Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/180 Thanks!
I have a one
thank you all for coming here at
this late hour
of the day.
My name is Goldie Skin and as
was said, I will be presenting about
virtualization security.
The purpose of my talk is to
introduce to you the low level mechanisms
that are related to the infrastructure
that makes the virtualization secure and
basically allows us to use a
virtualization virtualization security.
So am I. Why am I talking to you about
this?
The key point that is related to
virtualization here is that they used to
work for eight years for Intel doing
a lot of the infrastructure work and
virtualization security.
OK, so let's move on.
I want first to give a few thanks.
I want to thank my wife, Taylor,
who has been there taking good care of me
while I'm doing research.
I want to take everyone at Sevilla and
especially the people that review the
talk for me and
all the security people that Intel agreed
to all.
You know, it is from the other side now.
OK.
So what am I going to talk about
today? I'm going to talk about how
digital assisted virtualization.
I'm going to talk about the software
stacks and different virtualization
approaches and weaknesses
of each approach.
I'm going to talk about the complexity of
memory management and the related
weaknesses that this affects on
virtualization.
And finally, I'm going to talk about the
computer platform and the way it does
lead to certain weaknesses in
the implementation of the
virtualization platforms.
And there's a special bonus they might
show. I will show a small potential
VM escape that might work
and might
not know them or silly
kind of walk down my computer when I try
to do it
anyways.
So what
is virtualization in the context of this?
Virtualization is replacing the real hard
world that you have the CPU and the
computer platform with a virtual
environment.
Historically, we can trace
the roots of virtualization even to
Alan Turing and the universal Turing
machine concept, which was basically a
machine that could emulate any adult
machine.
After that, it's the
late 70s Beck and Goldberg
came came up with the
virtualization requirements
for computer architectures
anyways.
So that's that's always thoughtful and a
bit of terminology that's just so
all speaking the same language,
a machine manager or VM is the stuff
to virtualizing privileged instructions
and the audio.
Basically, this is the core of the
virtualization system.
A virtual machine is the software stack
running on television.
VM in a
guest operating system is the operating
system of the virtual machine,
and the operating system is the operating
system that is controlling the VM,
and the operation is when you execute
within the VM.
So first question we need to ask
yourself if this guy is talking to us
about secure virtualization, but
there are many definitions of secure.
So what is secure virtualization?
So the security goes
that way. We need to define what
allows our security guys and when
we want to secure a secure virtualization
platform.
So first, the first goal is preventing
modification of the operating system
by guests. This makes sense and
naturally, also the VM has
to be in order for this to live and work.
You need to prevent one guest from
changing another guest, right?
If I have two virtual machines, I don't
want one to attach the either or vice
versa.
You need to prevent the guest out, well,
the virtual machine from actually
subverting the
the
actual film of the system.
You need to prevent the guests on
stealing data from either guests or from
the host operating system or from.
And then you need to prevent
denial of service.
Vegas, though, is all getting on Phil
lovely Celsius relative to other guests,
and you need to give the guest to a
secure way.
You don't want to downgrade this to their
normal security mechanisms of
the guest operating system.
Now, this may not be equal in every
platform. For example, MySQL
virtualization usually gives access
to the guests directly to the hardware,
which is a very bad idea in security
terms. But this is what they do because
they want their virtualization
capabilities for money, building
other
virtualization engines of useful
instrumentation, and they again don't
care about security.
But if you care about security, you
shouldn't give access to the album, and
we'll hear a lot about this later.
So moving on to the first section of
this talk, I'm going to talk about the
defense of. Stocks, though, different
ways to use virtualization capabilities.
So first one we have here is
the type one hypervisor
also call the Bell MetLife vasL.
It's important to note that this is sort
of a simplified view, but it still
it represents most of the way the system
works. So what we have here is
first off, we have the processes
the processes each executes in a
different guest operating system.
The guest operating system is executing
above a
virtual machine and only thulo a
hypervisor, and this one is executing
directly above the audio and between
each one with different interfaces.
So as you all know, between processes and
the operating system, you have system
call interface and the interface
between the guest operating systems and
the whether they are well, that's the
reason interface or not is the
event exits and vehemently is
a VM exit is the transition from the
VM, from the guest to the
VM to the route execution mode.
And the VM entry is the opposite
transition from the execution mode to the
guest.
Now, the one of the key
points here is that the build method I
feel Viso has to virtualized every
access to the Alphaville, so basically it
is emulating all the Alphaville
accesses, and
this means that it needs.
This creates a very large attack surface
on the actual virtualization
implementation.
Next up, we have the type two hypervisor,
so type two, I believe ISOs.
Basically, I fill vessels that are
executing inside the operating system.
If Typekit type one is things like the
only a six, if you are familiar with the
wild type two is things
like VMware
Player, which executes in the
same manner similar to a program.
