How hypervisor rootkits create network connections to exfiltrate data? They don't have access to the underlying OS syscalls, right? Because they are usually programmed with VTx Intel instructions in assembly.
1 Answer
From the paper SubVirt: Implementing malware with virtual machines.
This new type of malware, which we call a virtual-machine based rootkit (VMBR), installs a virtual-machine monitor underneath an existing operating system and hoists the original operating system into a virtual machine.
There are two main approaches for making a suitable running environment for the rootkit:
The first one involves changing the actual operating system and user programs with your elevated authorization and running the VMM (Virtual Machine Monitor) and user/kernel mode component of the rootkit.
The other one is pretty much the same, just using another operating system.
Further, VMBRs support general-purpose malicious services by allowing such services to run in a separate operating system that is protected from the target system.
You can use APIs (including the TCP/IP stack and related API) and the hardware abstraction of your new host. It is a little different, but I must say another way is using your own TCP/IP stack:
Delusion comes with its own TCP/IP stack based on lwIP
The Blue Pill-based Delusion backdoor uses its own stack according to the Introducing Blue Pill presentation.
And what about if our new host application need to interact with target OS? For stealing data in the first place.
- Like most of the legit virtualization software you can use agents inside the guest OS.
- Controlling CPU registers makes it easy to implement any hooking techniques.
- The hypervisor also controls the disk and the OS interface to the disk.
This is another topic to discuss, but it is more than enough to control the target OS.
