0 00:00:00,000 --> 00:00:30,000 Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/180 Thanks! 1 00:00:08,980 --> 00:00:09,759 I have a one 2 00:00:09,760 --> 00:00:11,889 thank you all for coming here at 3 00:00:11,890 --> 00:00:12,849 this late hour 4 00:00:12,850 --> 00:00:13,850 of the day. 5 00:00:15,250 --> 00:00:17,839 My name is Goldie Skin and as 6 00:00:17,840 --> 00:00:19,719 was said, I will be presenting about 7 00:00:19,720 --> 00:00:21,189 virtualization security. 8 00:00:21,190 --> 00:00:23,409 The purpose of my talk is to 9 00:00:23,410 --> 00:00:26,079 introduce to you the low level mechanisms 10 00:00:26,080 --> 00:00:28,809 that are related to the infrastructure 11 00:00:28,810 --> 00:00:30,669 that makes the virtualization secure and 12 00:00:30,670 --> 00:00:32,949 basically allows us to use a 13 00:00:32,950 --> 00:00:35,439 virtualization virtualization security. 14 00:00:35,440 --> 00:00:37,599 So am I. Why am I talking to you about 15 00:00:37,600 --> 00:00:38,769 this? 16 00:00:38,770 --> 00:00:40,659 The key point that is related to 17 00:00:40,660 --> 00:00:42,729 virtualization here is that they used to 18 00:00:42,730 --> 00:00:45,009 work for eight years for Intel doing 19 00:00:45,010 --> 00:00:46,779 a lot of the infrastructure work and 20 00:00:46,780 --> 00:00:48,040 virtualization security. 21 00:00:50,770 --> 00:00:52,599 OK, so let's move on. 22 00:00:52,600 --> 00:00:54,999 I want first to give a few thanks. 23 00:00:55,000 --> 00:00:57,189 I want to thank my wife, Taylor, 24 00:00:57,190 --> 00:00:59,049 who has been there taking good care of me 25 00:00:59,050 --> 00:01:00,489 while I'm doing research. 26 00:01:00,490 --> 00:01:02,319 I want to take everyone at Sevilla and 27 00:01:02,320 --> 00:01:04,068 especially the people that review the 28 00:01:04,069 --> 00:01:06,309 talk for me and 29 00:01:06,310 --> 00:01:08,259 all the security people that Intel agreed 30 00:01:08,260 --> 00:01:09,879 to all. 31 00:01:09,880 --> 00:01:11,620 You know, it is from the other side now. 32 00:01:14,020 --> 00:01:14,559 OK. 33 00:01:14,560 --> 00:01:16,749 So what am I going to talk about 34 00:01:16,750 --> 00:01:18,649 today? I'm going to talk about how 35 00:01:18,650 --> 00:01:21,099 digital assisted virtualization. 36 00:01:21,100 --> 00:01:22,719 I'm going to talk about the software 37 00:01:22,720 --> 00:01:24,519 stacks and different virtualization 38 00:01:24,520 --> 00:01:26,799 approaches and weaknesses 39 00:01:26,800 --> 00:01:28,539 of each approach. 40 00:01:28,540 --> 00:01:30,909 I'm going to talk about the complexity of 41 00:01:30,910 --> 00:01:32,589 memory management and the related 42 00:01:32,590 --> 00:01:34,449 weaknesses that this affects on 43 00:01:34,450 --> 00:01:35,589 virtualization. 44 00:01:35,590 --> 00:01:37,269 And finally, I'm going to talk about the 45 00:01:37,270 --> 00:01:39,909 computer platform and the way it does 46 00:01:39,910 --> 00:01:42,099 lead to certain weaknesses in 47 00:01:42,100 --> 00:01:44,319 the implementation of the 48 00:01:44,320 --> 00:01:45,669 virtualization platforms. 49 00:01:46,750 --> 00:01:48,759 And there's a special bonus they might 50 00:01:48,760 --> 00:01:51,219 show. I will show a small potential 51 00:01:51,220 --> 00:01:53,529 VM escape that might work 52 00:01:53,530 --> 00:01:53,919 and might 53 00:01:53,920 --> 00:01:55,930 not know them or silly 54 00:01:57,160 --> 00:01:59,059 kind of walk down my computer when I try 55 00:01:59,060 --> 00:02:00,060 to do it 56 00:02:02,140 --> 00:02:03,549 anyways. 57 00:02:03,550 --> 00:02:05,619 So what 58 00:02:05,620 --> 00:02:08,319 is virtualization in the context of this? 59 00:02:08,320 --> 00:02:10,538 Virtualization is replacing the real hard 60 00:02:10,539 --> 00:02:12,039 world that you have the CPU and the 61 00:02:12,040 --> 00:02:14,109 computer platform with a virtual 62 00:02:14,110 --> 00:02:15,110 environment. 63 00:02:15,880 --> 00:02:18,009 Historically, we can trace 64 00:02:18,010 --> 00:02:20,109 the roots of virtualization even to 65 00:02:20,110 --> 00:02:22,299 Alan Turing and the universal Turing 66 00:02:22,300 --> 00:02:24,339 machine concept, which was basically a 67 00:02:24,340 --> 00:02:26,409 machine that could emulate any adult 68 00:02:26,410 --> 00:02:27,410 machine. 69 00:02:27,880 --> 00:02:30,609 After that, it's the 70 00:02:30,610 --> 00:02:33,009 late 70s Beck and Goldberg 71 00:02:33,010 --> 00:02:35,319 came came up with the 72 00:02:35,320 --> 00:02:37,869 virtualization requirements 73 00:02:37,870 --> 00:02:39,249 for computer architectures 74 00:02:41,020 --> 00:02:42,020 anyways. 75 00:02:42,520 --> 00:02:44,949 So that's that's always thoughtful and a 76 00:02:44,950 --> 00:02:47,279 bit of terminology that's just so 77 00:02:47,280 --> 00:02:48,909 all speaking the same language, 78 00:02:50,290 --> 00:02:52,419 a machine manager or VM is the stuff 79 00:02:52,420 --> 00:02:54,759 to virtualizing privileged instructions 80 00:02:54,760 --> 00:02:55,689 and the audio. 81 00:02:55,690 --> 00:02:57,309 Basically, this is the core of the 82 00:02:57,310 --> 00:02:59,259 virtualization system. 83 00:02:59,260 --> 00:03:01,359 A virtual machine is the software stack 84 00:03:01,360 --> 00:03:03,239 running on television. 85 00:03:03,240 --> 00:03:05,139 VM in a 86 00:03:05,140 --> 00:03:07,569 guest operating system is the operating 87 00:03:07,570 --> 00:03:10,179 system of the virtual machine, 88 00:03:10,180 --> 00:03:12,249 and the operating system is the operating 89 00:03:12,250 --> 00:03:14,289 system that is controlling the VM, 90 00:03:15,580 --> 00:03:17,709 and the operation is when you execute 91 00:03:17,710 --> 00:03:18,789 within the VM. 92 00:03:20,920 --> 00:03:23,049 So first question we need to ask 93 00:03:23,050 --> 00:03:24,909 yourself if this guy is talking to us 94 00:03:24,910 --> 00:03:27,309 about secure virtualization, but 95 00:03:27,310 --> 00:03:28,989 there are many definitions of secure. 96 00:03:28,990 --> 00:03:30,790 So what is secure virtualization? 97 00:03:31,990 --> 00:03:34,149 So the security goes 98 00:03:34,150 --> 00:03:36,369 that way. We need to define what 99 00:03:36,370 --> 00:03:38,469 allows our security guys and when 100 00:03:38,470 --> 00:03:40,569 we want to secure a secure virtualization 101 00:03:40,570 --> 00:03:42,039 platform. 102 00:03:42,040 --> 00:03:44,259 So first, the first goal is preventing 103 00:03:44,260 --> 00:03:46,329 modification of the operating system 104 00:03:46,330 --> 00:03:48,369 by guests. This makes sense and 105 00:03:48,370 --> 00:03:50,439 naturally, also the VM has 106 00:03:50,440 --> 00:03:52,419 to be in order for this to live and work. 107 00:03:53,560 --> 00:03:55,239 You need to prevent one guest from 108 00:03:55,240 --> 00:03:56,589 changing another guest, right? 109 00:03:56,590 --> 00:03:58,479 If I have two virtual machines, I don't 110 00:03:58,480 --> 00:04:00,489 want one to attach the either or vice 111 00:04:00,490 --> 00:04:01,490 versa. 112 00:04:02,530 --> 00:04:04,479 You need to prevent the guest out, well, 113 00:04:04,480 --> 00:04:06,069 the virtual machine from actually 114 00:04:06,070 --> 00:04:07,809 subverting the 115 00:04:07,810 --> 00:04:08,169 the 116 00:04:08,170 --> 00:04:11,049 actual film of the system. 117 00:04:11,050 --> 00:04:12,639 You need to prevent the guests on 118 00:04:12,640 --> 00:04:14,619 stealing data from either guests or from 119 00:04:14,620 --> 00:04:16,429 the host operating system or from. 120 00:04:16,430 --> 00:04:18,739 And then you need to prevent 121 00:04:18,740 --> 00:04:20,398 denial of service. 122 00:04:20,399 --> 00:04:22,819 Vegas, though, is all getting on Phil 123 00:04:22,820 --> 00:04:24,790 lovely Celsius relative to other guests, 124 00:04:26,140 --> 00:04:27,969 and you need to give the guest to a 125 00:04:27,970 --> 00:04:29,219 secure way. 126 00:04:29,220 --> 00:04:31,209 You don't want to downgrade this to their 127 00:04:31,210 --> 00:04:33,399 normal security mechanisms of 128 00:04:33,400 --> 00:04:34,959 the guest operating system. 129 00:04:34,960 --> 00:04:36,849 Now, this may not be equal in every 130 00:04:36,850 --> 00:04:38,679 platform. For example, MySQL 131 00:04:38,680 --> 00:04:40,809 virtualization usually gives access 132 00:04:40,810 --> 00:04:43,119 to the guests directly to the hardware, 133 00:04:43,120 --> 00:04:45,249 which is a very bad idea in security 134 00:04:45,250 --> 00:04:47,079 terms. But this is what they do because 135 00:04:47,080 --> 00:04:48,969 they want their virtualization 136 00:04:48,970 --> 00:04:50,499 capabilities for money, building 137 00:04:52,090 --> 00:04:53,019 other 138 00:04:53,020 --> 00:04:54,669 virtualization engines of useful 139 00:04:54,670 --> 00:04:56,319 instrumentation, and they again don't 140 00:04:56,320 --> 00:04:57,729 care about security. 141 00:04:57,730 --> 00:04:59,169 But if you care about security, you 142 00:04:59,170 --> 00:05:01,539 shouldn't give access to the album, and 143 00:05:01,540 --> 00:05:03,909 we'll hear a lot about this later. 144 00:05:03,910 --> 00:05:06,069 So moving on to the first section of 145 00:05:06,070 --> 00:05:07,569 this talk, I'm going to talk about the 146 00:05:07,570 --> 00:05:09,379 defense of. Stocks, though, different 147 00:05:09,380 --> 00:05:12,080 ways to use virtualization capabilities. 148 00:05:13,340 --> 00:05:15,439 So first one we have here is 149 00:05:15,440 --> 00:05:17,899 the type one hypervisor 150 00:05:17,900 --> 00:05:19,929 also call the Bell MetLife vasL. 151 00:05:21,200 --> 00:05:22,909 It's important to note that this is sort 152 00:05:22,910 --> 00:05:25,039 of a simplified view, but it still 153 00:05:26,540 --> 00:05:28,519 it represents most of the way the system 154 00:05:28,520 --> 00:05:30,709 works. So what we have here is 155 00:05:30,710 --> 00:05:33,529 first off, we have the processes 156 00:05:33,530 --> 00:05:35,359 the processes each executes in a 157 00:05:35,360 --> 00:05:37,100 different guest operating system. 158 00:05:38,150 --> 00:05:41,089 The guest operating system is executing 159 00:05:41,090 --> 00:05:42,499 above a 160 00:05:42,500 --> 00:05:44,239 virtual machine and only thulo a 161 00:05:44,240 --> 00:05:46,789 hypervisor, and this one is executing 162 00:05:46,790 --> 00:05:48,979 directly above the audio and between 163 00:05:48,980 --> 00:05:51,019 each one with different interfaces. 164 00:05:51,020 --> 00:05:53,089 So as you all know, between processes and 165 00:05:53,090 --> 00:05:54,679 the operating system, you have system 166 00:05:54,680 --> 00:05:56,839 call interface and the interface 167 00:05:56,840 --> 00:05:58,909 between the guest operating systems and 168 00:05:58,910 --> 00:06:00,949 the whether they are well, that's the 169 00:06:00,950 --> 00:06:03,739 reason interface or not is the 170 00:06:03,740 --> 00:06:05,899 event exits and vehemently is 171 00:06:05,900 --> 00:06:08,089 a VM exit is the transition from the 172 00:06:08,090 --> 00:06:10,219 VM, from the guest to the 173 00:06:10,220 --> 00:06:12,409 VM to the route execution mode. 174 00:06:12,410 --> 00:06:14,839 And the VM entry is the opposite 175 00:06:14,840 --> 00:06:16,909 transition from the execution mode to the 176 00:06:16,910 --> 00:06:17,910 guest. 177 00:06:18,390 --> 00:06:20,479 Now, the one of the key 178 00:06:20,480 --> 00:06:22,159 points here is that the build method I 179 00:06:22,160 --> 00:06:24,319 feel Viso has to virtualized every 180 00:06:24,320 --> 00:06:26,479 access to the Alphaville, so basically it 181 00:06:26,480 --> 00:06:28,159 is emulating all the Alphaville 182 00:06:28,160 --> 00:06:30,979 accesses, and 183 00:06:30,980 --> 00:06:32,569 this means that it needs. 184 00:06:32,570 --> 00:06:34,669 This creates a very large attack surface 185 00:06:34,670 --> 00:06:36,559 on the actual virtualization 186 00:06:36,560 --> 00:06:38,179 implementation. 187 00:06:38,180 --> 00:06:41,059 Next up, we have the type two hypervisor, 188 00:06:41,060 --> 00:06:42,949 so type two, I believe ISOs. 189 00:06:42,950 --> 00:06:44,539 Basically, I fill vessels that are 190 00:06:44,540 --> 00:06:46,879 executing inside the operating system. 191 00:06:46,880 --> 00:06:49,009 If Typekit type one is things like the 192 00:06:49,010 --> 00:06:51,079 only a six, if you are familiar with the 193 00:06:51,080 --> 00:06:53,539 wild type two is things 194 00:06:53,540 --> 00:06:55,739 like VMware 195 00:06:55,740 --> 00:06:57,829 Player, which executes in the 196 00:06:57,830 --> 00:06:59,420 same manner similar to a program. 197 00:07:00,920 --> 00:07:03,259 And we have a guest of 198 00:07:03,260 --> 00:07:05,389 the processes, the guest operating system 199 00:07:05,390 --> 00:07:07,759 executing above the VM that is inside 200 00:07:07,760 --> 00:07:08,749 the office. 