And we have a guest of
the processes, the guest operating system
executing above the VM that is inside
the office.
Now the interesting thing here is that
the this type of virtualization
engine is actually using the
drivers of the operating system to
interface with the audio, which means
that the request, for example, to draw
on the screen from the guest operating
system or to access the graphics card
pursued the VM to the host operating
system, which makes this which
creates a different attack.
Surface of the actual communication.
Some sort of some of the in some cases
these are actually use what's called
of virtualized drivers, which are drivers
that are aware that they are running into
virtualization environment and are
calling directly to the OS,
which
naturally creates a whole
new attack surface
to quite.
I stayed with me.
Good, good.
Let's see which Fulghum is this
one the one I'm pointing at?
Come on.
One guy I who said
this.
Well done.
OK, now you always me.
Let's go. Let's move on.
OK, so
as I mentioned, a lot of challenges when
you want to emulate the diet or the
inspections that the architecture
and the venom needs to emulate every
instructional event that it registers on.
So the
FEMA must register to certain events.
It's not the same in every virtualization
architecture, but I'm talking about the
Intel architecture.
That's what I know is, as I told you
earlier and in interactive
texture there, the things that I'll call
the fix. The one exits events that
the VMS has to exit on.
It has no choice about this.
In addition to this, in any case that you
have other additional events that
you want to actually visualize,
then you need to exit on those as well.
So there are lots of challenges when
you come to actually emulate the ISA.
First off, you get the problem
that you need to know the exact
specification as any of you open
the the
stuff to.
Well done, guys.
Just for paying attention.
It was one.
Anyways, the interest there
is like seven eight thousand
pages they think now.
And while the instructions are still
fairly documented in the one place
architectural invents sets into
lots of other events
documented that you have to read the
entire manual to actually know how they
work. And even then, it's uncertain
that you will get the actual description.
So specification is not very simple, and
then turning the corner cases is
very hard,
deciding if the guess there is
the right privilege from a lot of places
and is also fairly complex.
And this leads us to the situations
which I'll call the confused deputy.
Well, you actually have multiple mission
in the vote operation.
Then the guest would have had if you did
it normally and you do an action on
behalf of the guest, that is to
do much. And that's the reason for
this guy over the top there.
That is definitely a confused
deputy.
OK, so what's
next?
Often when we talk about software stacks,
one part of the self-heal stack that we
didn't discuss yet was the
system management Model S admin
system management mode actually runs in
parallel to the other
operating modes in the machine.
So that means that while you're executing
at any given moment or ideally all
intrinsically the zero or
in the virtual machine monitor itself,
an SMI interlocked
which is the the interrupted
causes transition to the system
management mode could happen, and
this creates an attack surface.
For example, the same cache poisoning
attacks that will allow
about seven eight years back.
Well, basically this type of attacks
that in particular within the guest
operating system could do to infect
the smell.
Now the interesting thing about this,
Amum, is that while the
estimate as unlimited access
to everything on the right hand side
or left hand side from your
point of view, wherever
the
the virtual machine monitor or any
code that is executing on the other side
can't access code that is executing in
this amp.
So basically, if you in fact that simple,
you can infect anything until
now, what you should be asking
me is if this is such a big
problem, why isn't there a way to
visualize this simple
right?
Should this should be a way to visualize
this event?
So the answer is there is a way to
visualize this amount.
It is called an transfer money monitor
or dual monitor or parallel monitor
or whatever you want to call it, monitor.
And basically,
it is meant to be used to virtualized
the system management mode.
Unfortunately, as any of you heard about
it in use in practice,
I can tell you that I know of one
little government agency that is using
it,
and
no other organization that I've heard
of is actually using
a small SDM.
The interesting one other interesting
quick about this time is that the
people that are actually meant to
implement the system,
the the transfer money through
this part, the virtualization for
some of the hardware
vendors, the Dell.
Ms. Dell and Samsung and
whoever will be on Sunday and whoever
builds your computer, not the
not the world that is making the women
and there and so it creates a whole
new complexity because they need to
decide on the interface the system is
docking with the VM and vice versa.
So this is a very complex
architecture that doesn't really work and
this is just not virtualized.
And we all hope that nobody has a way to
hack into us and them.
Otherwise, virtualization security
is gone.
OK, one last point and this
section is there.
The micro VMS Michael is
something that is becoming more and more
popular recently.
And the interesting thing about Michael
VMs is that what they
do is they sit underneath
the operating system and they
allow the guest.
They allow the guest operating system to
communicate directly with the well,
what's the redlines?
Was? Well, at the same time, they are
capturing certain and minimized set
of events that they have to,
which are the green lines.
Now, Michael Venom's, they'll use it for
various tasks, but the most
common one is security.
