VM applications

1. VM 2015fall final presentation
VM applications
B00902069 傅 蕎
B00902070 沈雯萱

2. Reference Papers
● “Terra: a virtual machine-based platform for trusted
computing”, Tal Garfinkel, et. al., Proceedings of the
nineteenth ACM symposium on Operating systems
principles, SOSP’03, 2003
● “ReVirt: enabling intrusion analysis through virtual-
machine logging and replay”, G. Dunlap, et. al., ACM
SIGOPS Operating Systems Review - OSDI '02:
Proceedings of the 5th symposium on Operating
systems design and implementation, 2002
● “SubVirt: implementing malware with virtual machines”,
S.T King, P. Chen, 2006 IEEE Symposium on Security
and Privacy, 2006.
● “Cider: Native Execution of iOS Apps on Android”,
Jeremy Andrus, et. al., ASPLOS 2

3. Outline
● Why apply VM
● Four applications
 Motivation
 Technical Highlight
 Major Experience Result
 Main Contribution
● Our own idea
● Comparison
● Conclusion
3

4. Why apply VM?
● Allows programs to run cross platforms.
● Enable innovation in security.
● Failure isolation.
4

5. Four applications
● Terra, SOSP’ 03, 2003
● ReVirt, ACM SIGOPS OSR – OSDI’ 02
● RubVirt, IEEE SSP, 2006
● Cider, ASPLOS 2014
5

6. Terra:
a virtual machine-based
platform for trusted
computing
6

7. Motivation
● Commodity systems impose “fundamental
limitations” on security
● Opened-box systems
 General purpose, rich functionality
● Closed-box systems
 Greater security, maybe including tamper-resistance
7

8. Technical Highlight
● TVMM: Partitions a single tamper-resistant,
general-purpose platform into multiple
isolated virtual machines
 TVMM runs at the highest privilege level and is
secure against tampering by administrator (root
secure)
 Management VM
 Formulates all platform access control and resource
management policies
8

9. Experience Result
● Quake – multi-player online game vulnerable
to client cheating
 Terra provides:
 Security communication
 Client integrity
 Server integrity
 Isolation
 Terra can’t prevent:
 DoS attacks
9

10. Main Contribution
● Make closed-box VMs equivalent to dedicated
hardware and software of closed-box platforms
● The TVMM mechanisms allow Terra to partition
the platform into multiple, isolated VMs.
10

11. Revirt:
Enabling intrusion
analysis through virtual-
machine logging and
replay

12. Motivation
 Post-attack analysis
 Understand the attack
 Fix the vulnerability
 Repair any damage
● Current system logger
 Need integrity of the OS being logged
 No sufficient information for non-deterministic events
● Revirt
12

13. Revirt
● Encapsulate target(OS+app) inside VM
● Log below the VM
● Replay executions before, during, after
an intruder compromises the system
● Replay instruction-by-instruction
● Non-deterministic attack or execution
 Time
 External input
● Long-term to several months
13

14. Technical highlight
● UMLinux
 Virtual machine is a user process on host
(OS-on-OS)
 Guest app -> Guest kernel -> Host kernel
 Logging in OS-on-OS is safer
● Logging
 Record all non-deterministic event affecting VM
 PC, number of branches, signals, interrupts, traps
● Replaying
 Prevent new interrupt
14

15. Experience
● 5 workloads
● Virtualization overhead
● Validating correctness
 Add extensive error to alert
● Logging and replaying overhead
 Space & Time
15

16. Main contribution
● Enable a system administrator to replay the
long-term, instruction-by-instruction
execution of a computer system
16

17. Subvirt:
implementing malware
with virtual machines

18. Motivation
● Attacker V.S. Defender
 Control of lower layer system
 To monitor, perturb execution, modify state, etc.
 To avoid detector
● Current rootkit
 No clear advantage over detection system
 Tradeoff between functionality and invisibility
● Virtual Machine Based Rootkit(VMBR)
18

19. VMBR
● Run beneath the OS
hoist the target OS into a virtual machine
● No visible state or event
● Easy to develop malicious services
19

20. Technical highlight
● Loads before target OS/applications
 Use VMM to boot
● 3 kinds of malicious services
 No interact with target
 Observe information about target
 Intentionally perturb execution of target
● Maintain control
 Only lose after power up before VMBR start
 Lose when power off, keep low-power mode
20

21. Experience
● 2 proof-of-concept VMBR
to subvert Windows XP & Linux targets
● 4 example malicious services
 Evaluation
 Disk place
 Time to install VMBR
 Effect on time of booting target
 User view
 Memory space
21

22. Defend VMBR
● Security software below VMBR
 Not go through VMBR layer!!
 Use secure hardware
 Boot from safe medium
 Physically unplug the machine
 Secure VMM
● Security software above VMBR
 CPU overhead cause timing difference
 Extra memory and disk place
 Change in I/O devices
 Imperfect virtualization then
22

23. Main contribution
● A non-traditional malware can gain a clear
advantage over intrusion detection systems
running in a target OS
23

24. Cider:
native Execution of iOS
Apps on Android
24

25. Motivation
● Users who wants to run iOS games are
stuck with the smaller screen sizes.
● Users who prefer larger selection of
hardware are stuck with the poor quality and
selection of Android games.
● Cider: an OS compatibility architecture that
can run apps of different platforms
simultaneously.
25

26. Technical Highlight
● Persona: Distinguish iOS and Linux threads
 Mach-O Loader: supporting XNU syscall interface
and facilitating proper signal delivery.
● Duct Tapes: Translate foreign APIs to
domestic APIs
 Compile-time code adaption layer
● Diplomats: iOS apps using Adroid libraries
 Android ELF loader
 Kernal-level persona management
 Mediates foreign function calls into domestic library
26

27. Experience Results
● PassMark benchmark application
27

28. Main Contribution
● Direct execution of unmodified iOS apps
● Reuse existing libraries
● iOS apps can use Android libraries
28

29. Let’s summarize.
29

30. We think...
● VM has many great features which standard
OS doesn't.
● Making an operating system which has no
host system but all virtual machines.
30

31. Comparison
● Destination
 Terra: secuity
 Revirt: security
 Subvirt: security
 Cider: OS compatibility
● System layer
 Terra: VMM
 Revirt: VMM
 Subvirt: VMM
 Cider: ABI
31

32. Conclusion
● VM is good!
● VM can be applied on
 security
 running/developing cross platforms program
 isolating OS
32

33. Team Work
● We partition the four paper into two part.
● After read our own part, we summarize our
part to each other.
● Discuss the rest part of the report together.
33

34. Q&A??
34

35. THANK YOU!!:D
35