Abstract:Exploiting memory disclosure vulnerabilities like the Heart Bleed bug may cause arbitrary reading of a victim's memory, leading to leakage of critical secrets such as crypto keys, personal identity and financial information. While isolating code that manipulates critical secrets into an isolated execution environment is a promising countermeasure, existing approaches are either too coarse-grained to prevent intra-domain attacks, or require excessive intervention from low-level software (e.g., hypervisor or OS), or both. Further, few of them are applicable to large-scale software with millions of lines of code.This paper describes a new approach, namely SeCage, which retrofits commodity hardware virtualization extensions to support efficient isolation of sensitive code manipulating critical secrets from the remaining code. SeCage is designed to work under a strong adversary model where a victim application or even the OS may be controlled by the adversary, while supporting large-scale software with small deployment cost. SeCage combines static and dynamic analysis to decompose monolithic software into several compartments, each of which may contain different secrets and their corresponding code. Following the idea of separating control and data plane, SeCage retrofits the VMFUNC mechanism and nested paging in Intel processors to transparently provide different memory views for different compartments, while allowing low-cost and transparent invocation across domains without hypervisor intervention.We have implemented SeCage in KVM on a commodity Intel machine. To demonstrate the effectiveness of SeCage, we deploy it to the Nginx and OpenSSH server with the OpenSSL library as well as CryptoLoop with small efforts. Security evaluation shows that SeCage can prevent the disclosure of private keys from HeartBleed attacks and memory scanning from rootkits. The evaluation shows that SeCage only incurs small performance and space overhead.

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

CovertInspector: Identification of Shared Memory Covert Timing Channel in Multi-tenanted Cloud.

Constructing the On/Off Covert Channel on Xen

Investigating Timing Channel in IaaS

Exploring Virtual Machine Covert Channel Via I/O Performance Interference

A Covert Channel Using Event Channel State on Xen Hypervisor

An Efficient Approach for Mitigating Covert Storage Channel Attacks in Virtual Machines by the Anti-Detection Criterion.

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

An Approach for Secure-Communication Between XEN Virtual Machines

A Covert Channel Using Core Alternation

Thwarting Memory Disclosure With Efficient Hypervisor-Enforced Intra-Domain Isolation

Secure and Efficient In-Hypervisor Memory Introspection Using Nested Virtualization.

Tsac: Enforcing Isolation of Virtual Machines in Clouds

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors

An Efficient and Transparent Approach for Adaptive Intra-and Inter-Node Virtual Machine Communication in Virtualized Clouds.

Cross-VM Cache Side Channel Attacks in Cloud: A Survey

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

Architecture support for guest-transparent VM protection from untrusted hypervisor and physical attacks

Timing Channel in IaaS: How to Identify and Investigate

Checking virtual machine kernel control-flow integrity using a page-level dynamic tracing approach

VIsolator: An intel VMX-based isolation mechanism