One strong example for this would
be the McAfee Deep Safe and McAfee
Intel Corporation that is actually
used to T2
security protections until
rootkit. And this type of stuff
on the CPU problem is,
if you actually get to one inside
the guest kernel mode, once
you can access the outwell, you can
fairly easily subvert
the VMA and will get to why?
Why this is a bit later.
But this is the general idea.
So just to summarize this section,
there are many ways to resolve the
virtualization technology.
Type one, Type two Michael Vietnams
You could follow virtualized or not power
virtualized each approach
as its own unique challenges.
If you do a full out of the transition,
you need to secure a big implementation
of software emulation for all
the that you'll emulating.
If you are doing thorough virtualization,
you need this. You created an interface
between the guest operating system and
the operating system, so you need to
secure it if you
read it. Regardless which implementation
you picked, you need to emulate
the ISO correctly, which is a dick and
securely, which means no confuse
deputy type of situations.
And finally, when you create
a micro VM, you have to defend
from models of the vision without
going into full out emulation,
which is really a problem.
And finally, as members do many
privileges and there are no SD
Ms.
OK, so moving on, we
are going to talk about memory
and
everybody in this room or most
of our guests and know what our computer
memory works.
You have an address value.
It's a very, very simple light.
I got one address x
value y.
This is the diagram that describes the
the first diagram in the entire manual
that describes how memory works.
This is less user friendly, I think.
So what this diagram actually says?
Let me show you a few highlights.
First off, we have the Dell
called Quantum, which is top of memory or
the size of the deal.
And then if we just
look around, do you get the April-May,
which you don't know what it is, but it
is a stolen range used for the chips that
the information and journal
goes as chips that the
memory chips that fill
a memory silly.
I had a problem that anyways.
And then you get the
all different areas like the
always visible range that is over
64 gigabytes.
You get this interesting thing.
This line, obviously, anybody knows
what this legion is.
This is the claim legion, the region
that is rumored.
If you remember back when you walked on
the Intel database.
You had a limited amount of memory
that if you bought Molly, you didn't
actually get much of a memory for your
CPU.
The reason for this is this claim this
range that cannot be accessed by a normal
operating system.
Maybe I should explain this a bit better
because I skipped the one part of the
explanation left inside represents
our discipline is the physical memory
on the right hand side of a hill.
What you see is the way the
delinquent, what the actual values that
are stored in your DRAM chip.
So what happens is
that memory that is accessed
at this address is actually stored on
the deal at a different
address
causing.
Station, this translation was used when
it was not locked to break
virtualization systems because you're
just the guest remembers
some of its memory.
Two points to memory that the VM is
actually residing in and then over
to the VM. Call it the data.
And that's why the exploit that the VML.
So nowadays there is a lock register that
is supposed to be used to prevent
changing this after this is configured,
assuming it is actually locked.
I suggest everybody reveals the
bias and check.
Oh,
OK.
So and finally, you get some really,
really weird ranges.
If there's anybody in this room that
is able to come on stage and say,
what type is
then my guest, I
really
want to hear because
there are lots of secret trenches and
undocumented dangers.
And this one I found only one intel
manual or tool, and somebody
has to tell me
anyways.
So moving on,
a dozen installations are actually even
more complex than there we discussed
so far because what do we get
is we get actually
there at least
three different translations in
a healthy virtualization
system and this translation.
So first, the paging translation
page servers, which take a
certain Edlis and convert it to a
different edits.
Then we get the interest
came up and said, Oh, Beijing is great,
let's do extended page stable, which is
basically another level of paging
because that's great, right?
We like it. So.
Mm hmm.
So we do again at Beijing translation.
And then if we're unlucky, we fall on
a certain special regional decline
region and other
memory access is actually redirected to
somewhere else.
So basically, memory
is not simple.
And this is even before I started talking
about cache and how such
as in the case of being made before you
actually access the dealer
like
the extended page developer, I say
another word about it.
It's actually a very useful feature of
the extended page. David is a feature
that allows the virtualization
environment to
virtualized the the accesses
that the guest operating system.
Susan's already reached the physical
memory, which means that when the guest
operating system sinks that it's done,
the virtual machine monitor can
actually make a decision if this access
is right for it or not.
Or, well, is it going well?
Does it once the access to go to?
So it's a very useful feature when you
want to secure something, but it's very,
very it adds a lot of complexity to the
system, as you can see on the screen,
which is kind of scary.
So when you actually
want to make a memory
access, the what
actually happens, there are several
types of memory accesses.
So the Green Line in this diagram
represents an excess that is made from
the CPU directly to the
dilemma of the
dual them chip, right?
And this is the simple one
what happens when you have the filter
line, when the CPU, the X
is a device?
