Debunking Blue Pill myth

Posted by virtualization.info Staff   |   Friday, August 11th, 2006   |  

Since months the security and virtualization industry are discussing about a new security threat: the Blue Pill.

Blue Pill is the prototype resulting from a security study made by Joanna Rutkowska, which took advantage of new virtualization capabilities of AMD processors (known as SVM and previously as Pacifica) to inject a rootkit in a running Vista operating system (check the related Black Hat 2006 presentation).

The world press given this work much attention, often reporting misleading informations, because the scenario involved the upcoming Microsoft operating system, and because Ms. Rutkowska claimed a malware using this method is undetectable.

Assuming every reader out there already discovered, by reading follow-up to original post or other security professional analysis, that this method is not exploiting any flaw in the operating system, claim of undetectability stands still.

virtualization.info met Anthony Liguori, Software Engineer at IBM Linux Technology Center and, most of all, one of the men behind the Xen hypervisor, to finally debunk the Blue Pill myth.

virtualization.info: Anthony thank you for accepting to spend some time with virtualization.info and its readers.
First of all would you explain us your exact involvement in Xen project and since how much time you are working on this role?

Anthony Liguori: I’ve been working on the Xen project for approximately 2 years. Like most Xen hackers, I do a little bit of everything. I’m on an extended vacation right now but normally I’m fortunate enough to be a full time Xen hacker.

My primary interest in Xen is desktop virtualization. Recently, I’ve been involved in a number of desktop-related features including graphics virtualization and HVM VNC support. There are a number of interesting features that are in progress that I’m working on too such as HTTP block device support and a high performance graphics component.

In the past, I’ve been involved in Xen’s web services interface and the libvirt API.

I’ll also take this opportunity too to point out that my comments here are my own opinions and do not represent the opinions of IBM or the Xen project :-)

VI: Let’s talk about the Blue Pill announcement: can you explain us in simple terms the scenario considered by the researcher?

AL: Rutkowska claims to have create a 100% undetectable piece of malware.

The basic idea behind her claim is that one could create a piece of malware that also was a Virtual Machine Monitor. If the VMM could take over the host Operating System (imagine if you could launch Xen on a running copy of Windows and instantly have the previous Windows system be a virtual machine), then it could potentially hide a virus from that virtual machine by remaining within the VMM.

Having a VMM take over a host operating system would be very difficult. It’s not outside of the realm of possibility but it would take a huge engineering effort.

However, for this malware to be successful, it would not only need to be able to take over the host Operating System, but it would also need to prevent that operating system from being able to detect that it was now a virtual machine.

While the former is at least possible (albeit tremendously difficult), the later is not possible which means that anti-malware software will always be able to detect this sort of attack.

VI: Where are risks in this scenario?

AL: If a virus cannot be removed or detected, it’s pretty much a worse case scenario for corporate security. Once there was an outbreak, you couldn’t trust any of your systems at all. I’m not sure how one could even mitigate such a threat–perhaps do frequent reinstalls of every system on your network?

It’s really a doomsday scenario which is why it’s gotten so much press.

Malware at the VMM level could potentially install keyloggers, provide remote access to disk, sniff passwords from a VM’s memory, pretty much anything evil thing that can be imagined.

VI: In your blog, Tales of a Code Monkey, you said Blue Pill claims are unfounded and malware is always detectable. Why?

AL: It’s been a fair bit of time since the post you are referring to. Since then, more details have come out about Rutkowska’s prototype. I should mention that this prototype is very detectable.

All it does is turn on SVM, and set up a small piece of memory that is called periodically. It makes no attempt, currently, to hide that memory from the operating system so one could simply search all of physical memory.

However, even if she builds a full VMM with proper memory protection (which is no small task), there would still be a way to detect it.

Hardware virtualization requires a technique know as “trap and emulation”. The idea is that the hardware traps certain instructions and the VMM emulates those instructions in such a way as to make the software believe it is running in a virtual machine.

Software emulation implies that these instructions take much longer to complete when executed under a VMM then on normal hardware. This fact is what can be used to detect the presence of a VMM.

