Slashdot Mirror
Attacking Sandboxes
SkiifGeek writes "Many anti-malware applications use a sandbox as a tool to help identify potentially malicious software. Now knowledge is spreading about techniques and methods that can allow sandboxed software to target the sandbox itself (and by extension the application that applied it). While attacks that specifically target sandboxing applications are probably a little way off, this technology can be considered the logical extension of techniques and procedures to identify the presence of hosted systems (VMWare, Virtual PC, etc.)."
So when will we be able to attack the Matrix?
That's ok. We can just sandbox the sandbox and still be safe.
for building a box out of sand. what were we thinking?
Bite my shiny metal ass.
Theres a simple detection program called RedPill that probes a simple method to do so, vmware leaves a lot of registry keys on windows, VirtualBox lacks supports for hardware breakpoints, cpu cycles counts is another way to detect virtualization, and some packed malware dont even run on virtual machines because of memory management, software packed with armadillo do not run on vbox and it used to fail on vmware player until they fixed that bug.
"Thwarting Virtual Machine Detection" is a nice paper on virtual machine detection.
There will never, ever be an end to this.
As long as people are imperfect (and they always will be) there will be measures, countermeasures, and counter-counter measures. New techniques will make old ones obsolete, and even newer techniques will make the once-new techniques no longer apply.
With this understanding, any technology that can outsurvive more than one or two iterations of other products in the same field becomes "venerable" and "stable".
Which makes now a particularly good time to appreciate the guys who worked out the spec for TCP/IP some 30 (?) years ago. Despite going from mainframes, to minis, to PCs, and now on to the era of ubiquitous computing, the basic concepts and ideas behind the TCP/IP specification continue to hold steady and useful. They managed to come up with a technology, that whatever flaws have actually been found, hasn't come up against any real show-stoppers. None.
To which I can only say: WOW.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The article didn't say that they've found code that attacks sandboxes, it said that they've found code that detects a sandbox (VMWare for instance) and plays innocent so as to avoid detection through the sandbox.
It also said that software has been found that detects when it's attached to a debugger. Big deal, copy protection schemes have been doing that for decades.
The article then goes on to FUD that code that attacks the sand box "must" be coming.
Oh, it must be coming. Uhuh.
That malware detects VMs is old news. I'd wager about 60% of current malware has VM detection built in. About as many have debugger detection. Some overlapping allowed.
So far, malware that "breaks out" of the sandbox would be new to me (though I'd be grateful for a sample). Though, seriously, why not run a VM with Windows (to analyze) on a box running Linux? I'd be very interested if someone manages to do the feat of creating a piece of malware that manages to break out of the sandbox and then run on a machine with a completely different operating system.
If you wanna throw another stick between the malware's feet, run the VM on a non-i386 architecture. If someone manages to break out of THAT and manages to hijack my machine, he really earned it and should get it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I've got friends who know how to block your friend's actions.
I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
If you'll review the vmware source,
you'll see, about line 452 of vm_ostat.c,
that there is a major flaw.
Stuff like this will make VMWare, Parallels, and others improve their product so it becomes difficult (if not impossible) to detect that the host is virtual.
By the same token, it suggests a new attack against malware.... find out what makes a piece of malware think it's running on a VM and then make a physical machine react the same way. The possibilities are endless here.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
To detech VMware, it's almost trivial. VMware can be detected with a built-in backdoor. The backdoor is a configurable setting that's on a lot of times. Programs like VMware Tools use it to enhance KVM operations. An easier check would be to look on the system to see if your network driver is the VMware NIC drivers.
"Piercing the abstraction" as they call it in the business, however, is much more difficult especially on a VM running on top of VMware's ESX, which don't actually interact with the guest OS except via software that uses the backdoor. If it is turned off, VMware doesn't talk to the guest OS so I don't see an easy way of doing this. VMware works by intercepting special system calls and getting out of the way and allowing the VM to execute its code on the CPU itself.
Solutions like paravirtualization would be more susceptible to these attacks than a hypervisor like VMware.
EvilCON - Made Famous by
So the little tykes are refusing to play nice in the sand box, so add some sand toys. I always wanted one of those little shovel things.
Malware's built-in detection makes hell of the casual e-sleuth's investigation techniques, and there seems only one sure-fire way to make sure malware behaves as you wish; keep it on a real system. I'm mostly speaking of network-oriented malware (ie: botnet clients), where you don't really care so much about what goes on with the infected system, so much as what occurs during the control/attack phase.
