Matasano Chargen - Latest Comments in Side-Channel Detection Attacks Against Unauthorized Hypervisors

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

TK — Tue, 04 Sep 2007 10:29:47 -0000

Can we add a pwnie category for best blog post of the year? Anything describing security with sesame street chars is sure to become an instant classic... :)

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

Alfred Huger — Thu, 23 Aug 2007 14:48:01 -0000

Wow, that is a fantastic writeup Tom, thanks.

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

Andrew — Mon, 20 Aug 2007 22:09:03 -0000

Your memory hierarchy diagram is beautiful.

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

Matt — Mon, 20 Aug 2007 15:33:33 -0000

The first link ("all over the place") is not kablamo. Also, the combinatoric cognitive dissonance of the HSAS, Sesame Street, and the memory hierarchy nearly made my head explode this morning.

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

Thomas Ptacek — Mon, 20 Aug 2007 10:52:43 -0000

If run from within ring 0 of a guest operating system, of course; it will simply detect the fact that the guest is in fact a guest.

But if run from within ring 0 of the host ("ring -1", as it were), it spots unexpected virtualization --- a "smoking gun" when the hypervisor is itself not expected to be virtualized.

Re: Side-Channel Detection Attacks Against Unauthorized Hypervisors

yakov — Mon, 20 Aug 2007 09:53:44 -0000

Excellent explanation Thomas. Still I don't see how it detects only unauthorized hypervisors. Won't legitimate use case of software running in a VM cause false positive?