201 00:07:08,750 --> 00:07:10,610 Now the interesting thing here is that 202 00:07:11,660 --> 00:07:14,329 the this type of virtualization 203 00:07:14,330 --> 00:07:16,459 engine is actually using the 204 00:07:17,510 --> 00:07:19,609 drivers of the operating system to 205 00:07:19,610 --> 00:07:21,649 interface with the audio, which means 206 00:07:21,650 --> 00:07:23,929 that the request, for example, to draw 207 00:07:23,930 --> 00:07:26,059 on the screen from the guest operating 208 00:07:26,060 --> 00:07:28,369 system or to access the graphics card 209 00:07:28,370 --> 00:07:30,619 pursued the VM to the host operating 210 00:07:30,620 --> 00:07:32,779 system, which makes this which 211 00:07:32,780 --> 00:07:33,979 creates a different attack. 212 00:07:33,980 --> 00:07:36,709 Surface of the actual communication. 213 00:07:36,710 --> 00:07:39,079 Some sort of some of the in some cases 214 00:07:39,080 --> 00:07:41,269 these are actually use what's called 215 00:07:41,270 --> 00:07:43,729 of virtualized drivers, which are drivers 216 00:07:43,730 --> 00:07:45,439 that are aware that they are running into 217 00:07:45,440 --> 00:07:47,329 virtualization environment and are 218 00:07:47,330 --> 00:07:50,059 calling directly to the OS, 219 00:07:50,060 --> 00:07:50,629 which 220 00:07:50,630 --> 00:07:52,759 naturally creates a whole 221 00:07:52,760 --> 00:07:53,760 new attack surface 222 00:07:55,580 --> 00:07:56,580 to quite. 223 00:07:59,820 --> 00:08:00,719 I stayed with me. 224 00:08:00,720 --> 00:08:02,219 Good, good. 225 00:08:02,220 --> 00:08:04,319 Let's see which Fulghum is this 226 00:08:04,320 --> 00:08:05,850 one the one I'm pointing at? 227 00:08:07,650 --> 00:08:08,219 Come on. 228 00:08:08,220 --> 00:08:10,329 One guy I who said 229 00:08:10,330 --> 00:08:11,330 this. 230 00:08:11,820 --> 00:08:13,259 Well done. 231 00:08:13,260 --> 00:08:15,239 OK, now you always me. 232 00:08:15,240 --> 00:08:16,380 Let's go. Let's move on. 233 00:08:18,930 --> 00:08:21,269 OK, so 234 00:08:21,270 --> 00:08:23,219 as I mentioned, a lot of challenges when 235 00:08:23,220 --> 00:08:25,349 you want to emulate the diet or the 236 00:08:25,350 --> 00:08:27,749 inspections that the architecture 237 00:08:27,750 --> 00:08:29,519 and the venom needs to emulate every 238 00:08:29,520 --> 00:08:32,158 instructional event that it registers on. 239 00:08:32,159 --> 00:08:35,209 So the 240 00:08:35,210 --> 00:08:38,009 FEMA must register to certain events. 241 00:08:38,010 --> 00:08:40,168 It's not the same in every virtualization 242 00:08:40,169 --> 00:08:41,849 architecture, but I'm talking about the 243 00:08:41,850 --> 00:08:42,779 Intel architecture. 244 00:08:42,780 --> 00:08:44,699 That's what I know is, as I told you 245 00:08:44,700 --> 00:08:47,199 earlier and in interactive 246 00:08:47,200 --> 00:08:48,389 texture there, the things that I'll call 247 00:08:48,390 --> 00:08:50,459 the fix. The one exits events that 248 00:08:50,460 --> 00:08:52,889 the VMS has to exit on. 249 00:08:52,890 --> 00:08:54,659 It has no choice about this. 250 00:08:54,660 --> 00:08:56,669 In addition to this, in any case that you 251 00:08:56,670 --> 00:08:58,799 have other additional events that 252 00:08:58,800 --> 00:09:01,259 you want to actually visualize, 253 00:09:01,260 --> 00:09:03,059 then you need to exit on those as well. 254 00:09:04,170 --> 00:09:06,329 So there are lots of challenges when 255 00:09:06,330 --> 00:09:08,489 you come to actually emulate the ISA. 256 00:09:08,490 --> 00:09:10,769 First off, you get the problem 257 00:09:10,770 --> 00:09:12,239 that you need to know the exact 258 00:09:12,240 --> 00:09:14,709 specification as any of you open 259 00:09:14,710 --> 00:09:15,710 the the 260 00:09:17,160 --> 00:09:18,059 stuff to. 261 00:09:18,060 --> 00:09:19,499 Well done, guys. 262 00:09:19,500 --> 00:09:21,779 Just for paying attention. 263 00:09:21,780 --> 00:09:22,780 It was one. 264 00:09:24,900 --> 00:09:27,359 Anyways, the interest there 265 00:09:27,360 --> 00:09:29,519 is like seven eight thousand 266 00:09:29,520 --> 00:09:31,289 pages they think now. 267 00:09:31,290 --> 00:09:33,269 And while the instructions are still 268 00:09:33,270 --> 00:09:35,759 fairly documented in the one place 269 00:09:36,990 --> 00:09:39,209 architectural invents sets into 270 00:09:39,210 --> 00:09:41,549 lots of other events 271 00:09:41,550 --> 00:09:43,319 documented that you have to read the 272 00:09:43,320 --> 00:09:45,209 entire manual to actually know how they 273 00:09:45,210 --> 00:09:47,279 work. And even then, it's uncertain 274 00:09:47,280 --> 00:09:49,289 that you will get the actual description. 275 00:09:49,290 --> 00:09:51,449 So specification is not very simple, and 276 00:09:51,450 --> 00:09:53,309 then turning the corner cases is 277 00:09:53,310 --> 00:09:54,310 very hard, 278 00:09:55,650 --> 00:09:57,869 deciding if the guess there is 279 00:09:57,870 --> 00:10:00,059 the right privilege from a lot of places 280 00:10:00,060 --> 00:10:01,439 and is also fairly complex. 281 00:10:01,440 --> 00:10:03,839 And this leads us to the situations 282 00:10:03,840 --> 00:10:05,609 which I'll call the confused deputy. 283 00:10:05,610 --> 00:10:07,709 Well, you actually have multiple mission 284 00:10:07,710 --> 00:10:08,849 in the vote operation. 285 00:10:08,850 --> 00:10:11,009 Then the guest would have had if you did 286 00:10:11,010 --> 00:10:13,079 it normally and you do an action on 287 00:10:13,080 --> 00:10:15,719 behalf of the guest, that is to 288 00:10:15,720 --> 00:10:17,849 do much. And that's the reason for 289 00:10:17,850 --> 00:10:19,949 this guy over the top there. 290 00:10:19,950 --> 00:10:22,109 That is definitely a confused 291 00:10:22,110 --> 00:10:23,110 deputy. 292 00:10:26,340 --> 00:10:28,919 OK, so what's 293 00:10:28,920 --> 00:10:29,319 next? 294 00:10:29,320 --> 00:10:31,889 Often when we talk about software stacks, 295 00:10:31,890 --> 00:10:33,659 one part of the self-heal stack that we 296 00:10:33,660 --> 00:10:35,969 didn't discuss yet was the 297 00:10:35,970 --> 00:10:38,129 system management Model S admin 298 00:10:38,130 --> 00:10:40,259 system management mode actually runs in 299 00:10:40,260 --> 00:10:42,809 parallel to the other 300 00:10:42,810 --> 00:10:44,639 operating modes in the machine. 301 00:10:44,640 --> 00:10:47,219 So that means that while you're executing 302 00:10:47,220 --> 00:10:49,079 at any given moment or ideally all 303 00:10:49,080 --> 00:10:51,149 intrinsically the zero or 304 00:10:51,150 --> 00:10:53,859 in the virtual machine monitor itself, 305 00:10:53,860 --> 00:10:56,489 an SMI interlocked 306 00:10:56,490 --> 00:10:58,799 which is the the interrupted 307 00:10:58,800 --> 00:11:00,509 causes transition to the system 308 00:11:00,510 --> 00:11:03,899 management mode could happen, and 309 00:11:03,900 --> 00:11:06,089 this creates an attack surface. 310 00:11:06,090 --> 00:11:08,069 For example, the same cache poisoning 311 00:11:08,070 --> 00:11:10,469 attacks that will allow 312 00:11:10,470 --> 00:11:13,259 about seven eight years back. 313 00:11:13,260 --> 00:11:15,359 Well, basically this type of attacks 314 00:11:15,360 --> 00:11:17,039 that in particular within the guest 315 00:11:17,040 --> 00:11:19,439 operating system could do to infect 316 00:11:19,440 --> 00:11:20,699 the smell. 317 00:11:20,700 --> 00:11:22,109 Now the interesting thing about this, 318 00:11:22,110 --> 00:11:24,249 Amum, is that while the 319 00:11:24,250 --> 00:11:26,429 estimate as unlimited access 320 00:11:26,430 --> 00:11:28,799 to everything on the right hand side 321 00:11:28,800 --> 00:11:30,149 or left hand side from your 322 00:11:30,150 --> 00:11:32,879 point of view, wherever 323 00:11:32,880 --> 00:11:33,880 the 324 00:11:35,370 --> 00:11:36,479 the 325 00:11:36,480 --> 00:11:38,759 the virtual machine monitor or any 326 00:11:38,760 --> 00:11:40,559 code that is executing on the other side 327 00:11:40,560 --> 00:11:42,719 can't access code that is executing in 328 00:11:42,720 --> 00:11:43,679 this amp. 329 00:11:43,680 --> 00:11:46,109 So basically, if you in fact that simple, 330 00:11:46,110 --> 00:11:48,509 you can infect anything until 331 00:11:48,510 --> 00:11:50,789 now, what you should be asking 332 00:11:50,790 --> 00:11:52,859 me is if this is such a big 333 00:11:52,860 --> 00:11:54,659 problem, why isn't there a way to 334 00:11:54,660 --> 00:11:56,729 visualize this simple 335 00:11:56,730 --> 00:11:57,730 right? 336 00:11:58,230 --> 00:11:59,759 Should this should be a way to visualize 337 00:11:59,760 --> 00:12:01,109 this event? 338 00:12:01,110 --> 00:12:03,179 So the answer is there is a way to 339 00:12:03,180 --> 00:12:04,200 visualize this amount. 340 00:12:05,280 --> 00:12:07,889 It is called an transfer money monitor 341 00:12:07,890 --> 00:12:10,379 or dual monitor or parallel monitor 342 00:12:10,380 --> 00:12:12,570 or whatever you want to call it, monitor. 343 00:12:13,710 --> 00:12:16,139 And basically, 344 00:12:16,140 --> 00:12:19,139 it is meant to be used to virtualized 345 00:12:19,140 --> 00:12:20,979 the system management mode. 346 00:12:20,980 --> 00:12:23,069 Unfortunately, as any of you heard about 347 00:12:23,070 --> 00:12:25,169 it in use in practice, 348 00:12:26,310 --> 00:12:28,829 I can tell you that I know of one 349 00:12:29,910 --> 00:12:32,009 little government agency that is using 350 00:12:32,010 --> 00:12:33,299 it, 351 00:12:33,300 --> 00:12:34,349 and 352 00:12:34,350 --> 00:12:36,449 no other organization that I've heard 353 00:12:36,450 --> 00:12:38,829 of is actually using 354 00:12:38,830 --> 00:12:40,829 a small SDM. 355 00:12:42,090 --> 00:12:44,549 The interesting one other interesting 356 00:12:44,550 --> 00:12:46,619 quick about this time is that the 357 00:12:46,620 --> 00:12:48,149 people that are actually meant to 358 00:12:48,150 --> 00:12:50,219 implement the system, 359 00:12:50,220 --> 00:12:52,449 the the transfer money through 360 00:12:52,450 --> 00:12:54,539 this part, the virtualization for 361 00:12:54,540 --> 00:12:56,789 some of the hardware 362 00:12:56,790 --> 00:12:58,859 vendors, the Dell. 363 00:12:58,860 --> 00:13:00,949 Ms. Dell and Samsung and 364 00:13:00,950 --> 00:13:02,599 whoever will be on Sunday and whoever 365 00:13:02,600 --> 00:13:05,269 builds your computer, not the 366 00:13:05,270 --> 00:13:07,879 not the world that is making the women 367 00:13:07,880 --> 00:13:10,159 and there and so it creates a whole 368 00:13:10,160 --> 00:13:11,689 new complexity because they need to 369 00:13:11,690 --> 00:13:13,669 decide on the interface the system is 370 00:13:13,670 --> 00:13:16,429 docking with the VM and vice versa. 371 00:13:16,430 --> 00:13:18,649 So this is a very complex 372 00:13:18,650 --> 00:13:20,419 architecture that doesn't really work and 373 00:13:20,420 --> 00:13:22,879 this is just not virtualized. 374 00:13:22,880 --> 00:13:24,919 And we all hope that nobody has a way to 375 00:13:24,920 --> 00:13:26,029 hack into us and them. 376 00:13:26,030 --> 00:13:28,309 Otherwise, virtualization security 377 00:13:28,310 --> 00:13:29,310 is gone. 378 00:13:31,070 --> 00:13:33,349 OK, one last point and this 379 00:13:33,350 --> 00:13:34,909 section is there. 380 00:13:34,910 --> 00:13:37,189 The micro VMS Michael is 381 00:13:37,190 --> 00:13:38,899 something that is becoming more and more 382 00:13:38,900 --> 00:13:40,429 popular recently. 383 00:13:41,480 --> 00:13:43,249 And the interesting thing about Michael 384 00:13:43,250 --> 00:13:45,319 VMs is that what they 385 00:13:45,320 --> 00:13:47,479 do is they sit underneath 386 00:13:47,480 --> 00:13:50,329 the operating system and they 387 00:13:50,330 --> 00:13:51,799 allow the guest. 388 00:13:51,800 --> 00:13:53,959 They allow the guest operating system to 389 00:13:53,960 --> 00:13:55,699 communicate directly with the well, 390 00:13:55,700 --> 00:13:57,109 what's the redlines? 391 00:13:57,110 --> 00:13:59,299 Was? Well, at the same time, they are 392 00:13:59,300 --> 00:14:01,399 capturing certain and minimized set 393 00:14:01,400 --> 00:14:03,529 of events that they have to, 394 00:14:03,530 --> 00:14:05,179 which are the green lines. 395 00:14:05,180 --> 00:14:07,789 Now, Michael Venom's, they'll use it for 396 00:14:07,790 --> 00:14:09,859 various tasks, but the most 397 00:14:09,860 --> 00:14:11,209 common one is security. 