This is what's called memory methyl
or the security situation.
Will you have a range
of addresses in memory and
will get to it in the next slide a bit
more?
That is actually not used as
part of the deal.
It is redirected to
one of your other devices, whether it's
an integrated device like the PC
or something inside the PC or the CPU,
or an external device like your wireless
LAN card, for example, or whatever
else.
And finally,
a device might make a memory access,
and this is the yellow line and this is
what's called the direct memory access
dmay.
And what's also interesting to
note is that since some devices
are nowadays integrated in the CPU
and the CPU as a way to directly connect
to it,
the
PCI devices, this is called
persistently nice graphics OPG
and then
actually requests from devices could
come along the big blue line instead
of along the Big Red Line.
And in either case,
and in all of these accesses must be
monitored. Do not actually allow
a guest to access either
reconfigure
hardware or
overwrite the if anything,
that is critical for the VMS security,
whether it's called thato structures
that the film is relying
on.
OK, so
the green highlighted areas
of the MMI your memory
map to your regions.
So basically in this diagram you get to
which is good because this is not
to.
But the ceiling looks like this.
Everything that is N.M.
should be if it's below four gigabytes,
so it should be the last range before
four gigabytes memory a boundary
or if it's 64 gigabytes, it should
be the top of memory.
This is the theory that Intel wants you
to follow AMD the
and I'm assuming that as something
similar,
but
the reality is different.
The reality is that you
can configure
a MMI
MMO wenches are configured based on the
registers at the base of the
registers when you can.
Once you configure the base of the
register of any device,
you can put any value in there and
you can just decide to configure it.
For example, right, you
disagreed. Disagree that SIM resides
right on the for, let's say, on
the first megabyte of the memory of your
machine to drive crazy or both.
You can configure it
anywhere you like, basically.
And this gives gives you an
opening to create some interesting
attacks. If you have access
to reconfigure the bell
register because you can just make
it overlap anything you like and
that let's say I send the
let's say my memory map television
is actually representing the last Typekit
my eta on. It's called the saved right.
So I know the value is there because I'm
I don't know pinging it, though sending
packets to it right?
And at the same time, I may I change
the the place.
It is the base of this register to
make it overlap the code form.
I don't know what the VM and
the code of my hypervisor.
So at this moment, it
will run from the code that is actually
the last packets that arrive to the
to the to to the
Ethernet guard
who understood me because they are too
quiet.
OK. So we can move on
little
those that didn't ask the guy instead
next to you after the talk?
OK.
So in
addition to having the memo and
reptile, we have special
guest Lynch's special
address, Sanchez arranges that have
the special functionality
in the computer.
For example, you have the under the
legacy. Those areas some
light the low memory addresses,
which each of which has a special
function.
You have the main memory address
as described in each of
each of it, and it is broken to different
regions that also have special functions
and so on and so forth.
I really don't want to get into this
because this could be a whole
talk on its own.
But the general idea is you don't want to
give anyone access to these regions
because one has access to this large and
they can reconfigure little hardware and
just some virtual machine
under you.
And finally, we could have
talk about cache, as I mentioned, the
same cache poisoning attacks.
We can't really talk about the
I can't really find the time to talk
about this and finish this talk in any
reasonable way.
I actually go to the original version
with a discussion about cache, and it
took like 15 slides and then I said
of them.
So the bottom line, I'll
just give you the short overview of
this of these 15 slides.
Kiss is optimized for performance.
Performance doesn't work
well, play well with security.
You optimized for performance.
You don't optimize for security.
The end.
Thanks.
OK, so anyways, just to summarize,
this section nonetheless is complex,
I think we can all agree on this now.
Attackers with access to them and my
physical memory that says
can compromise basically anything on the
system at the
access to special address lenses is also
dangerous because it gives the attacker
the potential to subvert your hard work
by misconfigured and get
if it can help mitigate some of these
problems. If you can configure it
correctly and if it is available on
your platform, which is
a
problem because if it is only available
on high end well and not on low
end well, so you have to buy
the more expensive CPUs if you want this
protection, which kind of makes sense on
the Intel side. But
yeah, OK.
So next off, I'm going to
talk about the insides
of computer platforms and how these
affect the security.
Yeah, and just way too, I thought before
I do.
OK, so
the
what is a computer?
We talked about the it's a very complex
device internally.
We already talked about the fact that the
logical software architecture can be
complex.
But the other thing that we should note
is that the
every
modern computer is a very high speed,
complex network of interconnecting
components. It's speaking in different
protocols, using many busses
on many types of networks and
passing data at an extremely
high speed.
So this diagram
represents a CPO
more or less.
How does it work? Basically, you have the
big blue box on
the outside, which is the the CPU
CPU is actually broken into,
let's say, two close, right?
