DKSM: Subverting Virtual Machine Introspection for Fun and Profit


Virtual machine (VM) introspection is a powerful technique for determining the specific aspects of guest VM execution from outside the VM. Unfortunately, existing introspection solutions share a common questionable assumption. This assumption is embodied in the expectation that original kernel data structures are respected by the untrusted guest and thus can be directly used to bridge the well-known semantic gap. In this paper, we assume the perspective of the attacker, and exploit this questionable assumption to subvert VM introspection. In particular, we present an attack called DKSM (Direct Kernel Structure Manipulation), and show that it can effectively foil existing VM introspection solutions into providing false information. By assuming this perspective, we hope to better understand the challenges and opportunities for the development of future reliable VM introspection solutions that are not vulnerable to the proposed attack.

DOI: 10.1109/SRDS.2010.39

Extracted Key Phrases

5 Figures and Tables

Citations per Year

136 Citations

Semantic Scholar estimates that this publication has 136 citations based on the available data.

See our FAQ for additional information.

Cite this paper

@article{Bahram2010DKSMSV, title={DKSM: Subverting Virtual Machine Introspection for Fun and Profit}, author={Sina Bahram and Xuxian Jiang and Zhi Wang and Mike Grace and Jinku Li and Deepa Srinivasan and Junghwan Rhee and Dongyan Xu}, journal={2010 29th IEEE Symposium on Reliable Distributed Systems}, year={2010}, pages={82-91} }