398 00:14:11,210 --> 00:14:13,459 One strong example for this would 399 00:14:13,460 --> 00:14:15,649 be the McAfee Deep Safe and McAfee 400 00:14:15,650 --> 00:14:18,319 Intel Corporation that is actually 401 00:14:18,320 --> 00:14:21,019 used to T2 402 00:14:21,020 --> 00:14:23,359 security protections until 403 00:14:23,360 --> 00:14:25,220 rootkit. And this type of stuff 404 00:14:26,630 --> 00:14:28,699 on the CPU problem is, 405 00:14:28,700 --> 00:14:31,039 if you actually get to one inside 406 00:14:31,040 --> 00:14:33,259 the guest kernel mode, once 407 00:14:33,260 --> 00:14:35,029 you can access the outwell, you can 408 00:14:35,030 --> 00:14:37,549 fairly easily subvert 409 00:14:37,550 --> 00:14:40,009 the VMA and will get to why? 410 00:14:40,010 --> 00:14:42,739 Why this is a bit later. 411 00:14:42,740 --> 00:14:44,090 But this is the general idea. 412 00:14:45,500 --> 00:14:47,689 So just to summarize this section, 413 00:14:47,690 --> 00:14:49,189 there are many ways to resolve the 414 00:14:49,190 --> 00:14:50,699 virtualization technology. 415 00:14:50,700 --> 00:14:53,119 Type one, Type two Michael Vietnams 416 00:14:53,120 --> 00:14:55,129 You could follow virtualized or not power 417 00:14:55,130 --> 00:14:57,349 virtualized each approach 418 00:14:57,350 --> 00:14:59,989 as its own unique challenges. 419 00:14:59,990 --> 00:15:01,939 If you do a full out of the transition, 420 00:15:01,940 --> 00:15:03,739 you need to secure a big implementation 421 00:15:03,740 --> 00:15:05,959 of software emulation for all 422 00:15:05,960 --> 00:15:07,759 the that you'll emulating. 423 00:15:07,760 --> 00:15:09,739 If you are doing thorough virtualization, 424 00:15:09,740 --> 00:15:11,659 you need this. You created an interface 425 00:15:11,660 --> 00:15:13,819 between the guest operating system and 426 00:15:13,820 --> 00:15:15,469 the operating system, so you need to 427 00:15:15,470 --> 00:15:17,779 secure it if you 428 00:15:17,780 --> 00:15:19,759 read it. Regardless which implementation 429 00:15:19,760 --> 00:15:21,919 you picked, you need to emulate 430 00:15:21,920 --> 00:15:24,109 the ISO correctly, which is a dick and 431 00:15:24,110 --> 00:15:26,509 securely, which means no confuse 432 00:15:26,510 --> 00:15:28,279 deputy type of situations. 433 00:15:28,280 --> 00:15:30,589 And finally, when you create 434 00:15:30,590 --> 00:15:32,659 a micro VM, you have to defend 435 00:15:32,660 --> 00:15:35,239 from models of the vision without 436 00:15:35,240 --> 00:15:37,759 going into full out emulation, 437 00:15:37,760 --> 00:15:39,889 which is really a problem. 438 00:15:39,890 --> 00:15:41,819 And finally, as members do many 439 00:15:41,820 --> 00:15:43,909 privileges and there are no SD 440 00:15:43,910 --> 00:15:44,910 Ms. 441 00:15:45,620 --> 00:15:47,689 OK, so moving on, we 442 00:15:47,690 --> 00:15:50,269 are going to talk about memory 443 00:15:50,270 --> 00:15:51,019 and 444 00:15:51,020 --> 00:15:53,239 everybody in this room or most 445 00:15:53,240 --> 00:15:55,639 of our guests and know what our computer 446 00:15:55,640 --> 00:15:56,689 memory works. 447 00:15:56,690 --> 00:15:58,639 You have an address value. 448 00:15:58,640 --> 00:16:00,080 It's a very, very simple light. 449 00:16:03,370 --> 00:16:05,689 I got one address x 450 00:16:05,690 --> 00:16:06,690 value y. 451 00:16:08,300 --> 00:16:10,349 This is the diagram that describes the 452 00:16:10,350 --> 00:16:12,169 the first diagram in the entire manual 453 00:16:12,170 --> 00:16:13,940 that describes how memory works. 454 00:16:15,590 --> 00:16:18,019 This is less user friendly, I think. 455 00:16:19,340 --> 00:16:22,399 So what this diagram actually says? 456 00:16:22,400 --> 00:16:24,469 Let me show you a few highlights. 457 00:16:24,470 --> 00:16:27,019 First off, we have the Dell 458 00:16:27,020 --> 00:16:29,029 called Quantum, which is top of memory or 459 00:16:29,030 --> 00:16:29,949 the size of the deal. 460 00:16:29,950 --> 00:16:32,119 And then if we just 461 00:16:32,120 --> 00:16:34,789 look around, do you get the April-May, 462 00:16:34,790 --> 00:16:36,739 which you don't know what it is, but it 463 00:16:36,740 --> 00:16:38,869 is a stolen range used for the chips that 464 00:16:38,870 --> 00:16:41,239 the information and journal 465 00:16:41,240 --> 00:16:43,609 goes as chips that the 466 00:16:43,610 --> 00:16:45,999 memory chips that fill 467 00:16:46,000 --> 00:16:47,269 a memory silly. 468 00:16:47,270 --> 00:16:49,849 I had a problem that anyways. 469 00:16:49,850 --> 00:16:52,639 And then you get the 470 00:16:52,640 --> 00:16:54,769 all different areas like the 471 00:16:54,770 --> 00:16:56,869 always visible range that is over 472 00:16:56,870 --> 00:16:58,129 64 gigabytes. 473 00:16:58,130 --> 00:16:59,629 You get this interesting thing. 474 00:16:59,630 --> 00:17:01,849 This line, obviously, anybody knows 475 00:17:01,850 --> 00:17:02,869 what this legion is. 476 00:17:04,730 --> 00:17:06,979 This is the claim legion, the region 477 00:17:06,980 --> 00:17:08,419 that is rumored. 478 00:17:08,420 --> 00:17:10,608 If you remember back when you walked on 479 00:17:10,609 --> 00:17:12,409 the Intel database. 480 00:17:12,410 --> 00:17:14,629 You had a limited amount of memory 481 00:17:14,630 --> 00:17:16,219 that if you bought Molly, you didn't 482 00:17:16,220 --> 00:17:18,318 actually get much of a memory for your 483 00:17:18,319 --> 00:17:19,319 CPU. 484 00:17:20,060 --> 00:17:22,409 The reason for this is this claim this 485 00:17:22,410 --> 00:17:24,649 range that cannot be accessed by a normal 486 00:17:24,650 --> 00:17:25,650 operating system. 487 00:17:27,260 --> 00:17:29,059 Maybe I should explain this a bit better 488 00:17:29,060 --> 00:17:30,799 because I skipped the one part of the 489 00:17:30,800 --> 00:17:33,529 explanation left inside represents 490 00:17:33,530 --> 00:17:36,499 our discipline is the physical memory 491 00:17:36,500 --> 00:17:38,989 on the right hand side of a hill. 492 00:17:38,990 --> 00:17:41,059 What you see is the way the 493 00:17:41,060 --> 00:17:43,279 delinquent, what the actual values that 494 00:17:43,280 --> 00:17:45,380 are stored in your DRAM chip. 495 00:17:46,790 --> 00:17:49,129 So what happens is 496 00:17:49,130 --> 00:17:51,409 that memory that is accessed 497 00:17:51,410 --> 00:17:53,539 at this address is actually stored on 498 00:17:53,540 --> 00:17:54,829 the deal at a different 499 00:17:54,830 --> 00:17:55,830 address 500 00:17:56,750 --> 00:17:57,939 causing. 501 00:17:57,940 --> 00:17:59,949 Station, this translation was used when 502 00:17:59,950 --> 00:18:02,169 it was not locked to break 503 00:18:02,170 --> 00:18:03,669 virtualization systems because you're 504 00:18:03,670 --> 00:18:05,979 just the guest remembers 505 00:18:05,980 --> 00:18:07,329 some of its memory. 506 00:18:07,330 --> 00:18:09,489 Two points to memory that the VM is 507 00:18:09,490 --> 00:18:11,679 actually residing in and then over 508 00:18:11,680 --> 00:18:13,629 to the VM. Call it the data. 509 00:18:13,630 --> 00:18:16,569 And that's why the exploit that the VML. 510 00:18:16,570 --> 00:18:18,639 So nowadays there is a lock register that 511 00:18:18,640 --> 00:18:20,319 is supposed to be used to prevent 512 00:18:20,320 --> 00:18:22,299 changing this after this is configured, 513 00:18:23,410 --> 00:18:25,779 assuming it is actually locked. 514 00:18:25,780 --> 00:18:27,849 I suggest everybody reveals the 515 00:18:27,850 --> 00:18:28,850 bias and check. 516 00:18:29,670 --> 00:18:30,670 Oh, 517 00:18:32,010 --> 00:18:32,469 OK. 518 00:18:32,470 --> 00:18:34,719 So and finally, you get some really, 519 00:18:34,720 --> 00:18:35,979 really weird ranges. 520 00:18:35,980 --> 00:18:38,109 If there's anybody in this room that 521 00:18:38,110 --> 00:18:40,179 is able to come on stage and say, 522 00:18:40,180 --> 00:18:41,739 what type is 523 00:18:43,270 --> 00:18:45,129 then my guest, I 524 00:18:45,130 --> 00:18:45,369 really 525 00:18:45,370 --> 00:18:47,259 want to hear because 526 00:18:47,260 --> 00:18:48,919 there are lots of secret trenches and 527 00:18:48,920 --> 00:18:50,169 undocumented dangers. 528 00:18:50,170 --> 00:18:52,299 And this one I found only one intel 529 00:18:52,300 --> 00:18:54,579 manual or tool, and somebody 530 00:18:54,580 --> 00:18:55,580 has to tell me 531 00:18:58,120 --> 00:18:58,989 anyways. 532 00:18:58,990 --> 00:18:59,990 So moving on, 533 00:19:01,200 --> 00:19:03,309 a dozen installations are actually even 534 00:19:03,310 --> 00:19:05,529 more complex than there we discussed 535 00:19:05,530 --> 00:19:07,779 so far because what do we get 536 00:19:07,780 --> 00:19:10,299 is we get actually 537 00:19:10,300 --> 00:19:12,459 there at least 538 00:19:12,460 --> 00:19:14,589 three different translations in 539 00:19:14,590 --> 00:19:16,869 a healthy virtualization 540 00:19:16,870 --> 00:19:18,799 system and this translation. 541 00:19:18,800 --> 00:19:21,399 So first, the paging translation 542 00:19:21,400 --> 00:19:23,499 page servers, which take a 543 00:19:23,500 --> 00:19:25,209 certain Edlis and convert it to a 544 00:19:25,210 --> 00:19:26,439 different edits. 545 00:19:26,440 --> 00:19:28,689 Then we get the interest 546 00:19:28,690 --> 00:19:30,939 came up and said, Oh, Beijing is great, 547 00:19:30,940 --> 00:19:33,069 let's do extended page stable, which is 548 00:19:33,070 --> 00:19:35,589 basically another level of paging 549 00:19:35,590 --> 00:19:37,449 because that's great, right? 550 00:19:37,450 --> 00:19:38,919 We like it. So. 551 00:19:38,920 --> 00:19:39,920 Mm hmm. 552 00:19:40,180 --> 00:19:42,879 So we do again at Beijing translation. 553 00:19:42,880 --> 00:19:45,009 And then if we're unlucky, we fall on 554 00:19:45,010 --> 00:19:47,119 a certain special regional decline 555 00:19:47,120 --> 00:19:49,179 region and other 556 00:19:49,180 --> 00:19:51,249 memory access is actually redirected to 557 00:19:51,250 --> 00:19:52,539 somewhere else. 558 00:19:52,540 --> 00:19:54,969 So basically, memory 559 00:19:54,970 --> 00:19:56,319 is not simple. 560 00:19:56,320 --> 00:19:58,149 And this is even before I started talking 561 00:19:58,150 --> 00:20:00,429 about cache and how such 562 00:20:00,430 --> 00:20:02,229 as in the case of being made before you 563 00:20:02,230 --> 00:20:03,339 actually access the dealer 564 00:20:03,340 --> 00:20:04,340 like 565 00:20:05,410 --> 00:20:07,599 the extended page developer, I say 566 00:20:07,600 --> 00:20:08,559 another word about it. 567 00:20:08,560 --> 00:20:10,149 It's actually a very useful feature of 568 00:20:10,150 --> 00:20:11,949 the extended page. David is a feature 569 00:20:11,950 --> 00:20:13,599 that allows the virtualization 570 00:20:13,600 --> 00:20:15,759 environment to 571 00:20:15,760 --> 00:20:18,369 virtualized the the accesses 572 00:20:18,370 --> 00:20:20,629 that the guest operating system. 573 00:20:20,630 --> 00:20:22,629 Susan's already reached the physical 574 00:20:22,630 --> 00:20:24,849 memory, which means that when the guest 575 00:20:24,850 --> 00:20:27,279 operating system sinks that it's done, 576 00:20:27,280 --> 00:20:29,349 the virtual machine monitor can 577 00:20:29,350 --> 00:20:31,569 actually make a decision if this access 578 00:20:31,570 --> 00:20:33,789 is right for it or not. 579 00:20:33,790 --> 00:20:35,679 Or, well, is it going well? 580 00:20:35,680 --> 00:20:37,599 Does it once the access to go to? 581 00:20:37,600 --> 00:20:39,309 So it's a very useful feature when you 582 00:20:39,310 --> 00:20:41,229 want to secure something, but it's very, 583 00:20:41,230 --> 00:20:43,239 very it adds a lot of complexity to the 584 00:20:43,240 --> 00:20:45,339 system, as you can see on the screen, 585 00:20:45,340 --> 00:20:46,450 which is kind of scary. 586 00:20:47,620 --> 00:20:49,749 So when you actually 587 00:20:49,750 --> 00:20:51,999 want to make a memory 588 00:20:52,000 --> 00:20:54,489 access, the what 589 00:20:54,490 --> 00:20:56,739 actually happens, there are several 590 00:20:56,740 --> 00:20:58,299 types of memory accesses. 591 00:20:58,300 --> 00:21:00,759 So the Green Line in this diagram 592 00:21:00,760 --> 00:21:02,889 represents an excess that is made from 593 00:21:02,890 --> 00:21:05,469 the CPU directly to the 594 00:21:05,470 --> 00:21:07,569 dilemma of the 595 00:21:07,570 --> 00:21:08,709 dual them chip, right? 596 00:21:10,560 --> 00:21:12,759 And this is the simple one 597 00:21:12,760 --> 00:21:15,039 what happens when you have the filter 598 00:21:15,040 --> 00:21:17,229 line, when the CPU, the X 599 00:21:17,230 --> 00:21:18,279 is a device? 600 00:21:18,280 --> 00:21:20,619 This is what's called memory methyl 601 00:21:20,620 --> 00:21:22,329 or the security situation. 