Got one call
to
each of these calls is again broken
into two hyper slides.
One I posted two episodes, so basically
you get four logical
processors within one Scipio
package.
In addition, each call, as some shared
the area and some stuff.
For example, shared registers showed
Cachalia that is shared between both
sides, both sides of this same call.
And finally, there is a
line.
There is another part that is called the
ankle.
Anyone cares to hazard a guess.
What's the definition of Uncle
Goldman?
Exactly everything that is not
cool, right?
OK.
So everything that is not cool is
the ankle. And what does this mean?
Actually, for us, it means the integrated
devices, which include in emergency
Incipio Generations, the integrated
graphics. They include the special
device that actually is several special
devices that represent the CPU.
And they include all
sorts of things, other things
like power management and things like
this. Then we get to the memory
management unit or memory control
hub that we so when we talked about
memory, which communicates with the
RAM
and another component that we
have is the persistently nice graphics
that they mentioned, which allows PC
devices to be connected directly
to the CPU without going through the
chipset. Which is a great idea
because now everything that is done
on every day to protect in the chipset
needs to be done also in the CPU.
So the and the
interesting thing is it's persistently
enhanced graphics.
So you would think that only graphics
cards could be connected there.
But no, you can connect to any
PC device you like.
It's not like anybody's in full thing
that it will be a graphics
card.
And finally, you'll get the demo bus,
which is actually connecting us to the
next component main component of the
x86 x64.
The modern CPU computer architecture.
So who knows?
What's the other major component?
What's his name?
Come on.
No, you are wrong,
sir.
But you are in the right direction.
Anybody else?
That's right, man.
OK, so the platform
control hub is
what replaced the southbridge.
And
we used to have the platform was it used
to be broken into three main chips where
we used to have the CPU, the nosebleeds
and the southbridge.
And it was a line that connecting between
them. But actually, the way it
is now is that the nose spillage was
broken into two.
Half of it was merged with this
assemblage and created the.
Platform controllable PCH
and the other half was merged into the
ankle in the CPU and became
the power to some of the integrated
devices of the CPU.
So the PCH is actually fairly
complex internally and this diagram
doesn't do it justice.
But what can I do?
I can talk all day about the
architecture.
So what we have here, the PCH
is made so many internal devices, such
as the
LAN card, for example, the integrated
LAN is in the PCH,
many bridges, many foam
and chips that power management
to
tell
my code and various other
things.
And in addition, the
PCH has several bridges, so
one bridge is connecting all the PCI
e devices to the
to the PC. So the PCH
and another bridge or
other several other bridges are
connecting to different, different
legacy devices in this that
on my own little one, but actually the
civil one for, for example, for the
LPC four bus, one
from the spy bus that contains
the embedded controller in
laptops, one for the
AM, I don't know various
other the low speed busses
that you can think of.
So and basically
when
you talk about the visualizing
the Howard, well, you talk about actually
utilizing all these devices,
you need to actually create an emulation
of these devices.
Folio locks all platform, some
with some of these devices the your
keyboard, the little mouse.
So layer the USB,
everything goes to the PCH.
Basically everything the talks to do,
dual CPU
and naturally, device virtualization
is very simple.
We can just use Khemu Zen
and the KVM use using modified
A for deals in its and there are
no no vulnerabilities in cumulate.
Yeah, so that was my quick
certain vulnerabilities in Kumu.
OK.
So to solve the problem of actually,
how do we give access, so protect
situations where there is access to
to the work by a guest?
What we want to do is we want to have the
ability to virtualized the world well in
a similar manner that to to
the way we virtualized software.
And for this, we have defeated the all
future zation technology for directed
IO, which is
also IO in the
middle,
and it is useful visualizing the chipset
components.
So there are two main
features for this technology.
One is the amazing mapping and the others
interrupt the mapping.
So the mapping, as the name
implies, is basically
allowing you to perform page
Beijing.
The map excesses DMCC says,
from devices to the dilemma
to different addresses.
And this is done by a paging mechanism
because Intel loves Beijing.
We already had regular paging APTN
and now we have visited
Beijing, right?
And because Beijing is great,
then they created the nested translation
concept, which is the dragon on the
top right of a, which allows you to
perform one two three four five
six seven times
full translations to get
the single address.
Oh!
If you can configure this, call me, I
need your help.
OK.
Anyways, in Typekit, mapping
is a really, really nice feature
which allows you to remap the way
interrupter delivered to guests
and to the VM.
And this is also a very important feature
because the actual
real world attacks that did this
and the very nice people
and this is the following the white
rabbit by John Politkovskaya's
and they are fallible chuck.
And
the interesting thing about interrupting
mapping is that even in the last the
latest generation of interceptors,
there is a one on the last day in
interactive mapping, which means that
you can deal with the machine or shut
it down. If you have access to a generate
interrupt there and certain
configuration conditions exist.
