Virtualization Device Emulator Testing Technology. Speaker: Qinghao Tang Title 360 Marvel Team Leader

Size: px

Start display at page:

Download "Virtualization Device Emulator Testing Technology. Speaker: Qinghao Tang Title 360 Marvel Team Leader"

Miranda Harrell
6 years ago
Views:

1 Virtualization Device Emulator Testing Technology Speaker: Qinghao Tang Title 360 Marvel Team Leader 1

2 360 Marvel Team Established in May 2015, the first professional could computing and virtualization security team in China. Focusing on attack and defense techniques in virtualization system. fuzzing framework guest machine escape technology Hypervisor risk defense technology 2

3 Agenda Virtualization System Attack Surface Fuzzing framework Case study 3

4 Virtualization System Attack Surface 4

5 Cloud Computing 5

6 Hypervisor Types function Xen Kvm Vmware quantizing distribution flexible scheduling 6

7 Distinctions OS Guest OS Hardware emulator Guest OS Hardware emulator Hypervisor Physical Devices Normal Server Physical Devices Virtualization Server 7

8 Attacking Processes in cloud computing 1. Enter VM via web or other devices 2. Exploit virtualization system vulnerabilities to escape VM 3. lateral movements to others VMs on host 4. Access to host network 8

9 Operation Principles of device emulators 9

10 The attack surface Hardware virtualization components diversity Qemu 30+ Vmware 20+ Bridge between inside-outside VM os -> device emulators -> Host os Related Vulnerabilities result big dangers Limitation 10

11 Fuzzing Framework 11

12 Basic intro Attack surface hardware virtual components Environment qemu vmware Testing results more than 20 vulnerabilities Challenges lower layers hard to predict Trends more attack surfaces more kinds of virtualization systems 12

13 Compare to traditional targets Hardware virtualization focus on lower layers System Kernel Hypervisor Testing data totally different 13

14 Methods for testing hardware virtual components 1. Analyze data which flowed to components 2. Change flowed-in data s contents and timing 3. Recording all of tiny abnormal activities 4. Analyze abnormal activities, takes and optimize fuzz framework. 14

15 Other factors of fuzz framework 1.Flexibility (other OS) vm in Linux coding in C and Python 2. Deeply understand VM system language for coding development environment coding style 15

16 Fuzz framework structure Control Center os os os os os os Host Host 16

17 Fuzz framework working flow (part 1) 1. Set up network and hardware environment, launch server, client and monitor. 2. Load system hook module, get all of machines device emulators 3. Client ask server for testing data of emulators, server send out required data. 4. Client received and loaded testing data, launch test. 5. Monitor continually monitor hypervisor, and record logs. 17

18 Fuzz framework working flow (part 2) 6. Notify the server after client testing finished 7. Server get logs from client and monitor, save it. 8. Server launch log analyze module, determine if anything wrong happened, and notify admins. 9. Analyze program exceptions, optimize fuzz framework 18

19 Functions of controlling center 19

20 Get target components info 20

21 Testing data Device access ports Device deal with structures used by data. Device data processing 21

Testing data attacks User space: generate

testing data flow user space Kernel space

22 Testing data attacks User space: generate testing dat, send request to client kernel Kernel space: apply for memory, fill memory, send info to ports Device emulator testing data flow user space Kernel space Device controller inside trigger exceptions 22

23 Monitor VM management Snapshot Reboot VM device editing Dynamic debugging Debugging Mode on Start Load Debugging Plugin VM processing log User space Kernel space 23

24 Exceptions occur in device emulator VM os crash Hypervisor crash Invisible results 24

25 Advanced monitoring skills Dynamic Static 25

26 Optimize fuzz framework by using log data Client log Decrease invalid combinations Monitor log Promote coverage Server log 26

27 Vulnerabilities found by us 27

28 Case Study 28

process of descriptor 3 types descriptor context data legacy data xfer set status wait

29 Principle of e1000 Network Device Initialization Port Allocation Address Mapping Device Status Setting, Resource Allocation Data Transfer 'Write Command' to device TDT register process of descriptor 3 types descriptor context data legacy data xfer set status wait for next instruction Processing Details Circular Memory TSO tcp segmentation/flow control. 29

30 E1000 vulnerability analysis Qemu e1000 Network Device Vmware e1000 Network Device 30

31 Pcnet network card emulator working processes Io port write Control and Status Registers write Receive Send Virtual Network Interface 31

32 Pcnet vulnerability analysis Qemu pcnet Network Device 32

33 Summary Stay tuned for more achievements by 360 Marvel Team 33

34 Q & A tangqinghao@360.cn QQ

64-bit ARM Unikernels on ukvm

64-bit ARM Unikernels on ukvm Wei Chen Senior Software Engineer Tokyo / Open Source Summit Japan 2017 2017-05-31 Thanks to Dan Williams, Martin Lucina, Anil Madhavapeddy and other Solo5