back and start over.
25% Funny, 25% Insightful, 25% Informative, 25% Troll