This is a work by a person called Gabor
Tech, and I recommend reading it
for those interested in the low level
details.
And finally, what they do
with the old systems?
Well, you don't have to deal what they do
in systems, the weather you have today,
but it's an older generation even on
the Illinois. Suppose you still don't
have a fix for the Gabor piccata,
so it is not very simple.
It's a spec that is still going and
hopefully it will be stable.
One day, I
suspect this is a several L.Z.
of us still.
So just to summarize this section,
computer platforms are complex,
and they're emulating the necessary
components is out.
There are multiple surveys already found
in CV end. The pick virtualization as
well as Cuomo, actually didn't get
into API and the pick.
But you can find it in my backup
materials
and this will be uploaded and vetted.
The ALP's virtualizing the DMARD
will and and download and
drafts if it is useful, actually.
OK, so
we'll go getting to the last part of the
stock, we're going to talk a bit about
the different attack vectors, things that
they didn't get to talk about so far.
And then I'm going to get to the
actual there and suggested
the VM escape.
So
just the first of the most basic
work, though, we can talk about this, the
ISO implementation, we talked about it
emulating all the specification or even
part of the x86 specification
is not easy.
Next off, another classic one would
be performance monitoring.
There are lots of performance monitoring
controls, and we can use them to
basically trace the way that the
Fulghum executes within the VM
and try to figure out or
hack it this way.
A real time instruction placing is a new
feature that is coming up and might be
very, very interesting in this context.
Then we get to the problem of what do you
do when your system is old and
your defenses keep being introduced
with the latest? And well, if you can
identify that the actual how
you're going and going and there is a
very nice way to talk
about different red
people, not talk about different
red fields and how to automatically
generate red filters that allow you to
identify the specific cloud really
aligning one.
Then you can identify the
fact that you are on an old system and
use a bug that maybe is fixed on the
newest versions, but it just not
fixed and they're all valuable and you
can fix it in the cloud.
That's the whole point of order.
And then you get the new features.
What do you do when a whole new
CPO feature is introduced like outdated
that I mentioned earlier, and it has some
new register that is a buffer that writes
that bit of physical memory, then
you need to actually visualize it, right?
But they feel the virtualization engine
there didn't support it, and
now it is installed on and you're
allowed. Well, then it doesn't know
that it's the virtualization.
And then either it doesn't give access to
any new feature, which is a blacklist
approach that kind of kills all the new
features in your sleep.
You just can't get access to them all.
It gives access to every feature and then
it takes the risk that it is infected.
Usually,
Bayonetta little visors don't give access
to any feature, so you get something
like, for example, Vimal Player.
And as far as I can tell,
the default in general, the A6 emulates
a full 40 v x
chip anybody knows from.
Which is this
maybe close
enough? 97.
So you get kind of the
old systems.
OK, so another
interesting thing is the Io address base
that all of the space is used to actually
configure the the
PCI devices and to
directly communicate with them.
You can write directly to disk if you
just try to set it to the
iOS Matterport there
and various other things.
So anybody knows how many iReports
in x86.
Well, said, 64K.
You're wrong,
and I don't
know
you along as well, 64k was closer
to Mr. By how much
anybody
know, 60 plus three.
Now, any idea why is it +3?
Because the whites of it, when you
access iReports,
you can access one bytes
wallet, which is still bytes or full
bytes, right?
And you can have is that baseball
60 func values so it can start
from zero two six five five five.
But if you access a full
byte at six five five five, then
you get three filter unknown
parts that are beyond six five five
five and you actually have
60 4K plus, which
is kind of weird.
Yeah, I'm disappointed in you guys, I
expected someone to know this.
Anyways.
So the other
the other interesting thing is that you
can actually overlap, but what
happens if you overlap up the keyboard
both, which is actually configurable in
some conditions with the
IO configuration, both which
is CFA when you overlap
the Satar, well, both
with some of these boats,
you get
a problem in decoding that nobody
knows how to actually answer some
of the some things that are decoded.
Some are not. So this is an interesting
case. We already talked about overlapping
and then they all went just in all
different ways.
There are special memory arrangements.
We also talked about there and
what happens when you overlap?
A special memo that ends with an
MMI over Angel can get
mixed stuff together.
It's fun.
And finally, you get to the model
specific registers, which we didn't get
to talk about, but an
interesting thing in and of themselves
that they are actually the configuration
registers of the CPU.
They comprise the all sort
of address space.
But the interesting thing is certain
configuration registers don't actually
deal with configuration, so the missiles
actually trigger actions
when you write to them.
So, so
you might face something
like it missile that when
you write, it triggers the bios updates.
This is MSL's seventy
nine hex, so things like that.
