VIRTUALIZATION CHALLENGES: BLUE PILL, RED PILL, NO PILL
BY: Prachee Ratnaparkhi MSc part II, Roll No.17.
CONTENTS
INTRODUCTION UNDERSTANDING ROOT KITS BLUE PILL RED PILL
INTERRUPT HANDELING
NO PILL SCOOPY DOO
ISSUES
REFERENCES
INTRODUCTION
Incase of virtualization, the main challenge faced
by investigators is detection whether the OS is operating on a VM or real, physical one. ? Joanna Rutkowska, came up with a Code a small program which is termed as Pill three codes that are used and researched are Blue Pill (Malware / hides the presence of VM) Red Pill (helps in detection of VM) No pill (detection without any code)
ROOT KITS
A root kit is a software program designed to provide a user with
administrator access to a computer without being detected.
Considered as one of the most serious types of malware since they may be used to gain unauthorized access to remote systems and perform malicious operations.
The name "root kit" includes the word "root," because the goal of a
root kit is to gain root access to a computer.
By logging in as the root user of a system, a hacker can perform
nearly any operation he or she wishes. This includes installing software and deleting files. The word "kit" refers to the software files that make up the root kit. These may include utilities, scripts, libraries, and other files.
BLUE PILL
is a malware, a root kit
Gives rise to a virtual platform, on which the
OS would run. OS is not aware of the fact that it is running on a virtual platform. It is able to scan to entire state of your machine, and allows the user (hacker) to have full privilege over the machine.
Its uses virtualization techniques of CPU, and
executes as hypervisor. It creates a VMM, takes over the host OS, & remains undetected within the VMM. Issues related to blue pill: 1. Having a VMM take over a host OS would be very difficult. 2. The malware would have to prevent the OS from being able to detect that it was now a VM.
RED PILL
Is not a malware, totally opposite in than that
of Blue Pill. it helps to detect whether the OS is running on a real, physical machine or a VM. Mainly, a red pill helps to detect the presence of an hypervisor on a real machine. Normal environment (on a real machine), we have only one OS, but in case of a Virtualized environment(VM), we have two OS running, one is your guest OS & the host OS.
There is only one interrupt descriptor
table(IDT) register, but we have two OSes running simultaneously, so now the VMM relocates these registers to the guest OS, to avoid conflicts with the host OS. A single-machine language instruction store interrupt descriptor table (SIDT) is run in user mode that takes the location of the interrupt descriptor table register (IDTR) and stores it in memory. Rutkowska, conducted a study, where in, they used two separate software's to create virtual environments, (VMware & Virtual PC),
Finding & Conclusions:
the address of the relocated IDT was at
0ffXXXXXX, and in case of Virtual PC it was 0e8XXXXXX.
Lets us now understand what is Interrupt handling Interrupt descriptor table (IDT) Global descriptor table (GDT)
Certain important basics , based on which the red pill and no pill actually are designed and work
Store interrupt descriptor table(SIDT)
WHAT ARE INTERRUPTS ???....
An interrupt is a signal from a device attached to a
computer or from a program within the computer that causes the main program that operates the computer/OS to stop and figure out what to do next. Almost all personal (or larger) computers today are interrupt-driven - that is, they start down the list of computer instructions in one program (perhaps an application such as a word processor) and keep running the instructions until either (A) they can't go any further or (B) an interrupt signal is sensed. After the interrupt signal is sensed, the computer either resumes running the program it was running or begins running another program.
TYPES OF INTERRUPTS
In general, there are hardware interrupts and software
interrupts. A hardware interrupt occurs, for example, when an I/O operation is completed such as reading some data into the computer from a drive. A software interrupt occurs when an application program terminates or requests certain services from the operating system. In a personal computer. An operating system usually has some code that is called an interrupt handler . The interrupt handler prioritizes the interrupts and saves them in a queue if more than one is waiting to be handled. The operating system has another little program, sometimes called a scheduler , that figures out which program to give control to next.
