Non-interactive OS fingerprinting through memory de-duplication technique in virtual machines

Abstract

OS fingerprinting tries to identify the type and version of a system based on gathered information of a target host. It is an essential step for many subsequent penetration attempts and attacks. Traditional OS fingerprinting depends on banner grabbing schemes or network traffic analysis results to identify the system. These interactive procedures can be detected by intrusion detection systems (IDS) or fooled by fake network packets. In this paper, we propose a new OS fingerprinting mechanism in virtual machine hypervisors that adopt the memory de-duplication technique. Specifically, when multiple memory pages with the same contents occupy only one physical page, their reading and writing access delay will demonstrate some special properties. We use the accumulated access delay to the memory pages that are unique to some specific OS images to derive out whether or not our VM instance and the target VM are using the same OS. The experiment results on VMware ESXi hypervisor with both Windows and Ubuntu Linux OS images show the practicability of the attack. We also discuss the mechanisms to defend against such attacks by the hypervisors and VMs.

Cross-Tenant Side-Channel Attacks in PaaS Clouds

“…A small but growing handful of works have explored side channels in settings characteristic of IaaS clouds, to which tenants deploy tasks in the form of virtual machines (VMs). Demonstrated attacks include side channels by which an attacker VM can extract coarse load measurements of a victim VM with which it is co-located [32]; identify pages it shares with a co-located victim VM, allowing it to detect victim VM applications, downloaded files [33] and its operating system (OS) [29]; and even exfiltrate a victim VM's private decryption key [40]. However, only the first of these attacks was demonstrated on a public cloud, with the others being demonstrated in lab settings.…”

Detection of Service Level Agreement (SLA) Violation in Memory Management in Virtual Machines

“…An implementation of the key extraction attack was presented in [23]. The delay caused by separation of deduplicated memory pages in virtual machines has been used to identify guest OS types [13] or derive out memory page contents [24].…”

“…We will access the pages of F1 and F2 regularly to keep them in the main memory. We can estimate the progress of deduplication based on our previous research [13]. When this procedure is finished, we can initiate "writing" operations to the pages.…”

“…For example, many mainframe virtual machine hypervisors such as VMware ESX and ESXi [10], Extended Xen [11], and KSM (Kernel Samepage Merging) [12] of the Linux kernel use the technique of memory deduplication to reduce memory footprint size of virtual machines. Since previous research has shown that page level memory sharing could create a side channel for information leakage [13], [14], [15], many end users ask the hypervisor to disable memory deduplication for their VMs. However, there exists no solution for end users to verify the execution of this agreement other than trusting the words of the cloud provider.…”

Leveraging USB to Establish Host Identity Using Commodity Devices

“…Fingerprinting has become a popular method for device identification, and has been used to identify home electronics [38], websites [39], [40], [41], [42], [43], [44], the operating system of VMs [45], [46], and the source of phone calls [47]. The concept of fingerprinting stems from leveraging measurable signals caused by hardware imperfections in analog circuitry to uniquely identify devices.…”