And if you give
any access to missiles, you
risk basically your system.
Finally, we get not finally actually
call up to this ICBMs.
Another problem anybody knows what they
zone.
Who said this?
I heard you.
You come by after
the talk.
OK, so the
interesting thing about Asians is that
they are basically learning
their code modules, very small
code modules that are signed by Intel
and they're basically running in sort of
unlimited privileged mode.
If you have a bug in one
that allows you to actually escalate to
the execution mode, you can do whatever
you like within the CPU.
So not within the CPU is in
any software, to any physical address,
whatever, whatever you're aiming
at.
Next up, if we get the CPU and PCH fill
out and I'm not
only talking about the MICHAEL code
that implements the I said this is the
one that everybody well off.
But actually there is something that is
called the manageability
engine,
which has been hacked into several
times and it runs
within the PCH.
It's sort of the film of the PCH.
And it has unlimited access
to any physical memory address, which
means that the one cell there you
broke into or anything on the system
in addition to this graphics
has its own microcode the integrated
graphics power control
as the it's on Michael Cloud, and
if you can break into one of them,
good luck.
You can have a lot of
fun
and it is possible
I'll go out anyways.
BIOS and this amendment.
I also like a common component of
every platform and the
control of both the configuration of the
platform
and the F the
privilege to access everything.
So those are interesting attack vectors.
And finally,
we talked about intentional
misconfigurations.
You can take this to various
places. You can mere
misconfigured PCI configuration space
and missiles eliminate all contact
constants in order to create
unexpected situations to the VMS,
even to the emulation of
these features usually
doesn't enter this weird corner cases
because why should the emulation
handle the world? Connor case will the
port of the up support?
So in the case of them,
I tried to do it.
The video player, actually, because I
started that very quick attack on the
demo for this dock.
And it turns out that the video player
actually detects this
because it supports Windows 3.1,
which had problems with this.
So finally, Microsoft did
something to improve the security
of the.
Silver platforms are really, really fun.
I don't know if if yellow without
intel skills the platforms, but actually
the desktop platforms, which are
basically everything inside
of them, their actual microarchitecture
is the same as what my my
architectural, whether you get it inside
your laptop or inside the desktop
is all the same.
But when it gets to the actual
microarchitecture, to the actual
cell villes, they actually get the
skills. They are not the same.
They are the updates to their medical
code. They have a ton of new features,
and those features line at
the extreme privilege
level,
highly recommended to look up to them
your and actually targets them if you
want to escape from virtualization,
especially because if you are trying to
do an escape on virtualization,
you will usually be in the cell phone and
therefore this is something very
nice to target.
And finally, we get to a
superior data.
So the the
any
virtualization, any code running on the
system is still a lie on the
on the while performing correctly.
But actually, the adadevoh doesn't
perform correctly.
Intel publishes a letter
on every CPU and updates it and updates
it and updates it and so forth
and so on.
And practically
you need to think, Well, is there
virtualization engine need to
rely on this specific
function that I know that as a writer?
And then you can take advantage of it
and to demonstrate this.
Here's my bonus about a
potential VM escape
on any second generation course appeal.
So we have it in a letter that says
basically the following
the if you go to
form 32 bit mode, the 64
bit mode load a 64
bit value too closely, which is the
memory paging
route, the route of the paging
structure and then go back
to 32 bit mode, then
the zip. You will continue to use the 64
bit value, which means that
you can actually call up the pointer
and pointed to anywhere you like
while your virtualization engine thinks
that it is in the lower
32 bits because this is the size
of Cell C when you are in 32 bit
mode. So this is not something that the
updating systems normally do because they
don't transition to 64 bit
and go back to 32 bit mode.
But should you actually choose to do
this?
You can think of this, that now.
The problem is that if the virtualization
engine actually lights
the Cell C value along
the transition test, then
it will air it if
it writes a 32 bit sales
value. This is the walk along sit.
And it turns out based on my client's
presence with VM well, that they at least
believe they handle this case,
but
I haven't checked on either
virtualization platforms.
OK, so
that's that computer.
Plus, just to summarize what we've talked
about, computer platforms are complex
with Senate
memory
architecture and software stacks.
There are several approaches to
virtualized out, each with its own
internal and weaknesses.
Full out over utilization is
slower and uses software emulation
directly works.
This is born to malicious out of the
manipulations and
better defenses of available only with
new and sometimes I doubt well, but
really, if you are trying to defend
the virtualization using the hardware, if
you are trying to make it go back.
Thank you all for listening.
I'm open
to questions.
Thank you very much.
And it questions questions from the
internet. Yes.
Well.
This question from the internet,
shouldn't there be sixty four
K plus seven addresses in the
space since we are now in 64
bits?
You're saying that sixty
four plus seven, but there is no
way in
out, say, eight bytes
in the entire architecture.