I approached Rutkowska about this and she attempted to address it in her prototype by adjusting one of the processors clocks on every exit. However, there is nothing that she can due about external time sources and she’s admitted to this on her blog.

She refers to this as a theoritical weakness in her system but I assure you that it is quite practical to exploit.

Keep in mind too that this level of sophistication is not even necessary with the current Blue Pill prototype. She would have to get Blue Pill to the point where it was as good of a VMM as Xen or VMware ESX. That’s no small task!

This general approach can be used to detect any VMM–Xen, VMware, Virtual PC, z/OS, etc. In fact, this is a prediction from one of the earliest papers on virtualization (the Popek/Goldberg paper).

VI: Ms. Rutkowska stated several times that Blue Pill doesn’t exploit any bug at operating system level or hardware level. While this is true, do you think there is something vendors could do to prevent these kind of risks?

AL: I know that Thinkpads come with a BIOS setting to enable or disable virtualization technology. In fact, it is disabled by default.

I assume most vendors provide a BIOS setting to enable or disable VT/SVM. If a problem were found, vendors could simply disable the extension until AMD or Intel fixed the problem.

With that said, I strongly doubt this will ever be necessary.

VI: Ms. Rutkowska developed her prototype to work on machines where AMD SVM is available. Could this approach also work with Intel Virtualization Technology? If not why?

AL: Well, if this approach were valid (which it’s not), it would be equally applicable to VT. The two technologies, in their current forms, are almost completely identical except for some minor differences in performance characteristics.

VI: Looking at Ms. Rutkowaska demostration Austin Wilson, Director of the Windows Client Group at Microsoft, said the company will try to prevent such scenario in upcoming Vista operating system. What do you think can really be done at operating system level to mitigate the risk? Is this something also the Linux, BSD and Solaris communities should look at?

AL: I wouldn’t lose a bit of sleep over this particular threat. I don’t feel there is any new risk here at all.

There is some interesting security research on the horizon though and much of it has a huge intersection with virtualization.

A particularly interesting topic is attestation. Briefly, attestation is the ability to validate that the only software running at a moment in time is the software that is supposed to be there.

Currently, anti-malware software has to look specifically for known threats. Attestation lets you do something much stronger. Attestation allows you to validate that there is no unknown threats.

Imagine anti-virus software that doesn’t need to be updated–ever. With attestation, there is no such thing as zero-day threats.

It is somewhat ironic that Rutkwaska choose SVM as the ‘S’ in SVM stands for secure specifically because AMD introduced special processor extensions for dynamic attestation along side the virtualization extensions. Attestation depends heavily on the existence of a TPM chip and I should mention that Xen is, I believe, the first VMM to provide TPM virtualization which ought to enable all sorts of interesting security research to be done in Xen in the future.

Virtualization is particularly important for attestation because it provides a much smaller trusted computing base than a traditional operating system. In reality, virtualization provides a much strongers security platform than a traditional operating system would.

Update: Keith Adams, Virtual Machine Monitor (VMM) Engineeer at VMware, is back on topic from his personal blog. When Blue Pill research has been published he already labelled it as quasi-illiterate gibberish and now he’s reporting:

Well, first of all, SVM and VT make possible nothing that was not already possible before; VMware’s software-only products are an existence proof. The BluePill-istas don’t claim that SVM/VT make new exploits possible per se; rather, the claim is that SVM/VT make it possible to cloak the presence of a VMM rootkit completely.

Allow me to go on record: this claim is pure fantasy. In practice, it is always possible to detect the presence of a VMM, via timing attacks…

Second Update: After almost one year Blue Pill is again a popular topic. And Keith Adams, Virtual Machine Monitor (VMM) Engineer at VMware, slams Joanna Rutkowska claims once again:

…I’ve seen zero evidence that Rutkowska has pondered resource-based detection attempts like this, or indeed, any attacks more sophisticated than a “go-slow” loop between reads of the PIT. It is hard for me to imagine a “hypervisor” worthy of the name that doesn’t leave noticable traces in resource usage. In fact, to the degree that a hypervisor goes to heroic lengths to prevent such a detection technique, e.g., by running a hardware-accurate cache simulator on every guest memory access, it will only open up wider timing discrepancies for the guest’s HV-detector to exploit.

