Skip to main content

A Technique for Remote Detection of Certain Virtual Machine Monitors

  • Conference paper

Part of the Lecture Notes in Computer Science book series (LNSC,volume 7222)

Abstract

The ability to detect a virtualized environment has both malicious and non-malicious uses. This paper reveals a new exploit and technique that can be used to remotely detect VMware Workstation, VMware Player and VirtualBox. The detection based on this technique can be done completely passively in that there is no need to have access to the remote machine and no network connections are initiated by the verifier. Using only information in the IP packet together with information sent in the user-agent string in an HTTP request, it is shown how to detect that the traffic originates from a guest in VMware Workstation, VMware Player or VirtualBox client. The limitation is that NAT has to be turned on and that the host and guest need to run different operating system families, e.g., Windows/Linux.

This is a preview of subscription content, access via your institution.

Buying options

Chapter
USD   29.95
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (Canada)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Conficker’s virtual machine detection, http://nakedsecurity.sophos.com/2009/03/27/confickers-virtual-machine-detection/

  2. Nmap, http://nmap.org/ (last accessed on June 22, 2011)

  3. Official website of the apache http server, http://httpd.apache.org/

  4. Path traversal vulnerability in vmware’s shared folders implementation, http://www.immunityinc.com/documentation/cloudburst-vista.html

  5. Bellovin, S.: A technique for counting natted hosts, pp. 267–272. ACM, New York (2002)

    Google Scholar 

  6. Oracle Corporation. Oracle vm virtualbox, user manual, http://www.virtualbox.org/manual/

  7. Dingledine, R., Mathewson, N., Syverson, P.: The second-generation onion router. In: Proceedings of the 13th USENIX Security Symposium (2004)

    Google Scholar 

  8. Franklin, J., Luk, M., McCune, J.M., Seshadri, A., Perrig, A., van Doorn, L.: Remote detection of virtual machine monitors with fuzzy benchmarking. SIGOPS Oper. Syst. Rev. 42, 83–92 (2008)

    CrossRef  Google Scholar 

  9. Fyodor. Return on investment, http://insecure.org/stc/

  10. Jordan, G.: Stealing profits from stock market spammers (2009), http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-grant_jordan-stock_market_spam.pdft

  11. Kortchinsky, K.: Cloudburst vista - vmware vulnerability, http://www.immunityinc.com/documentation/cloudburst-vista.html

  12. Lau, B., Svajcer, V.: Measuring virtual machine detection in malware using dsd tracer. Journal in Computer Virology 6, 181–195 (2008)

    CrossRef  Google Scholar 

  13. MacManus, G.: Vmware workstation shared folders directory traversal vulnerability, http://www.immunityinc.com/documentation/cloudburst-vista.html

  14. West, M., McCann, S.: Tcp/ip field behavior (2006), http://www.ietf.org/rfc/rfc4413.txt

  15. Rutkowska, J.: Introducing blue pill, http://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.htmll

  16. Rutkowska, J.: Red pill... or how to detect vmm using (almost) one cpu instruction, http://invisiblethings.org/papers/redpill.html

  17. Wang, Y.-M., Verbowski, C., Wang, H.J., King, S.T., Chen, P.M., Lorch, J.R.: SubVirt: implementing malware with virtual machines. In: Proceedings of the IEEE Symposium on Security and Privacy (May 2006)

    Google Scholar 

  18. Wojtczvk, R.: Cve-2007-4496 - vmware vulnerability, http://www.immunityinc.com/documentation/cloudburst-vista.html

  19. Xu, B., Wang, J., Peng, D.: Practical protocol steganography: Hiding data in ip header. In: Asia International Conference on Modelling & Simulation, pp. 584–588 (2007)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2012 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Jämthagen, C., Hell, M., Smeets, B. (2012). A Technique for Remote Detection of Certain Virtual Machine Monitors. In: Chen, L., Yung, M., Zhu, L. (eds) Trusted Systems. INTRUST 2011. Lecture Notes in Computer Science, vol 7222. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-32298-3_9

Download citation

  • DOI: https://doi.org/10.1007/978-3-642-32298-3_9

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-642-32297-6

  • Online ISBN: 978-3-642-32298-3

  • eBook Packages: Computer ScienceComputer Science (R0)