So, does anyone know of a particularly home-friendly way to handle a real-hardware box? I'm not sure of the best way to do this, but I assume it may simply require a CD/DVD that boots windows, instead of re-imaging the drive every time you want to test something new (which sounds quite...painful).
Setup a callgate, call it, the exceptions generated will be subtlety wrong. There's a lot of real weird stuff in the Intel instruction set that VMWare doesn't even try to emulate because the only OS that uses even 1% of it is OS2.
These are so called WONTFIX bugs.. all VMs have them. There ain't enough hours in the day to worry about every nook and cranny of the x86 architecture.
How we know is more important than what we know.
My wife just stormed out of the house, after we had an argument over whether Slashdot is "professional" for me or just encourages "antisocial views and behavior". I bet her that if we browsed to Slashdot RIGHT NOW the first headline would be NEWSWORTHY and NOT antisocial. "Attacking Sandboxes". Thanks a lot.
This sounds like MS FUD to me. Considering that their aim is to stop virtualization (if they are not doing it on their crippleware). It makes their OS irrelevant. And the increasing amount of reports on how virtualization is helping build leaner more efficient server farms and the like bolster this.
This reeks of MS tactics. No proof yet but I am sure it will come out eventually. It usually does. I would not be surprised if they indirectly had something to do with finding these vulnerabilities. MS Fanbois flame away.
An idea similar to this was proposed in 1980s science fiction. In particular, Eternity by Greg Bear had a computer virus that could escape any sandboxed environment.
People will start to think of sandboxes like they do fire walls. (Hay its wallz of fires! hay im no0b!)
hahahahahahhahahahahaha
I hate when people do that.
Just remember....recursive code is great code, because its recursive, so its great.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
Sandbox Sandbox Sandbox
There is no spoon
Can You Say Linux? I Knew That You Could.
I've always said it, and I'll keep saying it until malware takes my baby away, but every time someone makes a smarter anti-virus, some teenager will create a better virus. It's the computer equivalent to pesticide: it kills one batch of bugs, but the next generation grows immune.
Meanwhile, I avoid ALL forms of anti-malware tools, and magically I rarely get infected. When I do, I notice pretty quickly because I actually pay attention to what my PC is doing. If a certain task (or game) is used to running smoothly, and all of a sudden it starts wigging out, I'll know something is up. It's not like malware has ever cared to be spartan when it comes to CPU and memory usage.
If McAfee could stop selling anti-virus software, and instead just sell a book or instructive video on how to not be stupid and how to not click on all those sexy ActiveX prompts, well first of all they'd go out of business because they're a sloppy ass company, but secondly maybe some people would actually develop the ability to not click everything under the sun.
As it stands, I am of ZERO value to malware authors because my PC doesn't get involved in their spam/botnets, nor do I spread the plague to my friends and coworkers. I'm also worth ZERO to the anti-virus companies. If more people could self-police their PC like me, it would put a dent in both the virus and anti-virus businesses and as a result, it would slow the evolution of malware.
If two kids are fighting over a silly toy, when you take away the toy, they find something else to occupy them. Virus authors are no different. Businesses are no different. Humankind as a whole is no different.
-Billco, Fnarg.com
What you need to run, in order to overcome sandboxing, is my handy
utility called Cats(TM). It will effectively pollute any benefits of
sandboxing. In addition, it will spawn child processes Kittens(TM) to
further confuse the processes.
Ha!
/dev/colon >/proc/virtual/1
I always know there are security problems with sandboxes - and all the cats on the world surely know how to break them:
cat
Isn't it awful that a VMware virtual machine has its own VMware specific registry entries, drivers, services that make it so obvious the system is virtual? NO!!! Who cares! If a hacker can get at your registry or list drivers, they don't need to attack the hypervisor. Give them a bit and (assuming your VM is on the network) they'll be running through your network without going through the hypervisor.
I have not worked much with other virtualization technologies but if I wanted to attack a VMware virtual infrastructure (and I don't), IMO the weakest link is the VirtualCenter server. It communicates with each VMware Host (ESX, Virtual Server) and controls resource allocation (memory, network, CPU, disk shares), network connectivity through the host, virtual machine power functions, etc. of the entire virtual environment. And hey, it runs on Windows, a hacker's favorite target. Why would a hacker waist time learning how to hack into the hypervisor (rhetorical.. I know the answer... Because it's there...) when he already know how to hack into the one box with the keys to the virtual kingdom. Sure the hypervisor is an attack vector, but there are bigger, more probable ones that would concern me first!
Protect your VirtualCenter server folks. It is the weakest link.
In MY sandbox?
I was about to say 13256278887989457651018865901401704640, but it appears this number is private property.