Well, talking about the pill, so
it's only
in
out, in world, out
world or in the
world, out to the world.
So it's 60 plus.
And the moral questions.
Yep. Number two.
My question is, is there any hope?
Well, yeah,
basically, I'm asking you,
do you know about any
hardware development project which is
aiming to develop secure hardware
in a way?
There's a lot of hope.
Well, making progress this all the time.
What I think, what I presented there is
both the good and the bad because
we see that over time, things progress.
But new attacks come up
and this is the way
the world is everywhere.
It's too bad that in our well, we don't
hear about these components most
of the time, which is why I wanted to
talk.
Okay, so we have to fix.
I have one other question is a bit of a
presentation technical question.
Why are the slides
marked with confidential?
Oh, oops!
Thank you.
Answer is company template.
But now, you know, company secrets, I
have to kill all of you.
Please line up.
OK. Any other questions?
Go ahead.
One often answer to the previous
question until SGX
is upcoming, writes software, software,
guard extensions.
It has had a nice
welcome on invisible things,
and it
looks good for now.
I think they removed a lot of legacy
stuff there or rather circumvented that.
But we'll see how good it holds up to
when it's actually released.
And the other thing is for
virtualization, you don't need talked
about virtualization, hardware,
virtualization you need when you want to
virtualized windows, which you don't
do it for security, for security, you
don't use windows in the first place.
So I'll answer, and
you have two different statements here.
If you want to talk about SGX, I'd love
to. I was the head of product
security for SGX until three months
ago.
And basically, SGX is really a great
step in the right direction because what
SGX says is let's instead
of trying to solve the to secure the
entire platform, let's secure a small
part a small island for
each application, the latest thing that
we want to protect and
deal with the rest later.
But this still,
this is one thing.
The other thing is you don't
need to use out of all virtualization.
I think that the binary translation
based virtualization is even worse
than hardware in security.
You use
virtualization.
I mean, you're right, there's still an
interface.
But the point is the interface is at the
same level where the people are that are
implementing the virtualization.
So they know that stuff usually or for
the largest part, it's different.
When you have hardware virtualization,
you're breaking abstraction.
Basically, the VMware or whoever
is implementing your hypervisor kernel
program as they have,
they know the hardware, but they are not
until they are not processing engineers.
They don't know all the bits or the
internal workings.
The point of abstraction is that you
don't have to care about that, that your
software runs.
Also, if you have the newest, as you say,
the newest hardware, an older version of
the hardware, and that's why you should
use power virtualization, which is
actually the fault.
There was the hardware extensions
like until V3 and there
was virtualization for Linux.
There was an attempt for Windows.
I think the primary reason for the
hardware celebration hardware accelerated
virtualization is that people wanted
to virtualized windows on servers.
I would say that there were a lot
of reasons to do a lot of the other
based virtualization, basically to be
able to virtualized things without
compiling support into the code,
which is fairly important.
I think that history shows that
overall that personalization
is that a lot of weaknesses.
And basically it's very similar to the
model of system cores, which we know
work for privilege escalations
into the operating system even in 2013,
even with all the modern protections now.
I'm not arguing what you are saying.
This is this is another approach which
is useful, but
nothing is foolproof.
And it just you need to take the
pluses and minuses, and I'd love to
continue talking just coming over
after the talk. But I think the guy
behind you wants to ask questions.
Well, so
it's kind of on a related note, I think
I remember reading about running
applications directly on top of the V,
directly on top of the hypervisor without
a VM as such.
Most of your talk was about how how
broad the attack vector is and
would that would that reduce the problems
enough to consider it safe?
Yeah, but if you run applications?
Let me just be clear that you are
suggesting to run an application in
which mode sort of like
in the kernel of the vessel,
not in the kernel of the hypervisor on
top of the hypervisor.
I'm not sure exactly how it was
implemented, whether it has
the ability to access the hardware itself
or limited hardware.
I'm not sure exactly how it's
it's a vague memory.
And do you know anything
about it?
I'm not familiar with what you're talking
about. Is this
aggregated
or disaggregated
the disaggregating zen paper, which
may be not exactly what you mean by that.
It's an effort to, well,
just aggregate Zen.
So two to split Zen into multiple parts
because Zen basically has a trusted
domain. Zero.
You mean something like cubes OS
cubes.
Do you mean cubes of
invisible things that?
Think so.
And the other part would be the colonel
that could run as a hype or this Michael
conviction that also do virtualization at
the same time so they could run native
tasks at the same time also
run or as tasks.
I'm sorry, I failed on
the standard definition Hill.
Please come by, I'll give you my email
and we can talk about this
much today.
All right, and a final question.
If not, I suggest we give
Mr. Desiccant a warm applause.