Memory Forensics using Virtual
Machine Introspection for Cloud
ComputingTobias Zillner, BSc MSc MSc

About Me
Tobias Zillner, BSc MSc MSc• Vienna, Austria• Founder of Zillner IT-Security• Independent Security Consultant & Researcher• Consulting, Audit, Advisory, Training• Security Research• Internet of Things, Smart Homes• Wireless Security• www.zillner.tech

SDR Enthusiast

What is it about?
And why do we need it?

Outline
Introduction & Background
Virtual Machine Introspection (VMI)
Use cases
PrototypeSummary

Motivation
Relocation of systems and services into cloud environments is on the rise
Users loose direct access / control over their systems
Forensic methods are limited in the cloudEnable the user to perform their own forensic investigations
Forensic as a Service

Memory forensics &Virtual machine IntrospectionForensic ProcessCollection

Media

Examination

Data

Analysis

Information

Reporting

Evidence

Hardware virtualization
One / Multiple guest OS on virtualized hardware
Managed by Virtual Machine Monitor (VMM) – Hypervisor
Provides interfaces and controls interactions with hardware• CPU, memory, network, storage,…

Hypervisor on own OS – Host OS

Guest OS

Native virtualization

Guest OSGuestOSGuestOS

Hypervisor
Host OS

HardwareHardwareHypervisor

Hosted virtualization

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application

Application

Native vs. hosted virtualization

Virtual machine Introspection“Virtual Introspection (VI) is the process by which thestate of a virtual machine (VM) is observed fromeither the Virtual Machine Monitor (VMM), or fromsome virtual machine other than the one being
examined. “ 11: Brian Hay and Kara Nance. Forensics examination of volatile system data using

virtual introspection. SIGOPS Oper. Syst. Rev., 42(3):74 82, April 2008

Semantic gap
Difference between the presentation of data from volatile memory by the OS
and the raw data format
Requires VMI to perform the same translation of the the raw memory dataas the OS
At least some knowledge about the guest OS is necessaryHow does it work?

http://libvmi.com/docs/gcode-intro.html

Advantages
No altering of the target system
Very hard to detect the monitoring
Live analysis of memory content
Data size for analysis (storage much larger than memory)
Detection of advanced memory only malware
More reliable data• No data corruption through malware

Countermeasures
Detection• Timing analysis - unusual patterns in the frequency at which it is scheduled
for execution• Page fault analysis - the target VM may be able to detect unusual patterns
in the distribution of page faults

Direct Kernel Structure Manipulation (DKSM)• VMI assumes that OS implement certain kernel- and data structures• DKSM modifies this structures and prevents monitoring• Sytanx based: targeted deletion/addition/manipulation of data structures• Sematic: semantics of the data structures are changed• Combined: mix of syntax and semantics manipulation

Fields of application
ExamplesRootkit detection• Manipulation of memory access• Interception of system calls

Cryptographic key extraction• On the fly encrypted container• Network forensics

IDS / IPS

Prototype

Solution approach
Combining existing tools for a novel approach
Open Source
Minimal overhead
Transparent for the user

Architecture
Cloud Solution• Open Nebula

Memory Forensic Services

Cloud Management Server

VMI Library – LibVMI

Cloud Node

Forensic Tool – Volatility

Host OS – Ubuntu
Guest VM

Hypervisor - Xen

VM1

VM2

Dom 0Dom U Dom U
Hypervisor
Cloud Node

Cloud Control Services
Cloud Management ServerVM2

ForensicTool

Dom U Dom UVMI
Library

VM1

MemoryForensicService

Dom 0Hypervisor
Cloud Node

Cloud Control Services

Memory Forensic Service

Cloud Management Server

Open nebula extensions

www.opennebula.org

Memory forensic services
Self developed management and control services
Client – Server model
Platform independent
PKI for secure communication
Command whitelistingForensic Process

Collection

ExaminationMedia

DataAnalysis

ReportingInformation

EvidenceForensic Process• OS on Cloud Node• Data provided by LibVMI• Collected by Volatility
Collection

ExaminationMediaDataAnalysis

ReportingInformation

EvidenceForensic Process• OS on Cloud Node• Collected data checked by Volatility• Data extraction for forensic purpose
Collection

ExaminationMedia

DataAnalysis

ReportingInformation

EvidenceForensic Process••••
Collection

Examination

Media

Data

Partially OS on Cloud Node
Collected data checked by Volatility
Partially on user system
Analysis with additional tools by userAnalysis

ReportingInformation

EvidenceForensic Process• Completely on user system

Collection

ExaminationMedia

DataAnalysis

ReportingInformation

Evidence

Advantages
User gets easy access to the data
No changes on the target VM necessary
Memory analysis not on the possibly compromised system
No stop/pausing of the analyzed machine required
Operation of the VM does not get influenced
Analysis can be done either local or over the network• Reduction of local load / network load
Usage of existing authentication and authorization system

Disadvantages
Configuration necessary
Knowledge about the guest OS required
Installation overhead for cloud provider

Additional attack surface
Security is crucial for the added services
User segregation is very important

LibVMI config example

Volatility / Libvmi usageUse caseKernel level root kit detection

Modifying of data structures, which display the processes currently
running on the system
System call interception
Interrupt hooking
Modifying the kernel memory image
Intercepting calls handled by the VFS
Virtual memory subversion

Use caseEnduser VM in Iaas cloudDemoSummarySummary
Investigations in cloud environments get more and more common
Hypervisor forensics VMI is a very interesting solution approach
Fully Open Source based working prototype
Enables fast responses to security incidents
Lot of room for enhancements
Different use cases for VMI in clouds possible

Black hat sound bytes
Hypervisor forensics / VMI are very powerful and interesting
technologies
FaaS gives power to the end user
Memory analysis is a huge benefit for forensic investigations

Q &A
Please fill out the Black Hat Feedback FormContact
Tobias Zillner
tobias@zillner.tech
www.zillner.tech+43 664 8829 8290