Malicious hypervisor and hidden virtualization of operation systems

P. 178–182.

Sergeev, A, Minchenkov, V, Bashun, V.

Today virtualization technology is the focus of many new potential threats and introduces new security challenges that we must meet. The key problem is that malware can utilize the virtualization techniques of modern CPUs for “hidden virtualization”: to execute as a hypervisor and transform the working operation system (OS) into a “guest” state. In this work we analyzed and compared the functionality of several research virtual machine monitors (VMMs: BluePill, SubVirt, BitVisor) which can be used for hidden virtualization. We described the typical life circle of the hardware-accelerated VMM. We investigated the threats of hidden virtualization. We also implemented the proof-of-concept prototype of research VMM and used it for tests with hidden (invisible for user) virtualization of Linux operation systems. Our measurements demonstrated that using hardware-accelerating technologies malicious VMMs can efficiently hide their presence

Keywords: security, virtualization, threat, Cloud, vulnerability, bitvisor, bluepill, hardware-accelerated, hidden virtualization, hypervisor, VMM

In book

9th International Conference on Application of Information and Communication Technologies, AICT 2015 - Proceedings

IEEE Computer Society, 2015.