Hypervisor introspection: a technique for evading passive virtual machine monitoring

Virtualization technology has enabled powerful security monitoring techniques, such as virtual machine introspection (VMI). These monitoring techniques, however, rely on the assumed isolation of virtualized environments from the hypervisor. We show that there are still some events that can be observed that break this isolation. External observers can discern when virtual machines are suspended due to hypervisor activity, and can use this information to mount advanced attacks that go undetected by VMI monitoring systems. We demonstrate some example attacks against realistic monitors using our technique, and discuss existing and potential defenses against these kinds of attacks.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2015

Author dc:creator

• Wang, Gary L

• security
• virtual machine introspection (VMI)
• side-channel
• cloud

Statement dc:rights

• Copyright 2015 Gary Wang

Language dc:language

en

Handle dc:identifier

http://hdl.handle.net/2142/78671

OAI identifier oai:identifier

oai:www.ideals.illinois.edu:2142/78671