602 00:21:22,330 --> 00:21:24,399 Will you have a range 603 00:21:24,400 --> 00:21:26,829 of addresses in memory and 604 00:21:26,830 --> 00:21:28,329 will get to it in the next slide a bit 605 00:21:28,330 --> 00:21:29,409 more? 606 00:21:29,410 --> 00:21:31,479 That is actually not used as 607 00:21:31,480 --> 00:21:32,619 part of the deal. 608 00:21:32,620 --> 00:21:34,719 It is redirected to 609 00:21:34,720 --> 00:21:36,639 one of your other devices, whether it's 610 00:21:36,640 --> 00:21:38,949 an integrated device like the PC 611 00:21:38,950 --> 00:21:41,679 or something inside the PC or the CPU, 612 00:21:41,680 --> 00:21:43,749 or an external device like your wireless 613 00:21:43,750 --> 00:21:45,819 LAN card, for example, or whatever 614 00:21:45,820 --> 00:21:46,820 else. 615 00:21:47,650 --> 00:21:48,789 And finally, 616 00:21:48,790 --> 00:21:51,069 a device might make a memory access, 617 00:21:51,070 --> 00:21:53,169 and this is the yellow line and this is 618 00:21:53,170 --> 00:21:55,269 what's called the direct memory access 619 00:21:55,270 --> 00:21:56,289 dmay. 620 00:21:56,290 --> 00:21:58,419 And what's also interesting to 621 00:21:58,420 --> 00:22:00,969 note is that since some devices 622 00:22:00,970 --> 00:22:03,309 are nowadays integrated in the CPU 623 00:22:03,310 --> 00:22:05,699 and the CPU as a way to directly connect 624 00:22:05,700 --> 00:22:06,700 to it, 625 00:22:07,450 --> 00:22:07,839 the 626 00:22:07,840 --> 00:22:09,909 PCI devices, this is called 627 00:22:09,910 --> 00:22:11,869 persistently nice graphics OPG 628 00:22:12,870 --> 00:22:13,899 and then 629 00:22:13,900 --> 00:22:15,969 actually requests from devices could 630 00:22:15,970 --> 00:22:18,309 come along the big blue line instead 631 00:22:18,310 --> 00:22:20,589 of along the Big Red Line. 632 00:22:20,590 --> 00:22:22,380 And in either case, 633 00:22:23,740 --> 00:22:25,869 and in all of these accesses must be 634 00:22:25,870 --> 00:22:28,239 monitored. Do not actually allow 635 00:22:28,240 --> 00:22:30,549 a guest to access either 636 00:22:30,550 --> 00:22:31,239 reconfigure 637 00:22:31,240 --> 00:22:32,799 hardware or 638 00:22:32,800 --> 00:22:35,259 overwrite the if anything, 639 00:22:35,260 --> 00:22:37,629 that is critical for the VMS security, 640 00:22:37,630 --> 00:22:39,969 whether it's called thato structures 641 00:22:39,970 --> 00:22:41,199 that the film is relying 642 00:22:41,200 --> 00:22:42,200 on. 643 00:22:43,270 --> 00:22:46,059 OK, so 644 00:22:46,060 --> 00:22:49,179 the green highlighted areas 645 00:22:49,180 --> 00:22:51,579 of the MMI your memory 646 00:22:51,580 --> 00:22:53,019 map to your regions. 647 00:22:53,020 --> 00:22:55,269 So basically in this diagram you get to 648 00:22:55,270 --> 00:22:57,329 which is good because this is not 649 00:22:57,330 --> 00:22:58,330 to. 650 00:23:01,060 --> 00:23:03,549 But the ceiling looks like this. 651 00:23:03,550 --> 00:23:06,729 Everything that is N.M. 652 00:23:06,730 --> 00:23:08,959 should be if it's below four gigabytes, 653 00:23:08,960 --> 00:23:11,199 so it should be the last range before 654 00:23:11,200 --> 00:23:13,929 four gigabytes memory a boundary 655 00:23:13,930 --> 00:23:16,089 or if it's 64 gigabytes, it should 656 00:23:16,090 --> 00:23:17,439 be the top of memory. 657 00:23:17,440 --> 00:23:19,269 This is the theory that Intel wants you 658 00:23:19,270 --> 00:23:21,549 to follow AMD the 659 00:23:21,550 --> 00:23:23,739 and I'm assuming that as something 660 00:23:23,740 --> 00:23:24,740 similar, 661 00:23:25,840 --> 00:23:26,259 but 662 00:23:26,260 --> 00:23:27,609 the reality is different. 663 00:23:27,610 --> 00:23:29,799 The reality is that you 664 00:23:29,800 --> 00:23:30,939 can configure 665 00:23:30,940 --> 00:23:32,639 a MMI 666 00:23:32,640 --> 00:23:34,809 MMO wenches are configured based on the 667 00:23:34,810 --> 00:23:37,029 registers at the base of the 668 00:23:37,030 --> 00:23:38,619 registers when you can. 669 00:23:38,620 --> 00:23:40,749 Once you configure the base of the 670 00:23:40,750 --> 00:23:42,909 register of any device, 671 00:23:42,910 --> 00:23:45,009 you can put any value in there and 672 00:23:45,010 --> 00:23:47,529 you can just decide to configure it. 673 00:23:47,530 --> 00:23:50,079 For example, right, you 674 00:23:50,080 --> 00:23:52,119 disagreed. Disagree that SIM resides 675 00:23:52,120 --> 00:23:54,249 right on the for, let's say, on 676 00:23:54,250 --> 00:23:56,079 the first megabyte of the memory of your 677 00:23:56,080 --> 00:23:58,540 machine to drive crazy or both. 678 00:24:00,040 --> 00:24:02,199 You can configure it 679 00:24:02,200 --> 00:24:04,689 anywhere you like, basically. 680 00:24:04,690 --> 00:24:06,879 And this gives gives you an 681 00:24:06,880 --> 00:24:08,619 opening to create some interesting 682 00:24:08,620 --> 00:24:10,719 attacks. If you have access 683 00:24:10,720 --> 00:24:12,849 to reconfigure the bell 684 00:24:12,850 --> 00:24:15,189 register because you can just make 685 00:24:15,190 --> 00:24:17,789 it overlap anything you like and 686 00:24:17,790 --> 00:24:19,929 that let's say I send the 687 00:24:19,930 --> 00:24:22,509 let's say my memory map television 688 00:24:22,510 --> 00:24:24,849 is actually representing the last Typekit 689 00:24:24,850 --> 00:24:27,039 my eta on. It's called the saved right. 690 00:24:27,040 --> 00:24:29,049 So I know the value is there because I'm 691 00:24:29,050 --> 00:24:30,669 I don't know pinging it, though sending 692 00:24:30,670 --> 00:24:32,079 packets to it right? 693 00:24:32,080 --> 00:24:34,149 And at the same time, I may I change 694 00:24:34,150 --> 00:24:35,109 the the place. 695 00:24:35,110 --> 00:24:37,179 It is the base of this register to 696 00:24:37,180 --> 00:24:40,359 make it overlap the code form. 697 00:24:40,360 --> 00:24:42,819 I don't know what the VM and 698 00:24:42,820 --> 00:24:44,679 the code of my hypervisor. 699 00:24:44,680 --> 00:24:46,839 So at this moment, it 700 00:24:46,840 --> 00:24:48,759 will run from the code that is actually 701 00:24:48,760 --> 00:24:51,369 the last packets that arrive to the 702 00:24:51,370 --> 00:24:53,709 to the to to the 703 00:24:53,710 --> 00:24:54,710 Ethernet guard 704 00:24:56,650 --> 00:24:58,209 who understood me because they are too 705 00:24:58,210 --> 00:24:59,210 quiet. 706 00:24:59,890 --> 00:25:01,570 OK. So we can move on 707 00:25:02,680 --> 00:25:03,680 little 708 00:25:04,930 --> 00:25:06,699 those that didn't ask the guy instead 709 00:25:06,700 --> 00:25:07,869 next to you after the talk? 710 00:25:10,330 --> 00:25:11,769 OK. 711 00:25:11,770 --> 00:25:14,199 So in 712 00:25:14,200 --> 00:25:16,269 addition to having the memo and 713 00:25:16,270 --> 00:25:18,639 reptile, we have special 714 00:25:18,640 --> 00:25:20,869 guest Lynch's special 715 00:25:20,870 --> 00:25:23,229 address, Sanchez arranges that have 716 00:25:23,230 --> 00:25:25,869 the special functionality 717 00:25:25,870 --> 00:25:26,859 in the computer. 718 00:25:26,860 --> 00:25:28,989 For example, you have the under the 719 00:25:28,990 --> 00:25:31,049 legacy. Those areas some 720 00:25:31,050 --> 00:25:33,369 light the low memory addresses, 721 00:25:33,370 --> 00:25:35,469 which each of which has a special 722 00:25:35,470 --> 00:25:36,759 function. 723 00:25:36,760 --> 00:25:39,189 You have the main memory address 724 00:25:39,190 --> 00:25:41,609 as described in each of 725 00:25:41,610 --> 00:25:43,599 each of it, and it is broken to different 726 00:25:43,600 --> 00:25:45,819 regions that also have special functions 727 00:25:45,820 --> 00:25:47,179 and so on and so forth. 728 00:25:47,180 --> 00:25:49,089 I really don't want to get into this 729 00:25:49,090 --> 00:25:51,219 because this could be a whole 730 00:25:51,220 --> 00:25:53,079 talk on its own. 731 00:25:53,080 --> 00:25:55,149 But the general idea is you don't want to 732 00:25:55,150 --> 00:25:57,219 give anyone access to these regions 733 00:25:57,220 --> 00:25:58,959 because one has access to this large and 734 00:25:58,960 --> 00:26:00,849 they can reconfigure little hardware and 735 00:26:00,850 --> 00:26:03,069 just some virtual machine 736 00:26:03,070 --> 00:26:04,070 under you. 737 00:26:05,770 --> 00:26:07,959 And finally, we could have 738 00:26:07,960 --> 00:26:09,819 talk about cache, as I mentioned, the 739 00:26:09,820 --> 00:26:12,549 same cache poisoning attacks. 740 00:26:12,550 --> 00:26:14,910 We can't really talk about the 741 00:26:16,330 --> 00:26:18,339 I can't really find the time to talk 742 00:26:18,340 --> 00:26:20,439 about this and finish this talk in any 743 00:26:20,440 --> 00:26:21,759 reasonable way. 744 00:26:21,760 --> 00:26:23,499 I actually go to the original version 745 00:26:23,500 --> 00:26:25,299 with a discussion about cache, and it 746 00:26:25,300 --> 00:26:27,529 took like 15 slides and then I said 747 00:26:27,530 --> 00:26:28,599 of them. 748 00:26:32,620 --> 00:26:34,839 So the bottom line, I'll 749 00:26:34,840 --> 00:26:36,939 just give you the short overview of 750 00:26:36,940 --> 00:26:39,549 this of these 15 slides. 751 00:26:39,550 --> 00:26:41,889 Kiss is optimized for performance. 752 00:26:41,890 --> 00:26:43,959 Performance doesn't work 753 00:26:43,960 --> 00:26:45,669 well, play well with security. 754 00:26:45,670 --> 00:26:47,559 You optimized for performance. 755 00:26:47,560 --> 00:26:50,139 You don't optimize for security. 756 00:26:50,140 --> 00:26:51,140 The end. 757 00:26:58,710 --> 00:26:59,669 Thanks. 758 00:26:59,670 --> 00:27:02,069 OK, so anyways, just to summarize, 759 00:27:02,070 --> 00:27:04,499 this section nonetheless is complex, 760 00:27:04,500 --> 00:27:06,989 I think we can all agree on this now. 761 00:27:06,990 --> 00:27:09,069 Attackers with access to them and my 762 00:27:09,070 --> 00:27:11,279 physical memory that says 763 00:27:11,280 --> 00:27:13,319 can compromise basically anything on the 764 00:27:13,320 --> 00:27:15,449 system at the 765 00:27:15,450 --> 00:27:17,819 access to special address lenses is also 766 00:27:17,820 --> 00:27:19,799 dangerous because it gives the attacker 767 00:27:19,800 --> 00:27:21,959 the potential to subvert your hard work 768 00:27:21,960 --> 00:27:24,209 by misconfigured and get 769 00:27:24,210 --> 00:27:26,189 if it can help mitigate some of these 770 00:27:26,190 --> 00:27:28,199 problems. If you can configure it 771 00:27:28,200 --> 00:27:30,359 correctly and if it is available on 772 00:27:30,360 --> 00:27:32,369 your platform, which is 773 00:27:32,370 --> 00:27:32,549 a 774 00:27:32,550 --> 00:27:34,439 problem because if it is only available 775 00:27:34,440 --> 00:27:36,659 on high end well and not on low 776 00:27:36,660 --> 00:27:38,969 end well, so you have to buy 777 00:27:38,970 --> 00:27:41,039 the more expensive CPUs if you want this 778 00:27:41,040 --> 00:27:43,199 protection, which kind of makes sense on 779 00:27:43,200 --> 00:27:44,309 the Intel side. But 780 00:27:47,370 --> 00:27:50,009 yeah, OK. 781 00:27:50,010 --> 00:27:52,169 So next off, I'm going to 782 00:27:52,170 --> 00:27:54,329 talk about the insides 783 00:27:54,330 --> 00:27:56,309 of computer platforms and how these 784 00:27:56,310 --> 00:27:57,310 affect the security. 785 00:27:59,480 --> 00:28:01,769 Yeah, and just way too, I thought before 786 00:28:01,770 --> 00:28:02,489 I do. 787 00:28:02,490 --> 00:28:04,769 OK, so 788 00:28:04,770 --> 00:28:05,369 the 789 00:28:05,370 --> 00:28:07,469 what is a computer? 790 00:28:07,470 --> 00:28:09,749 We talked about the it's a very complex 791 00:28:09,750 --> 00:28:10,709 device internally. 792 00:28:10,710 --> 00:28:12,599 We already talked about the fact that the 793 00:28:12,600 --> 00:28:14,399 logical software architecture can be 794 00:28:14,400 --> 00:28:15,299 complex. 795 00:28:15,300 --> 00:28:17,459 But the other thing that we should note 796 00:28:17,460 --> 00:28:18,460 is that the 797 00:28:19,140 --> 00:28:19,469 every 798 00:28:19,470 --> 00:28:21,749 modern computer is a very high speed, 799 00:28:21,750 --> 00:28:23,969 complex network of interconnecting 800 00:28:23,970 --> 00:28:27,329 components. It's speaking in different 801 00:28:27,330 --> 00:28:29,729 protocols, using many busses 802 00:28:29,730 --> 00:28:32,669 on many types of networks and 803 00:28:32,670 --> 00:28:34,859 passing data at an extremely 804 00:28:34,860 --> 00:28:35,860 high speed. 805 00:28:37,710 --> 00:28:40,469 So this diagram 806 00:28:40,470 --> 00:28:42,689 represents a CPO 807 00:28:42,690 --> 00:28:44,039 more or less. 808 00:28:44,040 --> 00:28:46,589 How does it work? Basically, you have the 809 00:28:46,590 --> 00:28:48,749 big blue box on 810 00:28:48,750 --> 00:28:51,479 the outside, which is the the CPU 811 00:28:51,480 --> 00:28:53,789 CPU is actually broken into, 812 00:28:55,080 --> 00:28:56,729 let's say, two close, right? 