I can only conclude that in 2006 Rutkowska was either naive about the possibilities of such attacks, or that she consciously chose to make an outrageous and indefensible claim (“undetectable malware!!!!”) in order to draw attention to herself and her company. Given the peripheral evidence of Rutkowska’s competence, I think the evidence favors the latter, but I’d simply love to hear from her on the subject…



blog comments powered by Disqus


virtualization.info Newest articles
Release: Splunk App for VMware 3.1

April 17th, 2014

On April 15 Splunk announced the availability of Splunk App for VMware 3.1, the system that is competing with VMware Log Insight solution to provide administrators with a real-time…

Release: Ubuntu 14.04 LTS

April 15th, 2014

Today Canonical announced the new Ubuntu Linux 14.04 LTS with a press release intriguingly focused on its role as an OpenStack platform.
This release, that will be available on…

VMware introduces vCloud Hybrid Service – Disaster Recovery

April 15th, 2014

VMware vCloud Hybrid Service (vCHS) is the VMware’s owned and operated public Infrastructure as a Service (IaaS) platform, launched in 2013 in the US and extended to Europe in February…

Paper: 3D Graphics for Virtual Desktops Smackdown

April 11th, 2014

PQR, a dutch technology company has released a paper titled:"3D Graphics for Virtual Desktops Smackdown". The paper which contains 139 pages is written by virtualization experts, Benny Tritsch, Ruben Spruijt,…

Microsoft releases preview of Microsoft Azure Automation

April 10th, 2014

Microsoft has announced the release of a preview of Azure Automation. Azure Automation provides an orchestration engine for use within Microsoft Azure. Azure Automation allows you to automate the creation,…

Release: Citrix XenClient 5.1

April 10th, 2014

Citrix has released version 5.1 of its client hypervisor XenClient. XenClient consists of two technologies, the XenClient, which is a type-1 client hypervisor running on selected hardware and the XenClient…

Release: Microsoft Virtual Machine Converter 2.0

April 10th, 2014

In October 2012 Microsoft released version 1.0 of its Virtual Machine Converter tool (MVMC) allowing the conversion of VMware based virtual machines (VM’s) to Hyper-V based VM’s and virtual hard…

Paper: What’s New in VMware vSphere 5.5 Networking

April 9th, 2014

VMware vSpere 5.5 was released in September 2013 and introduced a couple of improvements to the networking capabilities of the vSphere platform.
These enhancements could be resumed as follows:

More…

VMware announces Horizon 6, adding Server Based Computing as a solution

April 9th, 2014

VMware today announced the release of version 6 of its end user computing suite: Horizon.
Starting with this version VMware not only provides a Virtual Desktop Infrastructure (VDI) solution based…

VMware elects Paul Sagan in the board of directors

April 8th, 2014

Yesterday VMware announced that David Goulden, CEO of EMC Information Infrastructure and CFO of EMC, has left the board of directors.
Goulden will be replaced by Paul Sagan, former Akamai’s…

VMware announces Q1 vExperts 2014

April 2nd, 2014

VMware vExpert is the program, started in 2009, that “rewards” the individuals who has been recognized as active contributors of the community that rotates around the VMware ecosystem.
The program…

Red Hat releases beta of Enterprise Virtualization version 3.4

April 1st, 2014

Red Hat has released a beta for an upcoming release of Red Hat Enterprise Virtualization (RHEV) platform version 3.4. Red Hat Enterprise Virtualization (RHEV) is Red Hats virtualization platform based…

Release: VMware vCenter Log Insight 2.0-beta

March 27th, 2014

Log Insight is VMware’s product for log aggregation, management and analysis. Introduced in June 2013, Log Insight is kept updated with a fast pace in order to be competitive on…

Release: Citrix XenApp 7.5 and XenDesktop 7.5

March 26th, 2014

In January Citrix announced the upcoming 7.5 version of its Virtual Desktop Infrastructure (VDI) product XenDesktop and desktop and virtualization product XenApp. At that time especially the fact that the…

 
Monthly Archive