Concurrent and consistent virtual machine introspection with hardware transactional memory

Liu, Yutao; Xia, Yubin; Guan, Haibing; Zang, Binyu; Chen, Haibo

doi:10.1109/hpca.2014.6835951

Cited by 40 publications

(15 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It also address the significant challenges of recovery of volatile memory of the virtual machine. Liu et.al [27] proposed an approach called TxIntro that leverage the Hardware Transactional Memory (HTM) for concurrent, consistent and timely introspection of guest operating system by actively monitoring critical kernel data structure of the monitored system. Hizver et.al [18] proposed real-time kernel data structure monitoring (RTKDSM) system of VM that simplifies and automate the analysis of execution state of virtual machine.…”

Section: Related Workmentioning

confidence: 99%

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Kumara

Jaidhar

2015

2015 International Conference on Futuristic Trends on Computational Analysis and Knowledge Management (ABLAZE)

View full text Add to dashboard Cite

Virtual Machines are prime target for adversary to take control by exploiting the identified vulnerability present in it. Due to increasing number of Advanced Persistent Attacks such as malware, rootkit, spyware etc., virtual machine protection is highly challenging task. The key element of Advanced Persistent Threat is rootkit that provides stealthy control of underlining Operating System (kernel). Protecting individual guest operating system by using antivirus and commercial security defense mechanism is cost effective and ineffective for virtualized environment. To solve this problem, Virtual Machine Introspection has emerged as one of the promising approaches to secure the state of the virtual machine. Virtual Machine Introspection inspects the state of multiple virtual machines by operating outside the virtual machine i.e. at hypervisor level. In this work, Virtual Machine Introspection based malicious process detection approach is proposed. It extracts the high level information such as system call details, opened known backdoor ports from introspected memory to identify the spurious process. It triggers an alert in response to detected intrusion.

show abstract

Section: Related Workmentioning

confidence: 99%

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Kumara

Jaidhar

2015

2015 International Conference on Futuristic Trends on Computational Analysis and Knowledge Management (ABLAZE)

View full text Add to dashboard Cite

show abstract

“…Concurrent modifications to data in a read or write set from different threads cause a transaction to abort. The size of the read set, i.e., all memory locations read inside a transaction, appears to be limited by the size of the L3 cache, and the size of the write set, i.e., all memory locations modified inside a transaction, appears to be limited by the size of the L1 cache [32].…”

Section: Applicationmentioning

confidence: 99%

Practical Enclave Malware with Intel SGX

Schwarz

Weiser

Gruss

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Modern CPU architectures offer strong isolation guarantees towards user applications in the form of enclaves. For instance, Intel's threat model for SGX assumes fully trusted enclaves, yet there is an ongoing debate on whether this threat model is realistic. In particular, it is unclear to what extent enclave malware could harm a system. In this work, we practically demonstrate the first enclave malware which fully and stealthily impersonates its host application. Together with poorlydeployed application isolation on personal computers, such malware can not only steal or encrypt documents for extortion, but also act on the user's behalf, e.g., sending phishing emails or mounting denial-of-service attacks. Our SGX-ROP attack uses new TSX-based memory-disclosure primitive and a write-anything-anywhere primitive to construct a codereuse attack from within an enclave which is then inadvertently executed by the host application. With SGX-ROP, we bypass ASLR, stack canaries, and address sanitizer. We demonstrate that instead of protecting users from harm, SGX currently poses a security threat, facilitating so-called super-malware with ready-to-hit exploits. With our results, we seek to demystify the enclave malware threat and lay solid ground for future research on and defense against enclave malware.

show abstract

“…3.4. In more distant security-related research, Liu et al [34] demonstrated the use of Intel TSX to facilitate virtual machine introspection. Guan et al [19] explored the use of TSX to protect cryptographic keys in CPU caches to prevent memory disclosure attacks.…”

Section: Transactional Synchronization Extensionsmentioning

confidence: 99%

“…In terms of usability of Intel TSX, it has been shown in these prior studies [34,19] that enclosing large code regions inside TSX transactions may induce numerous transaction aborts, degrading the performance of their applications and even making it unusable. Our use of Intel TSX avoids such issues by only enclosing a small loop inside the transaction, which significantly reduces the likelihood of transaction aborts due to regular system operations.…”

Section: Transactional Synchronization Extensionsmentioning

confidence: 99%

Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu

Chen

Zhang

Reiter

et al. 2017

Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security

131

127

View full text Add to dashboard Cite

Intel Software Guard Extension (SGX) protects the confidentiality and integrity of an unprivileged program running inside a secure enclave from a privileged attacker who has full control of the entire operating system (OS). Program execution inside this enclave is therefore referred to as shielded. Unfortunately, shielded execution does not protect programs from side-channel attacks by a privileged attacker. For instance, it has been shown that by changing page table entries of memory pages used by shielded execution, a malicious OS kernel could observe memory page accesses from the execution and hence infer a wide range of sensitive information about it. In fact, this page-fault side channel is only an instance of a category of side-channel attacks, here called privileged side-channel attacks, in which privileged attackers frequently preempt the shielded execution to obtain finegrained side-channel observations. In this paper, we present Déjà Vu, a software framework that enables a shielded execution to detect such privileged side-channel attacks. Specifically, we build into shielded execution the ability to check program execution time at the granularity of paths in its control-flow graph. To provide a trustworthy source of time measurement, Déjà Vu implements a novel software reference clock that is protected by Intel Transactional Synchronization Extensions (TSX), a hardware implementation of transactional memory. Evaluations show that Déjà Vu effectively detects side-channel attacks against shielded execution and against the reference clock itself. CCS Concepts •Security and privacy → Information flow control;

show abstract

Concurrent and consistent virtual machine introspection with hardware transactional memory

Cited by 40 publications

References 29 publications

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Virtual machine introspection based spurious process detection in virtualized cloud computing environment

Practical Enclave Malware with Intel SGX

Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu

Contact Info

Product

Resources

About