A technique for remote detection of certain virtual machine monitors

Authors:
Christopher Jämthagen;Martin Hell;Ben Smeets
Affiliations:
Department of Electrical and Information Technology, Lund University, Lund, Sweden;Department of Electrical and Information Technology, Lund University, Lund, Sweden;Department of Electrical and Information Technology, Lund University, Lund, Sweden
Venue:
INTRUST'11 Proceedings of the Third international conference on Trusted Systems
Year:
2011

Citing 5
Cited 0

A technique for counting natted hosts

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
SubVirt: Implementing malware with virtual machines

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Practical Protocol Steganography: Hiding Data in IP Header

AMS '07 Proceedings of the First Asia International Conference on Modelling & Simulation
Tor: the second-generation onion router

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Remote detection of virtual machine monitors with fuzzy benchmarking

ACM SIGOPS Operating Systems Review

Quantified Score

Hi-index	0.00

Visualization

Abstract

The ability to detect a virtualized environment has both malicious and non-malicious uses. This paper reveals a new exploit and technique that can be used to remotely detect VMware Workstation, VMware Player and VirtualBox. The detection based on this technique can be done completely passively in that there is no need to have access to the remote machine and no network connections are initiated by the verifier. Using only information in the IP packet together with information sent in the user-agent string in an HTTP request, it is shown how to detect that the traffic originates from a guest in VMware Workstation, VMware Player or VirtualBox client. The limitation is that NAT has to be turned on and that the host and guest need to run different operating system families, e.g., Windows/Linux.