Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 12 down vote favorite
4

Let's say I have a linux guest running in xen and I want xen to check the integrity of the guest kernel so that I know there aren't any rootkits, or similar, active.

Is there a way to accomplish this in with xen or other hypervisors?

share|improve this question
1  
I don't have a proper answer for this, but She Who Is The Expert on this (Joanna Rutkowska) can be found at theinvisiblethings.blogspot.com. She was the original author of the Blue Pill exploit, and numerous other attacks on virtualization. – AviD♦ Mar 30 '11 at 13:53
Do you want merely some file-level integrity checking, or do you want to go deeper? – Marcin Apr 1 '11 at 0:45
no file-integrity can be checked : mount, compare hashes, maybe search for files with foremost. i found that segmentationfault.fr/projets/… could do the job. i asked the author and he said it should work with xen-memory dumps. a list of network connections is still a missing features, but the project is young. probably he will implement it some day – banditj Apr 2 '11 at 22:44

5 Answers

up vote 5 down vote

That exists handily? I'm not aware. However, within the memory space that the VM allocates, the kernel is in predictable location. One could write code which reads the memory and compares the structure to what is expected.

If I were implementing such a creature, I'd focus on following the system APIs and ensuring that they are appropriate. One likely challenge is that different kernel versions will have changes in different areas. You may have to do mapping on a kernel-by-kernel basis.

You may be able to run chrootkit externally to the VM by exporting your filesystems. I've never tried such a thing, but I bet it would make an excellent research project.

EDIT: or read your disk images direct live and use known good hash comparisons from outside the vM. Then your VM continues running, but you have the benefit of the "LiveCD" confidence. There, now I have answers ordered from most esoteric to readily available.

share|improve this answer
up vote 1 down vote

xm dump-core --> xen memory dump

http://www.segmentationfault.fr/projets/volatilitux-physical-memory-analysis-linux-systems/
searching for active processes and open files.

foremost for searching files

share|improve this answer
up vote 1 down vote

Hypervisor introspection

1) XenAccess 2) Ukwazi-Xen

share|improve this answer
up vote 0 down vote

BlockWatch monitor's guest OS's by inspecting memory snapshots.

It uses snapshots because they can typically be converted into a common format (MINIDUMP), this is the case for Hyper-V and VMWare.

BlockWatch also has python scripting to automate snapshot/export/memory-scanning/cleanup. The memory validation is done with cryptographically secure hash (Tiger192). Currently it validates Windows 32 and 64 bit OS's.

share|improve this answer
up vote 0 down vote

virt-ice will do the trick. but i think it wasn't released yet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.