FETCH-EXECUTE CYCLE:
INTERRUPT DESCRIPTOR TABLE (IDT)
Gives us the address all different interrupt handlers Specific handler is required for each type of an
interrupt IDT simply stores the addresses of each handler, these are a part of the kernel and are mapped into kernel space memory An IDT consist of a list of such handlers and these are then mapped both in kernel as well as user memory. On Intel systems, IDT provides special instructions and data structures which are managed by CPU itself, so that interrupt handling can be done faster. IDT is a reserved block of RAM used by CPU to jump quickly to a specific interrupt handler
INTERRUPT HANDLERS
Interrupts are handled at two levels by kernels:
FAST & SLOW Fast Interrupt Handler (FIH) is the code which is directly invoked from the IDT whenever an interrupt occurs so that the interrupt handling is done quickly these handlers work in real time. certain interrupts get into the task queue of the OS, these are the ones which require large amount of data to be fetched form the device, such interrupts are solved by the Slow Interrupt Handlers (SIH) Slow: not called upon immediately & at lower priority. executes whenever CPU is not executing real time interrupt (i.e. FIH)
TERMINOLOGY :
SIDT:
Store Interrupt Descriptor Table, stores the contents of an IDT in destination operand. Destination operand specifies a 6-byte memory. GDT: Global Descriptor table, has information which is at a disposal to all processes or programs equally, thus Global. it defines characteristics of various memory areas used during program execution, memory areas are termed as segments.
LDT:
Local Descriptor Table, contains memory areas/segments specific to a program unlike your GDT.
KERNEL:
Dictionary meaning of kernel is core or an essential part of something In OS terms, kernel is the core of the OS, it has control over every little thing Primary purpose of a kernel is to manage system resources and provide an interface, so that other programs can access these resources.
NO PILL
No Pill literally means, No Code. in No Pill, the SIDT of the red pill is replaced with
SGDT. As per Ferrie (2007) research, a VMware makes use of the local descriptor table (LDT), which is not otherwise used by Windows, so he found a simple detection method for VMware to check for a nonzero LDT base on Windows OSes. Ferrie also found that the red pill and no pill methods for detecting VMware are unreliable on machines with multiple CPUs. Scoopy Doo - VMware Fingerprint Suite ,his tool is already outdated and replaced by Scoopy NG.
SCOOPY DOO
SCOOPY DOO
Tobias Klein wrote the Scoopy suite that looks at the location of
the IDT (like theRed Pill), the GDT, and the LDT. Klein observed that host operating systems have an IDT located at memory location 0xc0XXXXXX (which is consistent with the Red Pill, in that it is lower than 0xd0XXXXXX). Scoopy checks to see of the IDT is located at an address that starts with 0xc0. If it does, Scoopy prints a message indicating that it is running in a host machine. Otherwise, it prints that it is in a guest operating system. Klein uses identical logic to compare the GDTs location with 0xc0XXXXXX to get a second opinion on the matter. Finally, Klein observed that the LDT on a host machine is typically at location 0x0000. On guests, it has some other value. With three different tests for virtual machines, Scoopy has quite
ISSUES
In 2009, Charette posted How not to detect
virtualization in which he conducted testing in how to detect virtualization from within a usermode application, based on the red pill and no pill theories with the following specifications: Takes place within a user-mode application Must work from within Linux (specifically, Ubuntu 9.10) Must work with all of the popular consumer virtualization products (VMware Player, VirtualBox, and so on)
Here are his findings: Using these methods, two things have happened that render
this test useless:
1. Virtualization products have got better at doing what they do.
2. The data returned by the CPU instruction is actually a per-
CPU . This means that even in non virtualized environments, if you have multiple cores or CPUs, this test now returns false-
positives. For example, on a quad-core system running natively,
and assuming even distribution across all cores, 75% of the time this test will tell you it is running in a virtual environment.
REFERENCES:
1.
Virtualization & Forensics: A digital forensics investigators guide to virtual environments, by Diane Barrtee, Gregory Kipper, Chp.9 Virtualization Challenges.
2.
3. 4. 5. 6. 7. 8.
[Link] 27.09.2013
[Link] [Link] [Link] [Link] Lecture by Asst,Prof. [Link] Murphy, Coastal Carolina University. [Link] [Link]
9.
10. 11.
[Link]
[Link] [Link]
12.
[Link]