813 00:28:56,730 --> 00:28:57,569 Got one call 814 00:28:57,570 --> 00:28:58,739 to 815 00:28:58,740 --> 00:29:01,169 each of these calls is again broken 816 00:29:01,170 --> 00:29:02,640 into two hyper slides. 817 00:29:03,810 --> 00:29:06,239 One I posted two episodes, so basically 818 00:29:06,240 --> 00:29:08,559 you get four logical 819 00:29:08,560 --> 00:29:11,039 processors within one Scipio 820 00:29:11,040 --> 00:29:12,209 package. 821 00:29:12,210 --> 00:29:14,639 In addition, each call, as some shared 822 00:29:14,640 --> 00:29:17,219 the area and some stuff. 823 00:29:17,220 --> 00:29:19,259 For example, shared registers showed 824 00:29:19,260 --> 00:29:21,209 Cachalia that is shared between both 825 00:29:21,210 --> 00:29:23,400 sides, both sides of this same call. 826 00:29:24,570 --> 00:29:26,969 And finally, there is a 827 00:29:26,970 --> 00:29:27,629 line. 828 00:29:27,630 --> 00:29:29,369 There is another part that is called the 829 00:29:29,370 --> 00:29:30,269 ankle. 830 00:29:30,270 --> 00:29:32,219 Anyone cares to hazard a guess. 831 00:29:32,220 --> 00:29:34,199 What's the definition of Uncle 832 00:29:36,960 --> 00:29:37,960 Goldman? 833 00:29:39,300 --> 00:29:41,399 Exactly everything that is not 834 00:29:41,400 --> 00:29:43,180 cool, right? 835 00:29:45,930 --> 00:29:46,930 OK. 836 00:29:47,790 --> 00:29:49,949 So everything that is not cool is 837 00:29:49,950 --> 00:29:51,779 the ankle. And what does this mean? 838 00:29:51,780 --> 00:29:53,789 Actually, for us, it means the integrated 839 00:29:53,790 --> 00:29:56,429 devices, which include in emergency 840 00:29:56,430 --> 00:29:58,259 Incipio Generations, the integrated 841 00:29:58,260 --> 00:30:00,539 graphics. They include the special 842 00:30:00,540 --> 00:30:02,699 device that actually is several special 843 00:30:02,700 --> 00:30:05,129 devices that represent the CPU. 844 00:30:05,130 --> 00:30:07,229 And they include all 845 00:30:07,230 --> 00:30:09,539 sorts of things, other things 846 00:30:09,540 --> 00:30:11,099 like power management and things like 847 00:30:11,100 --> 00:30:12,989 this. Then we get to the memory 848 00:30:12,990 --> 00:30:15,059 management unit or memory control 849 00:30:15,060 --> 00:30:16,949 hub that we so when we talked about 850 00:30:16,950 --> 00:30:19,499 memory, which communicates with the 851 00:30:19,500 --> 00:30:20,349 RAM 852 00:30:20,350 --> 00:30:22,499 and another component that we 853 00:30:22,500 --> 00:30:24,329 have is the persistently nice graphics 854 00:30:24,330 --> 00:30:26,519 that they mentioned, which allows PC 855 00:30:26,520 --> 00:30:28,679 devices to be connected directly 856 00:30:28,680 --> 00:30:30,539 to the CPU without going through the 857 00:30:30,540 --> 00:30:32,609 chipset. Which is a great idea 858 00:30:32,610 --> 00:30:35,039 because now everything that is done 859 00:30:35,040 --> 00:30:37,529 on every day to protect in the chipset 860 00:30:37,530 --> 00:30:39,989 needs to be done also in the CPU. 861 00:30:42,870 --> 00:30:44,939 So the and the 862 00:30:44,940 --> 00:30:46,619 interesting thing is it's persistently 863 00:30:46,620 --> 00:30:47,519 enhanced graphics. 864 00:30:47,520 --> 00:30:49,889 So you would think that only graphics 865 00:30:49,890 --> 00:30:51,779 cards could be connected there. 866 00:30:51,780 --> 00:30:53,849 But no, you can connect to any 867 00:30:53,850 --> 00:30:55,679 PC device you like. 868 00:30:55,680 --> 00:30:57,779 It's not like anybody's in full thing 869 00:30:57,780 --> 00:30:59,999 that it will be a graphics 870 00:31:00,000 --> 00:31:01,000 card. 871 00:31:01,380 --> 00:31:03,329 And finally, you'll get the demo bus, 872 00:31:03,330 --> 00:31:05,489 which is actually connecting us to the 873 00:31:05,490 --> 00:31:08,069 next component main component of the 874 00:31:08,070 --> 00:31:09,959 x86 x64. 875 00:31:09,960 --> 00:31:12,959 The modern CPU computer architecture. 876 00:31:12,960 --> 00:31:14,009 So who knows? 877 00:31:14,010 --> 00:31:16,229 What's the other major component? 878 00:31:16,230 --> 00:31:17,249 What's his name? 879 00:31:17,250 --> 00:31:18,250 Come on. 880 00:31:18,870 --> 00:31:20,969 No, you are wrong, 881 00:31:20,970 --> 00:31:21,970 sir. 882 00:31:22,440 --> 00:31:23,969 But you are in the right direction. 883 00:31:23,970 --> 00:31:24,970 Anybody else? 884 00:31:27,330 --> 00:31:28,330 That's right, man. 885 00:31:30,720 --> 00:31:32,069 OK, so the platform 886 00:31:32,070 --> 00:31:33,809 control hub is 887 00:31:33,810 --> 00:31:35,369 what replaced the southbridge. 888 00:31:36,960 --> 00:31:37,960 And 889 00:31:39,240 --> 00:31:41,369 we used to have the platform was it used 890 00:31:41,370 --> 00:31:43,799 to be broken into three main chips where 891 00:31:43,800 --> 00:31:46,199 we used to have the CPU, the nosebleeds 892 00:31:46,200 --> 00:31:47,429 and the southbridge. 893 00:31:47,430 --> 00:31:49,769 And it was a line that connecting between 894 00:31:49,770 --> 00:31:51,929 them. But actually, the way it 895 00:31:51,930 --> 00:31:54,059 is now is that the nose spillage was 896 00:31:54,060 --> 00:31:55,289 broken into two. 897 00:31:55,290 --> 00:31:57,289 Half of it was merged with this 898 00:31:57,290 --> 00:31:58,519 assemblage and created the. 899 00:31:58,520 --> 00:32:00,769 Platform controllable PCH 900 00:32:00,770 --> 00:32:02,599 and the other half was merged into the 901 00:32:02,600 --> 00:32:05,029 ankle in the CPU and became 902 00:32:05,030 --> 00:32:06,739 the power to some of the integrated 903 00:32:06,740 --> 00:32:07,999 devices of the CPU. 904 00:32:09,080 --> 00:32:11,419 So the PCH is actually fairly 905 00:32:11,420 --> 00:32:13,729 complex internally and this diagram 906 00:32:13,730 --> 00:32:15,109 doesn't do it justice. 907 00:32:15,110 --> 00:32:16,819 But what can I do? 908 00:32:16,820 --> 00:32:18,769 I can talk all day about the 909 00:32:18,770 --> 00:32:19,939 architecture. 910 00:32:19,940 --> 00:32:22,249 So what we have here, the PCH 911 00:32:22,250 --> 00:32:24,559 is made so many internal devices, such 912 00:32:24,560 --> 00:32:25,880 as the 913 00:32:27,080 --> 00:32:29,539 LAN card, for example, the integrated 914 00:32:29,540 --> 00:32:31,609 LAN is in the PCH, 915 00:32:31,610 --> 00:32:33,959 many bridges, many foam 916 00:32:33,960 --> 00:32:36,469 and chips that power management 917 00:32:36,470 --> 00:32:37,470 to 918 00:32:38,210 --> 00:32:38,519 tell 919 00:32:38,520 --> 00:32:40,579 my code and various other 920 00:32:40,580 --> 00:32:41,779 things. 921 00:32:41,780 --> 00:32:43,999 And in addition, the 922 00:32:44,000 --> 00:32:46,309 PCH has several bridges, so 923 00:32:46,310 --> 00:32:48,489 one bridge is connecting all the PCI 924 00:32:48,490 --> 00:32:50,569 e devices to the 925 00:32:50,570 --> 00:32:53,209 to the PC. So the PCH 926 00:32:53,210 --> 00:32:55,549 and another bridge or 927 00:32:55,550 --> 00:32:57,739 other several other bridges are 928 00:32:57,740 --> 00:33:00,049 connecting to different, different 929 00:33:00,050 --> 00:33:02,149 legacy devices in this that 930 00:33:02,150 --> 00:33:03,889 on my own little one, but actually the 931 00:33:03,890 --> 00:33:05,989 civil one for, for example, for the 932 00:33:05,990 --> 00:33:08,299 LPC four bus, one 933 00:33:08,300 --> 00:33:10,909 from the spy bus that contains 934 00:33:10,910 --> 00:33:13,039 the embedded controller in 935 00:33:13,040 --> 00:33:15,199 laptops, one for the 936 00:33:15,200 --> 00:33:17,689 AM, I don't know various 937 00:33:17,690 --> 00:33:19,759 other the low speed busses 938 00:33:19,760 --> 00:33:20,760 that you can think of. 939 00:33:21,830 --> 00:33:24,099 So and basically 940 00:33:24,100 --> 00:33:24,829 when 941 00:33:24,830 --> 00:33:27,439 you talk about the visualizing 942 00:33:27,440 --> 00:33:29,239 the Howard, well, you talk about actually 943 00:33:29,240 --> 00:33:31,459 utilizing all these devices, 944 00:33:31,460 --> 00:33:33,469 you need to actually create an emulation 945 00:33:33,470 --> 00:33:34,789 of these devices. 946 00:33:34,790 --> 00:33:36,919 Folio locks all platform, some 947 00:33:36,920 --> 00:33:38,599 with some of these devices the your 948 00:33:38,600 --> 00:33:39,769 keyboard, the little mouse. 949 00:33:39,770 --> 00:33:42,529 So layer the USB, 950 00:33:42,530 --> 00:33:44,059 everything goes to the PCH. 951 00:33:44,060 --> 00:33:46,299 Basically everything the talks to do, 952 00:33:46,300 --> 00:33:47,300 dual CPU 953 00:33:48,830 --> 00:33:51,169 and naturally, device virtualization 954 00:33:51,170 --> 00:33:53,239 is very simple. 955 00:33:53,240 --> 00:33:55,339 We can just use Khemu Zen 956 00:33:55,340 --> 00:33:57,619 and the KVM use using modified 957 00:33:57,620 --> 00:33:59,689 A for deals in its and there are 958 00:33:59,690 --> 00:34:02,089 no no vulnerabilities in cumulate. 959 00:34:04,160 --> 00:34:06,259 Yeah, so that was my quick 960 00:34:06,260 --> 00:34:08,599 certain vulnerabilities in Kumu. 961 00:34:10,909 --> 00:34:11,909 OK. 962 00:34:12,590 --> 00:34:15,319 So to solve the problem of actually, 963 00:34:15,320 --> 00:34:17,479 how do we give access, so protect 964 00:34:18,560 --> 00:34:21,589 situations where there is access to 965 00:34:21,590 --> 00:34:24,709 to the work by a guest? 966 00:34:24,710 --> 00:34:26,658 What we want to do is we want to have the 967 00:34:26,659 --> 00:34:28,428 ability to virtualized the world well in 968 00:34:28,429 --> 00:34:30,529 a similar manner that to to 969 00:34:30,530 --> 00:34:32,779 the way we virtualized software. 970 00:34:32,780 --> 00:34:34,968 And for this, we have defeated the all 971 00:34:34,969 --> 00:34:37,339 future zation technology for directed 972 00:34:37,340 --> 00:34:40,249 IO, which is 973 00:34:40,250 --> 00:34:41,149 also IO in the 974 00:34:41,150 --> 00:34:42,229 middle, 975 00:34:42,230 --> 00:34:44,509 and it is useful visualizing the chipset 976 00:34:44,510 --> 00:34:45,510 components. 977 00:34:46,340 --> 00:34:48,559 So there are two main 978 00:34:48,560 --> 00:34:50,089 features for this technology. 979 00:34:50,090 --> 00:34:52,189 One is the amazing mapping and the others 980 00:34:52,190 --> 00:34:53,579 interrupt the mapping. 981 00:34:53,580 --> 00:34:55,999 So the mapping, as the name 982 00:34:56,000 --> 00:34:58,309 implies, is basically 983 00:34:58,310 --> 00:35:00,829 allowing you to perform page 984 00:35:00,830 --> 00:35:01,789 Beijing. 985 00:35:01,790 --> 00:35:03,889 The map excesses DMCC says, 986 00:35:03,890 --> 00:35:06,019 from devices to the dilemma 987 00:35:06,020 --> 00:35:07,429 to different addresses. 988 00:35:08,660 --> 00:35:11,299 And this is done by a paging mechanism 989 00:35:11,300 --> 00:35:12,649 because Intel loves Beijing. 990 00:35:12,650 --> 00:35:15,059 We already had regular paging APTN 991 00:35:15,060 --> 00:35:17,329 and now we have visited 992 00:35:17,330 --> 00:35:19,039 Beijing, right? 993 00:35:19,040 --> 00:35:21,259 And because Beijing is great, 994 00:35:21,260 --> 00:35:23,419 then they created the nested translation 995 00:35:23,420 --> 00:35:25,579 concept, which is the dragon on the 996 00:35:25,580 --> 00:35:28,159 top right of a, which allows you to 997 00:35:28,160 --> 00:35:30,679 perform one two three four five 998 00:35:30,680 --> 00:35:32,929 six seven times 999 00:35:32,930 --> 00:35:35,209 full translations to get 1000 00:35:35,210 --> 00:35:36,789 the single address. 1001 00:35:36,790 --> 00:35:37,790 Oh! 1002 00:35:38,850 --> 00:35:40,739 If you can configure this, call me, I 1003 00:35:40,740 --> 00:35:41,740 need your help. 1004 00:35:44,010 --> 00:35:44,859 OK. 1005 00:35:44,860 --> 00:35:47,129 Anyways, in Typekit, mapping 1006 00:35:47,130 --> 00:35:49,289 is a really, really nice feature 1007 00:35:49,290 --> 00:35:51,419 which allows you to remap the way 1008 00:35:51,420 --> 00:35:53,849 interrupter delivered to guests 1009 00:35:53,850 --> 00:35:55,199 and to the VM. 1010 00:35:55,200 --> 00:35:57,029 And this is also a very important feature 1011 00:35:57,030 --> 00:35:59,189 because the actual 1012 00:35:59,190 --> 00:36:01,629 real world attacks that did this 1013 00:36:01,630 --> 00:36:03,869 and the very nice people 1014 00:36:03,870 --> 00:36:05,699 and this is the following the white 1015 00:36:05,700 --> 00:36:07,829 rabbit by John Politkovskaya's 1016 00:36:07,830 --> 00:36:09,060 and they are fallible chuck. 1017 00:36:10,470 --> 00:36:11,470 And 1018 00:36:13,110 --> 00:36:15,089 the interesting thing about interrupting 1019 00:36:15,090 --> 00:36:17,099 mapping is that even in the last the 1020 00:36:17,100 --> 00:36:19,589 latest generation of interceptors, 1021 00:36:19,590 --> 00:36:21,599 there is a one on the last day in 1022 00:36:21,600 --> 00:36:23,669 interactive mapping, which means that 1023 00:36:23,670 --> 00:36:25,979 you can deal with the machine or shut 1024 00:36:25,980 --> 00:36:28,319 it down. If you have access to a generate 1025 00:36:28,320 --> 00:36:30,689 interrupt there and certain 1026 00:36:30,690 --> 00:36:32,399 configuration conditions exist. 