Attacking Hypervisors Using Firmware and Hardware

Presented at DEF CON 23 (2015), Aug. 9, 2015, 1 p.m. (60 minutes).

In this presentation, we explore the attack surface of modern hypervisors from the perspective of vulnerabilities in system firmware such as BIOS and in hardware emulation. We will demonstrate a number of new attacks on hypervisors based on system firmware vulnerabilities with impacts ranging from VMM DoS to hypervisor privilege escalation to SMM privilege escalation from within the virtual machines. We will also show how a firmware rootkit based on these vulnerabilities could expose secrets within virtual machines and explain how firmware issues can be used for analysis of hypervisor-protected content such as VMCS structures, EPT tables, host physical addresses (HPA) map, IOMMU page tables etc. To enable further hypervisor security testing, we will also be releasing new modules in the open source CHIPSEC framework to test issues in hypervisors when virtualizing hardware.

Presenters:

• Yuriy Bulygin - Advanced Threat Research, Intel Security
  Yuriy Bulygin is chief threat researcher at Intel Security Group where he is leading the Advanced Threat Research team in identifying and analyzing new threats impacting modern platforms and researching mitigations in hardware and software against these threats. He joined Intel’s Security Center of Excellence in 2006, where he was responsible for conducting security analysis and penetration testing of microprocessors, chipsets, graphics, and various other components, firmware, and technologies on Intel PCs, servers, and mobile devices. Yuriy is also a member of the core security architecture team reviewing Intel’s future products. Prior to joining Intel, he was teaching undergrad seminars in information security at Moscow Institute of Physics and Technology. Twitter: @c7zero
• Mikhail Gorobets - Advanced Threat Research, Intel Security
  Mikhail Gorobets is a security researcher in the Advanced Threat Research team. His area of expertise includes hardware security, virtualization technologies, reverse engineering, and vulnerability analysis. Previously, he led a team of security researchers working on Intel Virtualization Technology (VTx) and Intel Atom core security evaluation.  Mikhail holds a MS in computing machines, systems, and networks from the Moscow Institute of Electronics and Mathematics.
• Alexander Matrosov - Advanced Threat Research, Intel Security
  Alexander Matrosov has more than ten years of experience with malware analysis, reverse engineering, and advanced exploitation techniques. He is currently a senior security researcher in the Advanced Threat Research team at Intel Security Group. Prior to this role, he spent four years focused on advanced malware research at ESET. He is co-author of numerous research papers, including “Stuxnet Under the Microscope,” “The Evolution of TDL: Conquering x64,” and "Mind the Gapz: The most complex bootkit ever analyzed?". Alexander is frequently invited to speak at security conferences such as REcon, Ekoparty, Zeronigths, AVAR, CARO, and Virus Bulletin. Nowadays, he specializes in the comprehensive analysis of advanced threats, modern vectors of exploitation, and hardware security research.
• Oleksandr Bazhaniuk - Advanced Threat Research, Intel Security
  Oleksandr Bazhaniuk is a security researcher in the Advanced Threat Research team. His primary interests are low-level hardware security, bios/uefi security, and automation of binary vulnerability analysis. His work has been presented at world-renowned conferences, including Black Hat USA, Hack In The Box, Hackito Ergo Sum, Positive Hack Days, Toorcon, CanSecWest. He is also a co-founder of DCUA, the first DEF CON group in Ukraine.
• Andrew Furtak - Security Researcher
  Andrew Furtak is a security researcher focusing on security analysis of firmware and hardware of modern computing platforms. He was previously a security software engineer. Andrew holds a MS in applied mathematics and physics from the Moscow Institute of Physics and Technology.

Links:

• https://defcon.org/html/defcon-23/dc-23-speakers.html#Bulygin
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Video and Slides.mp4 (Video and Slides)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Video and Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Yuriy Bulygin - Attacking Hypervisors Using Firmware and Hardware - Video.srt (subtitles)

Similar Presentations:

• Black Hat USA 2015 / Attacking Hypervisors Using Firmware and Hardware
• Black Hat USA 2014 / Poacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors
• TROOPERS17 (2017) / Software Attacks on Hypervisor Emulation of Hardware