1027 00:36:32,400 --> 00:36:34,709 This is a work by a person called Gabor 1028 00:36:34,710 --> 00:36:36,899 Tech, and I recommend reading it 1029 00:36:36,900 --> 00:36:39,089 for those interested in the low level 1030 00:36:39,090 --> 00:36:40,090 details. 1031 00:36:40,830 --> 00:36:43,079 And finally, what they do 1032 00:36:43,080 --> 00:36:44,309 with the old systems? 1033 00:36:44,310 --> 00:36:46,559 Well, you don't have to deal what they do 1034 00:36:46,560 --> 00:36:48,389 in systems, the weather you have today, 1035 00:36:48,390 --> 00:36:50,519 but it's an older generation even on 1036 00:36:50,520 --> 00:36:52,319 the Illinois. Suppose you still don't 1037 00:36:52,320 --> 00:36:54,899 have a fix for the Gabor piccata, 1038 00:36:54,900 --> 00:36:57,389 so it is not very simple. 1039 00:36:57,390 --> 00:36:59,609 It's a spec that is still going and 1040 00:36:59,610 --> 00:37:01,859 hopefully it will be stable. 1041 00:37:01,860 --> 00:37:04,109 One day, I 1042 00:37:04,110 --> 00:37:06,029 suspect this is a several L.Z. 1043 00:37:06,030 --> 00:37:07,860 of us still. 1044 00:37:10,210 --> 00:37:12,549 So just to summarize this section, 1045 00:37:12,550 --> 00:37:15,789 computer platforms are complex, 1046 00:37:15,790 --> 00:37:18,099 and they're emulating the necessary 1047 00:37:18,100 --> 00:37:19,929 components is out. 1048 00:37:19,930 --> 00:37:22,059 There are multiple surveys already found 1049 00:37:22,060 --> 00:37:24,189 in CV end. The pick virtualization as 1050 00:37:24,190 --> 00:37:26,409 well as Cuomo, actually didn't get 1051 00:37:26,410 --> 00:37:28,149 into API and the pick. 1052 00:37:28,150 --> 00:37:29,739 But you can find it in my backup 1053 00:37:29,740 --> 00:37:30,740 materials 1054 00:37:32,440 --> 00:37:34,629 and this will be uploaded and vetted. 1055 00:37:34,630 --> 00:37:36,849 The ALP's virtualizing the DMARD 1056 00:37:36,850 --> 00:37:38,949 will and and download and 1057 00:37:38,950 --> 00:37:40,429 drafts if it is useful, actually. 1058 00:37:41,560 --> 00:37:43,719 OK, so 1059 00:37:43,720 --> 00:37:45,609 we'll go getting to the last part of the 1060 00:37:45,610 --> 00:37:48,009 stock, we're going to talk a bit about 1061 00:37:48,010 --> 00:37:49,979 the different attack vectors, things that 1062 00:37:49,980 --> 00:37:52,359 they didn't get to talk about so far. 1063 00:37:52,360 --> 00:37:54,549 And then I'm going to get to the 1064 00:37:54,550 --> 00:37:56,949 actual there and suggested 1065 00:37:56,950 --> 00:37:58,659 the VM escape. 1066 00:37:58,660 --> 00:37:59,660 So 1067 00:38:00,910 --> 00:38:03,069 just the first of the most basic 1068 00:38:03,070 --> 00:38:04,869 work, though, we can talk about this, the 1069 00:38:04,870 --> 00:38:07,659 ISO implementation, we talked about it 1070 00:38:07,660 --> 00:38:09,699 emulating all the specification or even 1071 00:38:09,700 --> 00:38:12,249 part of the x86 specification 1072 00:38:12,250 --> 00:38:13,250 is not easy. 1073 00:38:14,350 --> 00:38:16,509 Next off, another classic one would 1074 00:38:16,510 --> 00:38:18,279 be performance monitoring. 1075 00:38:18,280 --> 00:38:19,929 There are lots of performance monitoring 1076 00:38:19,930 --> 00:38:22,479 controls, and we can use them to 1077 00:38:22,480 --> 00:38:25,209 basically trace the way that the 1078 00:38:25,210 --> 00:38:27,279 Fulghum executes within the VM 1079 00:38:27,280 --> 00:38:30,069 and try to figure out or 1080 00:38:30,070 --> 00:38:31,959 hack it this way. 1081 00:38:31,960 --> 00:38:34,029 A real time instruction placing is a new 1082 00:38:34,030 --> 00:38:35,949 feature that is coming up and might be 1083 00:38:35,950 --> 00:38:37,869 very, very interesting in this context. 1084 00:38:39,520 --> 00:38:41,559 Then we get to the problem of what do you 1085 00:38:41,560 --> 00:38:43,749 do when your system is old and 1086 00:38:43,750 --> 00:38:45,999 your defenses keep being introduced 1087 00:38:46,000 --> 00:38:47,799 with the latest? And well, if you can 1088 00:38:47,800 --> 00:38:50,169 identify that the actual how 1089 00:38:50,170 --> 00:38:51,639 you're going and going and there is a 1090 00:38:51,640 --> 00:38:53,739 very nice way to talk 1091 00:38:53,740 --> 00:38:56,169 about different red 1092 00:38:56,170 --> 00:38:58,239 people, not talk about different 1093 00:38:58,240 --> 00:39:00,129 red fields and how to automatically 1094 00:39:00,130 --> 00:39:02,079 generate red filters that allow you to 1095 00:39:02,080 --> 00:39:03,849 identify the specific cloud really 1096 00:39:03,850 --> 00:39:04,959 aligning one. 1097 00:39:04,960 --> 00:39:07,029 Then you can identify the 1098 00:39:07,030 --> 00:39:08,619 fact that you are on an old system and 1099 00:39:08,620 --> 00:39:10,539 use a bug that maybe is fixed on the 1100 00:39:10,540 --> 00:39:12,849 newest versions, but it just not 1101 00:39:12,850 --> 00:39:14,349 fixed and they're all valuable and you 1102 00:39:14,350 --> 00:39:15,699 can fix it in the cloud. 1103 00:39:15,700 --> 00:39:17,050 That's the whole point of order. 1104 00:39:19,750 --> 00:39:22,089 And then you get the new features. 1105 00:39:22,090 --> 00:39:24,409 What do you do when a whole new 1106 00:39:24,410 --> 00:39:26,949 CPO feature is introduced like outdated 1107 00:39:26,950 --> 00:39:29,169 that I mentioned earlier, and it has some 1108 00:39:29,170 --> 00:39:31,549 new register that is a buffer that writes 1109 00:39:31,550 --> 00:39:33,789 that bit of physical memory, then 1110 00:39:33,790 --> 00:39:35,979 you need to actually visualize it, right? 1111 00:39:35,980 --> 00:39:38,419 But they feel the virtualization engine 1112 00:39:38,420 --> 00:39:40,629 there didn't support it, and 1113 00:39:40,630 --> 00:39:42,489 now it is installed on and you're 1114 00:39:42,490 --> 00:39:44,589 allowed. Well, then it doesn't know 1115 00:39:44,590 --> 00:39:46,199 that it's the virtualization. 1116 00:39:46,200 --> 00:39:48,399 And then either it doesn't give access to 1117 00:39:48,400 --> 00:39:50,889 any new feature, which is a blacklist 1118 00:39:50,890 --> 00:39:53,049 approach that kind of kills all the new 1119 00:39:53,050 --> 00:39:53,949 features in your sleep. 1120 00:39:53,950 --> 00:39:56,739 You just can't get access to them all. 1121 00:39:56,740 --> 00:39:58,899 It gives access to every feature and then 1122 00:39:58,900 --> 00:40:01,389 it takes the risk that it is infected. 1123 00:40:01,390 --> 00:40:02,390 Usually, 1124 00:40:03,730 --> 00:40:05,979 Bayonetta little visors don't give access 1125 00:40:05,980 --> 00:40:08,349 to any feature, so you get something 1126 00:40:08,350 --> 00:40:10,539 like, for example, Vimal Player. 1127 00:40:10,540 --> 00:40:12,909 And as far as I can tell, 1128 00:40:12,910 --> 00:40:15,309 the default in general, the A6 emulates 1129 00:40:15,310 --> 00:40:17,499 a full 40 v x 1130 00:40:17,500 --> 00:40:19,149 chip anybody knows from. 1131 00:40:19,150 --> 00:40:20,150 Which is this 1132 00:40:21,750 --> 00:40:24,039 maybe close 1133 00:40:24,040 --> 00:40:25,119 enough? 97. 1134 00:40:27,400 --> 00:40:30,009 So you get kind of the 1135 00:40:30,010 --> 00:40:31,010 old systems. 1136 00:40:32,980 --> 00:40:35,259 OK, so another 1137 00:40:35,260 --> 00:40:37,179 interesting thing is the Io address base 1138 00:40:37,180 --> 00:40:38,799 that all of the space is used to actually 1139 00:40:38,800 --> 00:40:40,869 configure the the 1140 00:40:40,870 --> 00:40:43,089 PCI devices and to 1141 00:40:43,090 --> 00:40:44,589 directly communicate with them. 1142 00:40:44,590 --> 00:40:46,719 You can write directly to disk if you 1143 00:40:46,720 --> 00:40:48,969 just try to set it to the 1144 00:40:48,970 --> 00:40:50,489 iOS Matterport there 1145 00:40:51,520 --> 00:40:53,049 and various other things. 1146 00:40:53,050 --> 00:40:55,539 So anybody knows how many iReports 1147 00:40:55,540 --> 00:40:56,650 in x86. 1148 00:40:58,380 --> 00:40:59,889 Well, said, 64K. 1149 00:40:59,890 --> 00:41:00,890 You're wrong, 1150 00:41:03,510 --> 00:41:04,510 and I don't 1151 00:41:05,790 --> 00:41:06,329 know 1152 00:41:06,330 --> 00:41:08,789 you along as well, 64k was closer 1153 00:41:08,790 --> 00:41:11,339 to Mr. By how much 1154 00:41:11,340 --> 00:41:12,340 anybody 1155 00:41:14,430 --> 00:41:16,369 know, 60 plus three. 1156 00:41:20,210 --> 00:41:23,749 Now, any idea why is it +3? 1157 00:41:23,750 --> 00:41:25,819 Because the whites of it, when you 1158 00:41:25,820 --> 00:41:27,979 access iReports, 1159 00:41:27,980 --> 00:41:30,629 you can access one bytes 1160 00:41:30,630 --> 00:41:32,569 wallet, which is still bytes or full 1161 00:41:32,570 --> 00:41:33,739 bytes, right? 1162 00:41:33,740 --> 00:41:36,079 And you can have is that baseball 1163 00:41:36,080 --> 00:41:38,209 60 func values so it can start 1164 00:41:38,210 --> 00:41:41,059 from zero two six five five five. 1165 00:41:41,060 --> 00:41:43,219 But if you access a full 1166 00:41:43,220 --> 00:41:45,349 byte at six five five five, then 1167 00:41:45,350 --> 00:41:47,659 you get three filter unknown 1168 00:41:47,660 --> 00:41:49,999 parts that are beyond six five five 1169 00:41:50,000 --> 00:41:52,129 five and you actually have 1170 00:41:52,130 --> 00:41:54,259 60 4K plus, which 1171 00:41:54,260 --> 00:41:55,260 is kind of weird. 1172 00:41:59,390 --> 00:42:01,459 Yeah, I'm disappointed in you guys, I 1173 00:42:01,460 --> 00:42:02,959 expected someone to know this. 1174 00:42:05,990 --> 00:42:06,990 Anyways. 1175 00:42:12,860 --> 00:42:15,169 So the other 1176 00:42:15,170 --> 00:42:16,549 the other interesting thing is that you 1177 00:42:16,550 --> 00:42:18,709 can actually overlap, but what 1178 00:42:18,710 --> 00:42:21,049 happens if you overlap up the keyboard 1179 00:42:21,050 --> 00:42:23,029 both, which is actually configurable in 1180 00:42:23,030 --> 00:42:25,219 some conditions with the 1181 00:42:25,220 --> 00:42:27,409 IO configuration, both which 1182 00:42:27,410 --> 00:42:29,929 is CFA when you overlap 1183 00:42:29,930 --> 00:42:32,089 the Satar, well, both 1184 00:42:32,090 --> 00:42:34,159 with some of these boats, 1185 00:42:34,160 --> 00:42:35,160 you get 1186 00:42:36,220 --> 00:42:38,599 a problem in decoding that nobody 1187 00:42:38,600 --> 00:42:40,849 knows how to actually answer some 1188 00:42:40,850 --> 00:42:42,079 of the some things that are decoded. 1189 00:42:42,080 --> 00:42:44,179 Some are not. So this is an interesting 1190 00:42:44,180 --> 00:42:46,669 case. We already talked about overlapping 1191 00:42:46,670 --> 00:42:48,289 and then they all went just in all 1192 00:42:48,290 --> 00:42:49,849 different ways. 1193 00:42:50,930 --> 00:42:52,699 There are special memory arrangements. 1194 00:42:52,700 --> 00:42:54,769 We also talked about there and 1195 00:42:54,770 --> 00:42:57,109 what happens when you overlap? 1196 00:42:57,110 --> 00:42:59,209 A special memo that ends with an 1197 00:42:59,210 --> 00:43:01,369 MMI over Angel can get 1198 00:43:01,370 --> 00:43:02,359 mixed stuff together. 1199 00:43:02,360 --> 00:43:03,360 It's fun. 1200 00:43:05,000 --> 00:43:06,799 And finally, you get to the model 1201 00:43:06,800 --> 00:43:08,869 specific registers, which we didn't get 1202 00:43:08,870 --> 00:43:10,999 to talk about, but an 1203 00:43:11,000 --> 00:43:12,919 interesting thing in and of themselves 1204 00:43:12,920 --> 00:43:14,639 that they are actually the configuration 1205 00:43:14,640 --> 00:43:16,429 registers of the CPU. 1206 00:43:16,430 --> 00:43:18,589 They comprise the all sort 1207 00:43:18,590 --> 00:43:19,789 of address space. 1208 00:43:19,790 --> 00:43:21,859 But the interesting thing is certain 1209 00:43:21,860 --> 00:43:24,170 configuration registers don't actually 1210 00:43:25,400 --> 00:43:27,469 deal with configuration, so the missiles 1211 00:43:27,470 --> 00:43:29,989 actually trigger actions 1212 00:43:29,990 --> 00:43:31,369 when you write to them. 1213 00:43:31,370 --> 00:43:33,499 So, so 1214 00:43:33,500 --> 00:43:35,599 you might face something 1215 00:43:35,600 --> 00:43:37,669 like it missile that when 1216 00:43:37,670 --> 00:43:40,039 you write, it triggers the bios updates. 1217 00:43:40,040 --> 00:43:42,109 This is MSL's seventy 1218 00:43:42,110 --> 00:43:43,940 nine hex, so things like that. 1219 00:43:45,050 --> 00:43:47,389 And if you give 1220 00:43:47,390 --> 00:43:49,699 any access to missiles, you 1221 00:43:49,700 --> 00:43:51,590 risk basically your system. 1222 00:43:52,880 --> 00:43:55,759 Finally, we get not finally actually 1223 00:43:55,760 --> 00:43:57,169 call up to this ICBMs. 1224 00:43:57,170 --> 00:43:59,269 Another problem anybody knows what they 1225 00:43:59,270 --> 00:44:00,270 zone. 1226 00:44:02,740 --> 00:44:03,729 Who said this? 1227 00:44:03,730 --> 00:44:04,730 I heard you. 1228 00:44:05,800 --> 00:44:07,929 You come by after 1229 00:44:07,930 --> 00:44:08,930 the talk. 1230 00:44:12,690 --> 00:44:14,759 OK, so the 1231 00:44:14,760 --> 00:44:17,009 interesting thing about Asians is that 1232 00:44:17,010 --> 00:44:19,229 they are basically learning 1233 00:44:19,230 --> 00:44:21,779 their code modules, very small 1234 00:44:21,780 --> 00:44:24,209 code modules that are signed by Intel 1235 00:44:24,210 --> 00:44:26,489 and they're basically running in sort of 1236 00:44:26,490 --> 00:44:28,499 unlimited privileged mode. 1237 00:44:28,500 --> 00:44:30,629 If you have a bug in one 1238 00:44:30,630 --> 00:44:32,669 that allows you to actually escalate to 1239 00:44:32,670 --> 00:44:35,069 the execution mode, you can do whatever 1240 00:44:35,070 --> 00:44:36,599 you like within the CPU. 1241 00:44:38,670 --> 00:44:40,949 So not within the CPU is in 1242 00:44:40,950 --> 00:44:43,319 any software, to any physical address, 1243 00:44:43,320 --> 00:44:45,449 whatever, whatever you're aiming 1244 00:44:45,450 --> 00:44:46,450 at. 1245 00:44:46,740 --> 00:44:49,049 Next up, if we get the CPU and PCH fill 1246 00:44:49,050 --> 00:44:51,209 out and I'm not 1247 00:44:51,210 --> 00:44:53,339 only talking about the MICHAEL code 1248 00:44:53,340 --> 00:44:55,049 that implements the I said this is the 1249 00:44:55,050 --> 00:44:57,269 one that everybody well off. 1250 00:44:57,270 --> 00:44:58,949 But actually there is something that is 1251 00:44:58,950 --> 00:44:59,939 called the manageability 1252 00:44:59,940 --> 00:45:01,109 engine, 1253 00:45:01,110 --> 00:45:03,209 which has been hacked into several 1254 00:45:03,210 --> 00:45:05,549 times and it runs 1255 00:45:05,550 --> 00:45:06,779 within the PCH. 1256 00:45:06,780 --> 00:45:09,269 It's sort of the film of the PCH. 1257 00:45:09,270 --> 00:45:11,339 And it has unlimited access 1258 00:45:11,340 --> 00:45:13,559 to any physical memory address, which 1259 00:45:13,560 --> 00:45:15,719 means that the one cell there you 1260 00:45:15,720 --> 00:45:17,880 broke into or anything on the system 1261 00:45:18,960 --> 00:45:21,329 in addition to this graphics 1262 00:45:21,330 --> 00:45:23,909 has its own microcode the integrated 1263 00:45:23,910 --> 00:45:26,099 graphics power control 1264 00:45:26,100 --> 00:45:29,009 as the it's on Michael Cloud, and 1265 00:45:29,010 --> 00:45:31,349 if you can break into one of them, 1266 00:45:31,350 --> 00:45:32,759 good luck. 1267 00:45:32,760 --> 00:45:33,839 You can have a lot of 1268 00:45:33,840 --> 00:45:34,840 fun 1269 00:45:35,490 --> 00:45:36,629 and it is possible 1270 00:45:37,680 --> 00:45:39,989 I'll go out anyways. 1271 00:45:39,990 --> 00:45:41,189 BIOS and this amendment. 1272 00:45:41,190 --> 00:45:43,319 I also like a common component of 1273 00:45:43,320 --> 00:45:45,449 every platform and the 1274 00:45:45,450 --> 00:45:47,459 control of both the configuration of the 1275 00:45:47,460 --> 00:45:48,119 platform 1276 00:45:48,120 --> 00:45:50,189 and the F the 1277 00:45:50,190 --> 00:45:51,629 privilege to access everything. 1278 00:45:51,630 --> 00:45:54,179 So those are interesting attack vectors. 1279 00:45:54,180 --> 00:45:55,180 And finally, 1280 00:45:56,250 --> 00:45:57,749 we talked about intentional 1281 00:45:57,750 --> 00:45:59,099 misconfigurations. 1282 00:45:59,100 --> 00:46:01,259 You can take this to various 1283 00:46:01,260 --> 00:46:03,569 places. You can mere 1284 00:46:03,570 --> 00:46:05,999 misconfigured PCI configuration space 1285 00:46:06,000 --> 00:46:08,099 and missiles eliminate all contact 1286 00:46:08,100 --> 00:46:10,889 constants in order to create 1287 00:46:10,890 --> 00:46:13,109 unexpected situations to the VMS, 1288 00:46:13,110 --> 00:46:15,299 even to the emulation of 1289 00:46:15,300 --> 00:46:17,579 these features usually 1290 00:46:17,580 --> 00:46:19,889 doesn't enter this weird corner cases 1291 00:46:19,890 --> 00:46:22,019 because why should the emulation 1292 00:46:22,020 --> 00:46:23,639 handle the world? Connor case will the 1293 00:46:23,640 --> 00:46:25,379 port of the up support? 1294 00:46:25,380 --> 00:46:27,719 So in the case of them, 1295 00:46:27,720 --> 00:46:28,709 I tried to do it. 1296 00:46:28,710 --> 00:46:30,629 The video player, actually, because I 1297 00:46:30,630 --> 00:46:33,539 started that very quick attack on the 1298 00:46:33,540 --> 00:46:34,949 demo for this dock. 1299 00:46:34,950 --> 00:46:37,109 And it turns out that the video player 1300 00:46:37,110 --> 00:46:39,539 actually detects this 1301 00:46:39,540 --> 00:46:42,209 because it supports Windows 3.1, 1302 00:46:42,210 --> 00:46:43,679 which had problems with this. 1303 00:46:50,320 --> 00:46:52,479 So finally, Microsoft did 1304 00:46:52,480 --> 00:46:54,639 something to improve the security 1305 00:46:54,640 --> 00:46:55,640 of the. 1306 00:46:59,830 --> 00:47:02,589 Silver platforms are really, really fun. 1307 00:47:02,590 --> 00:47:04,959 I don't know if if yellow without 1308 00:47:04,960 --> 00:47:07,569 intel skills the platforms, but actually 1309 00:47:07,570 --> 00:47:09,489 the desktop platforms, which are 1310 00:47:09,490 --> 00:47:11,589 basically everything inside 1311 00:47:11,590 --> 00:47:13,689 of them, their actual microarchitecture 1312 00:47:13,690 --> 00:47:15,969 is the same as what my my 1313 00:47:15,970 --> 00:47:18,039 architectural, whether you get it inside 1314 00:47:18,040 --> 00:47:20,499 your laptop or inside the desktop 1315 00:47:20,500 --> 00:47:21,699 is all the same. 1316 00:47:21,700 --> 00:47:24,759 But when it gets to the actual 1317 00:47:24,760 --> 00:47:27,039 microarchitecture, to the actual 1318 00:47:27,040 --> 00:47:29,229 cell villes, they actually get the 1319 00:47:29,230 --> 00:47:31,449 skills. They are not the same. 1320 00:47:31,450 --> 00:47:33,189 They are the updates to their medical 1321 00:47:33,190 --> 00:47:35,139 code. They have a ton of new features, 1322 00:47:35,140 --> 00:47:37,249 and those features line at 1323 00:47:37,250 --> 00:47:38,979 the extreme privilege 1324 00:47:38,980 --> 00:47:39,980 level, 1325 00:47:40,450 --> 00:47:42,369 highly recommended to look up to them 1326 00:47:42,370 --> 00:47:44,199 your and actually targets them if you 1327 00:47:44,200 --> 00:47:45,819 want to escape from virtualization, 1328 00:47:45,820 --> 00:47:48,069 especially because if you are trying to 1329 00:47:48,070 --> 00:47:50,409 do an escape on virtualization, 1330 00:47:50,410 --> 00:47:53,229 you will usually be in the cell phone and 1331 00:47:53,230 --> 00:47:55,419 therefore this is something very 1332 00:47:55,420 --> 00:47:56,420 nice to target. 1333 00:47:58,120 --> 00:48:00,189 And finally, we get to a 1334 00:48:00,190 --> 00:48:01,479 superior data. 1335 00:48:01,480 --> 00:48:03,549 So the the 1336 00:48:03,550 --> 00:48:03,849 any 1337 00:48:03,850 --> 00:48:05,919 virtualization, any code running on the 1338 00:48:05,920 --> 00:48:08,139 system is still a lie on the 1339 00:48:08,140 --> 00:48:10,599 on the while performing correctly. 1340 00:48:10,600 --> 00:48:12,189 But actually, the adadevoh doesn't 1341 00:48:12,190 --> 00:48:13,389 perform correctly. 1342 00:48:13,390 --> 00:48:15,879 Intel publishes a letter 1343 00:48:15,880 --> 00:48:18,429 on every CPU and updates it and updates 1344 00:48:18,430 --> 00:48:20,529 it and updates it and so forth 1345 00:48:20,530 --> 00:48:22,089 and so on. 1346 00:48:22,090 --> 00:48:23,709 And practically 1347 00:48:24,760 --> 00:48:26,679 you need to think, Well, is there 1348 00:48:26,680 --> 00:48:29,589 virtualization engine need to 1349 00:48:29,590 --> 00:48:31,659 rely on this specific 1350 00:48:31,660 --> 00:48:33,789 function that I know that as a writer? 1351 00:48:33,790 --> 00:48:36,129 And then you can take advantage of it 1352 00:48:36,130 --> 00:48:38,649 and to demonstrate this. 1353 00:48:38,650 --> 00:48:41,259 Here's my bonus about a 1354 00:48:41,260 --> 00:48:43,839 potential VM escape 1355 00:48:43,840 --> 00:48:46,989 on any second generation course appeal. 1356 00:48:46,990 --> 00:48:49,509 So we have it in a letter that says 1357 00:48:49,510 --> 00:48:51,579 basically the following 1358 00:48:51,580 --> 00:48:54,159 the if you go to 1359 00:48:54,160 --> 00:48:56,889 form 32 bit mode, the 64 1360 00:48:56,890 --> 00:48:59,109 bit mode load a 64 1361 00:48:59,110 --> 00:49:01,179 bit value too closely, which is the 1362 00:49:01,180 --> 00:49:03,579 memory paging 1363 00:49:03,580 --> 00:49:05,649 route, the route of the paging 1364 00:49:05,650 --> 00:49:07,869 structure and then go back 1365 00:49:07,870 --> 00:49:10,629 to 32 bit mode, then 1366 00:49:10,630 --> 00:49:12,999 the zip. You will continue to use the 64 1367 00:49:13,000 --> 00:49:15,129 bit value, which means that 1368 00:49:15,130 --> 00:49:17,339 you can actually call up the pointer 1369 00:49:17,340 --> 00:49:19,599 and pointed to anywhere you like 1370 00:49:19,600 --> 00:49:21,669 while your virtualization engine thinks 1371 00:49:21,670 --> 00:49:23,749 that it is in the lower 1372 00:49:23,750 --> 00:49:25,869 32 bits because this is the size 1373 00:49:25,870 --> 00:49:28,059 of Cell C when you are in 32 bit 1374 00:49:28,060 --> 00:49:30,009 mode. So this is not something that the 1375 00:49:30,010 --> 00:49:31,929 updating systems normally do because they 1376 00:49:31,930 --> 00:49:34,029 don't transition to 64 bit 1377 00:49:34,030 --> 00:49:36,309 and go back to 32 bit mode. 1378 00:49:36,310 --> 00:49:38,499 But should you actually choose to do 1379 00:49:38,500 --> 00:49:39,500 this? 1380 00:49:41,440 --> 00:49:43,659 You can think of this, that now. 1381 00:49:43,660 --> 00:49:45,969 The problem is that if the virtualization 1382 00:49:45,970 --> 00:49:48,249 engine actually lights 1383 00:49:48,250 --> 00:49:50,379 the Cell C value along 1384 00:49:50,380 --> 00:49:52,839 the transition test, then 1385 00:49:52,840 --> 00:49:54,959 it will air it if 1386 00:49:54,960 --> 00:49:57,139 it writes a 32 bit sales 1387 00:49:57,140 --> 00:49:59,469 value. This is the walk along sit. 1388 00:49:59,470 --> 00:50:01,729 And it turns out based on my client's 1389 00:50:01,730 --> 00:50:04,299 presence with VM well, that they at least 1390 00:50:04,300 --> 00:50:06,429 believe they handle this case, 1391 00:50:07,600 --> 00:50:08,259 but 1392 00:50:08,260 --> 00:50:09,349 I haven't checked on either 1393 00:50:09,350 --> 00:50:10,599 virtualization platforms. 1394 00:50:12,040 --> 00:50:13,539 OK, so 1395 00:50:15,070 --> 00:50:17,529 that's that computer. 1396 00:50:17,530 --> 00:50:19,749 Plus, just to summarize what we've talked 1397 00:50:19,750 --> 00:50:21,909 about, computer platforms are complex 1398 00:50:21,910 --> 00:50:23,439 with Senate 1399 00:50:23,440 --> 00:50:24,849 memory 1400 00:50:24,850 --> 00:50:26,800 architecture and software stacks. 1401 00:50:27,820 --> 00:50:29,109 There are several approaches to 1402 00:50:29,110 --> 00:50:30,939 virtualized out, each with its own 1403 00:50:30,940 --> 00:50:32,919 internal and weaknesses. 1404 00:50:32,920 --> 00:50:35,099 Full out over utilization is 1405 00:50:35,100 --> 00:50:37,569 slower and uses software emulation 1406 00:50:37,570 --> 00:50:38,499 directly works. 1407 00:50:38,500 --> 00:50:40,029 This is born to malicious out of the 1408 00:50:40,030 --> 00:50:42,249 manipulations and 1409 00:50:42,250 --> 00:50:44,349 better defenses of available only with 1410 00:50:44,350 --> 00:50:46,989 new and sometimes I doubt well, but 1411 00:50:46,990 --> 00:50:49,269 really, if you are trying to defend 1412 00:50:49,270 --> 00:50:51,519 the virtualization using the hardware, if 1413 00:50:51,520 --> 00:50:53,530 you are trying to make it go back. 1414 00:50:54,880 --> 00:50:56,139 Thank you all for listening. 1415 00:50:57,190 --> 00:50:57,729 I'm open 1416 00:50:57,730 --> 00:50:58,730 to questions. 1417 00:51:11,370 --> 00:51:12,569 Thank you very much. 1418 00:51:12,570 --> 00:51:14,609 And it questions questions from the 1419 00:51:14,610 --> 00:51:15,610 internet. Yes. 1420 00:51:18,390 --> 00:51:19,390 Well. 1421 00:51:21,230 --> 00:51:23,050 This question from the internet, 1422 00:51:24,640 --> 00:51:26,739 shouldn't there be sixty four 1423 00:51:26,740 --> 00:51:28,839 K plus seven addresses in the 1424 00:51:28,840 --> 00:51:31,149 space since we are now in 64 1425 00:51:31,150 --> 00:51:32,150 bits? 1426 00:51:34,430 --> 00:51:36,519 You're saying that sixty 1427 00:51:36,520 --> 00:51:38,379 four plus seven, but there is no 1428 00:51:38,380 --> 00:51:39,819 way in 1429 00:51:39,820 --> 00:51:42,669 out, say, eight bytes 1430 00:51:42,670 --> 00:51:44,349 in the entire architecture. 1431 00:51:46,580 --> 00:51:48,819 Well, talking about the pill, so 1432 00:51:48,820 --> 00:51:50,589 it's only 1433 00:51:50,590 --> 00:51:50,979 in 1434 00:51:50,980 --> 00:51:53,049 out, in world, out 1435 00:51:53,050 --> 00:51:55,239 world or in the 1436 00:51:55,240 --> 00:51:56,709 world, out to the world. 1437 00:51:56,710 --> 00:51:58,069 So it's 60 plus. 1438 00:52:03,640 --> 00:52:05,379 And the moral questions. 1439 00:52:05,380 --> 00:52:06,659 Yep. Number two. 1440 00:52:08,950 --> 00:52:10,839 My question is, is there any hope? 1441 00:52:13,780 --> 00:52:14,780 Well, yeah, 1442 00:52:16,810 --> 00:52:19,059 basically, I'm asking you, 1443 00:52:19,060 --> 00:52:21,729 do you know about any 1444 00:52:21,730 --> 00:52:23,979 hardware development project which is 1445 00:52:23,980 --> 00:52:26,139 aiming to develop secure hardware 1446 00:52:26,140 --> 00:52:27,140 in a way? 1447 00:52:28,960 --> 00:52:30,519 There's a lot of hope. 1448 00:52:30,520 --> 00:52:32,139 Well, making progress this all the time. 1449 00:52:32,140 --> 00:52:34,389 What I think, what I presented there is 1450 00:52:34,390 --> 00:52:36,519 both the good and the bad because 1451 00:52:36,520 --> 00:52:38,919 we see that over time, things progress. 1452 00:52:38,920 --> 00:52:41,169 But new attacks come up 1453 00:52:41,170 --> 00:52:43,449 and this is the way 1454 00:52:43,450 --> 00:52:45,969 the world is everywhere. 1455 00:52:45,970 --> 00:52:48,099 It's too bad that in our well, we don't 1456 00:52:48,100 --> 00:52:50,169 hear about these components most 1457 00:52:50,170 --> 00:52:51,959 of the time, which is why I wanted to 1458 00:52:51,960 --> 00:52:53,179 talk. 1459 00:52:53,180 --> 00:52:54,429 Okay, so we have to fix. 1460 00:52:58,890 --> 00:53:01,049 I have one other question is a bit of a 1461 00:53:01,050 --> 00:53:02,819 presentation technical question. 1462 00:53:02,820 --> 00:53:04,889 Why are the slides 1463 00:53:04,890 --> 00:53:06,989 marked with confidential? 1464 00:53:06,990 --> 00:53:09,119 Oh, oops! 1465 00:53:13,990 --> 00:53:14,990 Thank you. 1466 00:53:16,730 --> 00:53:18,499 Answer is company template. 1467 00:53:24,030 --> 00:53:25,919 But now, you know, company secrets, I 1468 00:53:25,920 --> 00:53:27,749 have to kill all of you. 1469 00:53:27,750 --> 00:53:28,750 Please line up. 1470 00:53:31,590 --> 00:53:33,269 OK. Any other questions? 1471 00:53:34,940 --> 00:53:35,940 Go ahead. 1472 00:53:37,050 --> 00:53:39,539 One often answer to the previous 1473 00:53:39,540 --> 00:53:41,939 question until SGX 1474 00:53:41,940 --> 00:53:44,129 is upcoming, writes software, software, 1475 00:53:44,130 --> 00:53:45,130 guard extensions. 1476 00:53:46,140 --> 00:53:48,779 It has had a nice 1477 00:53:48,780 --> 00:53:50,969 welcome on invisible things, 1478 00:53:50,970 --> 00:53:53,129 and it 1479 00:53:53,130 --> 00:53:54,689 looks good for now. 1480 00:53:54,690 --> 00:53:56,189 I think they removed a lot of legacy 1481 00:53:56,190 --> 00:53:58,289 stuff there or rather circumvented that. 1482 00:53:59,490 --> 00:54:01,409 But we'll see how good it holds up to 1483 00:54:01,410 --> 00:54:02,410 when it's actually released. 1484 00:54:03,660 --> 00:54:04,949 And the other thing is for 1485 00:54:04,950 --> 00:54:06,359 virtualization, you don't need talked 1486 00:54:06,360 --> 00:54:07,769 about virtualization, hardware, 1487 00:54:07,770 --> 00:54:09,749 virtualization you need when you want to 1488 00:54:09,750 --> 00:54:11,969 virtualized windows, which you don't 1489 00:54:11,970 --> 00:54:13,619 do it for security, for security, you 1490 00:54:13,620 --> 00:54:15,179 don't use windows in the first place. 1491 00:54:17,550 --> 00:54:20,099 So I'll answer, and 1492 00:54:20,100 --> 00:54:22,169 you have two different statements here. 1493 00:54:22,170 --> 00:54:24,239 If you want to talk about SGX, I'd love 1494 00:54:24,240 --> 00:54:26,339 to. I was the head of product 1495 00:54:26,340 --> 00:54:28,619 security for SGX until three months 1496 00:54:28,620 --> 00:54:29,620 ago. 1497 00:54:31,560 --> 00:54:33,929 And basically, SGX is really a great 1498 00:54:33,930 --> 00:54:36,059 step in the right direction because what 1499 00:54:36,060 --> 00:54:38,489 SGX says is let's instead 1500 00:54:38,490 --> 00:54:40,619 of trying to solve the to secure the 1501 00:54:40,620 --> 00:54:43,019 entire platform, let's secure a small 1502 00:54:43,020 --> 00:54:45,149 part a small island for 1503 00:54:45,150 --> 00:54:47,039 each application, the latest thing that 1504 00:54:47,040 --> 00:54:49,109 we want to protect and 1505 00:54:49,110 --> 00:54:51,299 deal with the rest later. 1506 00:54:51,300 --> 00:54:53,969 But this still, 1507 00:54:53,970 --> 00:54:54,899 this is one thing. 1508 00:54:54,900 --> 00:54:57,089 The other thing is you don't 1509 00:54:57,090 --> 00:54:58,869 need to use out of all virtualization. 1510 00:54:58,870 --> 00:55:01,139 I think that the binary translation 1511 00:55:01,140 --> 00:55:03,359 based virtualization is even worse 1512 00:55:03,360 --> 00:55:04,799 than hardware in security. 1513 00:55:04,800 --> 00:55:05,309 You use 1514 00:55:05,310 --> 00:55:06,310 virtualization. 1515 00:55:07,020 --> 00:55:08,429 I mean, you're right, there's still an 1516 00:55:08,430 --> 00:55:09,809 interface. 1517 00:55:09,810 --> 00:55:11,849 But the point is the interface is at the 1518 00:55:11,850 --> 00:55:13,829 same level where the people are that are 1519 00:55:13,830 --> 00:55:15,299 implementing the virtualization. 1520 00:55:15,300 --> 00:55:17,429 So they know that stuff usually or for 1521 00:55:17,430 --> 00:55:19,049 the largest part, it's different. 1522 00:55:19,050 --> 00:55:20,309 When you have hardware virtualization, 1523 00:55:20,310 --> 00:55:23,129 you're breaking abstraction. 1524 00:55:23,130 --> 00:55:25,379 Basically, the VMware or whoever 1525 00:55:25,380 --> 00:55:26,969 is implementing your hypervisor kernel 1526 00:55:26,970 --> 00:55:29,039 program as they have, 1527 00:55:29,040 --> 00:55:31,229 they know the hardware, but they are not 1528 00:55:31,230 --> 00:55:33,329 until they are not processing engineers. 1529 00:55:33,330 --> 00:55:34,589 They don't know all the bits or the 1530 00:55:34,590 --> 00:55:35,789 internal workings. 1531 00:55:35,790 --> 00:55:37,319 The point of abstraction is that you 1532 00:55:37,320 --> 00:55:39,209 don't have to care about that, that your 1533 00:55:39,210 --> 00:55:40,199 software runs. 1534 00:55:40,200 --> 00:55:42,149 Also, if you have the newest, as you say, 1535 00:55:42,150 --> 00:55:43,679 the newest hardware, an older version of 1536 00:55:43,680 --> 00:55:45,479 the hardware, and that's why you should 1537 00:55:45,480 --> 00:55:47,549 use power virtualization, which is 1538 00:55:47,550 --> 00:55:49,349 actually the fault. 1539 00:55:49,350 --> 00:55:51,479 There was the hardware extensions 1540 00:55:51,480 --> 00:55:53,549 like until V3 and there 1541 00:55:53,550 --> 00:55:56,159 was virtualization for Linux. 1542 00:55:56,160 --> 00:55:58,349 There was an attempt for Windows. 1543 00:55:58,350 --> 00:56:00,299 I think the primary reason for the 1544 00:56:00,300 --> 00:56:02,789 hardware celebration hardware accelerated 1545 00:56:02,790 --> 00:56:04,979 virtualization is that people wanted 1546 00:56:04,980 --> 00:56:06,300 to virtualized windows on servers. 1547 00:56:07,740 --> 00:56:09,989 I would say that there were a lot 1548 00:56:09,990 --> 00:56:12,099 of reasons to do a lot of the other 1549 00:56:12,100 --> 00:56:14,129 based virtualization, basically to be 1550 00:56:14,130 --> 00:56:16,439 able to virtualized things without 1551 00:56:16,440 --> 00:56:18,629 compiling support into the code, 1552 00:56:18,630 --> 00:56:20,669 which is fairly important. 1553 00:56:20,670 --> 00:56:23,069 I think that history shows that 1554 00:56:23,070 --> 00:56:25,829 overall that personalization 1555 00:56:25,830 --> 00:56:27,809 is that a lot of weaknesses. 1556 00:56:27,810 --> 00:56:29,699 And basically it's very similar to the 1557 00:56:29,700 --> 00:56:32,669 model of system cores, which we know 1558 00:56:32,670 --> 00:56:34,889 work for privilege escalations 1559 00:56:34,890 --> 00:56:38,399 into the operating system even in 2013, 1560 00:56:38,400 --> 00:56:40,859 even with all the modern protections now. 1561 00:56:40,860 --> 00:56:42,329 I'm not arguing what you are saying. 1562 00:56:42,330 --> 00:56:44,519 This is this is another approach which 1563 00:56:44,520 --> 00:56:46,769 is useful, but 1564 00:56:46,770 --> 00:56:48,329 nothing is foolproof. 1565 00:56:48,330 --> 00:56:50,429 And it just you need to take the 1566 00:56:50,430 --> 00:56:52,109 pluses and minuses, and I'd love to 1567 00:56:52,110 --> 00:56:54,359 continue talking just coming over 1568 00:56:54,360 --> 00:56:55,829 after the talk. But I think the guy 1569 00:56:55,830 --> 00:56:57,209 behind you wants to ask questions. 1570 00:56:57,210 --> 00:56:58,210 Well, so 1571 00:56:59,100 --> 00:57:01,649 it's kind of on a related note, I think 1572 00:57:01,650 --> 00:57:03,899 I remember reading about running 1573 00:57:03,900 --> 00:57:05,879 applications directly on top of the V, 1574 00:57:05,880 --> 00:57:08,189 directly on top of the hypervisor without 1575 00:57:08,190 --> 00:57:09,780 a VM as such. 1576 00:57:11,640 --> 00:57:13,859 Most of your talk was about how how 1577 00:57:13,860 --> 00:57:16,139 broad the attack vector is and 1578 00:57:16,140 --> 00:57:18,269 would that would that reduce the problems 1579 00:57:18,270 --> 00:57:20,130 enough to consider it safe? 1580 00:57:21,240 --> 00:57:23,999 Yeah, but if you run applications? 1581 00:57:24,000 --> 00:57:25,409 Let me just be clear that you are 1582 00:57:25,410 --> 00:57:27,719 suggesting to run an application in 1583 00:57:27,720 --> 00:57:29,939 which mode sort of like 1584 00:57:29,940 --> 00:57:32,579 in the kernel of the vessel, 1585 00:57:32,580 --> 00:57:34,289 not in the kernel of the hypervisor on 1586 00:57:34,290 --> 00:57:35,939 top of the hypervisor. 1587 00:57:35,940 --> 00:57:37,229 I'm not sure exactly how it was 1588 00:57:37,230 --> 00:57:39,299 implemented, whether it has 1589 00:57:39,300 --> 00:57:41,969 the ability to access the hardware itself 1590 00:57:41,970 --> 00:57:43,439 or limited hardware. 1591 00:57:43,440 --> 00:57:45,420 I'm not sure exactly how it's 1592 00:57:46,590 --> 00:57:47,609 it's a vague memory. 1593 00:57:47,610 --> 00:57:49,859 And do you know anything 1594 00:57:49,860 --> 00:57:50,879 about it? 1595 00:57:50,880 --> 00:57:52,859 I'm not familiar with what you're talking 1596 00:57:52,860 --> 00:57:53,489 about. Is this 1597 00:57:53,490 --> 00:57:54,490 aggregated 1598 00:57:55,390 --> 00:57:57,209 or disaggregated 1599 00:57:57,210 --> 00:57:59,549 the disaggregating zen paper, which 1600 00:57:59,550 --> 00:58:01,229 may be not exactly what you mean by that. 1601 00:58:01,230 --> 00:58:03,479 It's an effort to, well, 1602 00:58:03,480 --> 00:58:04,409 just aggregate Zen. 1603 00:58:04,410 --> 00:58:06,449 So two to split Zen into multiple parts 1604 00:58:06,450 --> 00:58:08,999 because Zen basically has a trusted 1605 00:58:09,000 --> 00:58:10,129 domain. Zero. 1606 00:58:10,130 --> 00:58:12,209 You mean something like cubes OS 1607 00:58:13,410 --> 00:58:14,489 cubes. 1608 00:58:14,490 --> 00:58:16,080 Do you mean cubes of 1609 00:58:17,100 --> 00:58:18,210 invisible things that? 1610 00:58:19,920 --> 00:58:21,659 Think so. 1611 00:58:21,660 --> 00:58:23,969 And the other part would be the colonel 1612 00:58:23,970 --> 00:58:26,279 that could run as a hype or this Michael 1613 00:58:26,280 --> 00:58:28,349 conviction that also do virtualization at 1614 00:58:28,350 --> 00:58:29,999 the same time so they could run native 1615 00:58:30,000 --> 00:58:32,279 tasks at the same time also 1616 00:58:32,280 --> 00:58:34,320 run or as tasks. 1617 00:58:37,080 --> 00:58:39,209 I'm sorry, I failed on 1618 00:58:39,210 --> 00:58:41,399 the standard definition Hill. 1619 00:58:41,400 --> 00:58:43,649 Please come by, I'll give you my email 1620 00:58:43,650 --> 00:58:45,719 and we can talk about this 1621 00:58:45,720 --> 00:58:46,720 much today. 1622 00:58:47,820 --> 00:58:49,889 All right, and a final question. 1623 00:58:51,570 --> 00:58:53,849 If not, I suggest we give 1624 00:58:53,850 --> 00:58:56,190 Mr. Desiccant a warm applause.