Virtualization for Security: Including Sandboxing, Disaster Recovery, High Availability, Forensic Analysis, and Honeypotting

Copyright Page......Page 1
Technical Editor......Page 2
Contributing Authors\r......Page 3
An Introduction to Virtualization......Page 7
What Is Virtualization?......Page 8
The Atlas Computer......Page 9
CP/CMS\r......Page 10
Other Time-Sharing Projects......Page 11
Virtualization Explosion of the 1990s and Early 2000s......Page 12
The Answer: Virtualization Is…......Page 14
Decentralization versus Centralization......Page 15
True Tangible Benefits......Page 19
Consolidation......Page 21
Reliability......Page 23
Security......Page 24
How Does Virtualization Work?......Page 25
OS Relationships with the CPU Architecture......Page 26
The Virtual Machine Monitor and Ring-0 Presentation......Page 28
The VMM Role Explored......Page 29
The Popek and Goldberg Requirements......Page 30
The Challenge: VMMs for the x86 Architecture......Page 31
Server Virtualization......Page 32
Storage Virtualization......Page 35
Network Virtualization......Page 36
Application Virtualization......Page 37
Technology Refresh......Page 38
Business Continuity and Disaster Recovery......Page 40
Virtual Desktops......Page 41
Rapid Development, Test Lab, and Software Configuration Management......Page 42
What Is Virtualization?......Page 44
How Does Virtualization Work?......Page 45
Common Use Cases for Virtualization......Page 46
Frequently Asked Questions......Page 48
Choosing the Right Solution for the Task......Page 50
Issues and Considerations That Affect Virtualization Implementations......Page 51
Redundancy......Page 52
Security......Page 53
Production......Page 54
Grid......Page 55
Library Emulation......Page 56
Wine......Page 57
Processor Emulation......Page 58
Application Virtualization......Page 59
Dedicated Hardware......Page 60
Hardware Compatibility......Page 61
Paravirtualization......Page 62
Hardware Virtualization......Page 63
Summary......Page 65
Distinguishing One Type of Virtualization from Another......Page 66
Frequently Asked Questions......Page 67
Building a Sandbox......Page 68
Sandbox Background......Page 69
The Visible Sandbox......Page 70
cwsandbox.exe......Page 73
cwmonitor.dll......Page 74
Existing Sandbox Implementations......Page 77
Describing CWSandbox......Page 79
Setting Up Linux......Page 83
Setting Up a Virtual Machine in VMware Server......Page 85
Setting Up Windows XP Professional in the Virtual Machine......Page 86
Setting Up CWSandbox v2.x in Windows XP Professional......Page 87
Configuring Linux and VMware Server for Live DVD Creation......Page 88
Updating Your Live DVD......Page 90
Sandbox Background......Page 91
Describing CWSandbox......Page 92
Creating a Live DVD with VMware and CWSandbox......Page 93
Frequently Asked Questions......Page 94
Bibliography......Page 95
Configuring the Virtual Machine......Page 96
Hard Drive and Network Configurations......Page 97
Virtual Disk Types......Page 98
Creating an Interface......Page 99
Bridged......Page 100
Host-Only......Page 101
Natted......Page 102
Multiple Interfaces......Page 103
Physical Disks......Page 104
USB Devices......Page 108
Cut and Paste......Page 109
How to Install the VMware Tools in a Virtual Machine......Page 110
How to Install the Virtual Machine Additions in Virtual PC......Page 117
Hard Drive and Network Configurations......Page 118
Interfacing with the Host......Page 119
Frequently Asked Questions......Page 120
Honeypotting......Page 121
Herding of Sheep......Page 122
Gen I......Page 124
Where to Put It......Page 125
Distributed Network......Page 126
Layer 2 Bridges......Page 127
Honeymole......Page 129
Multiple Remote Networks......Page 130
Intrusion Detection......Page 134
Network Traffic Capture......Page 135
Monitoring on the Box......Page 136
How to Set Up a Realistic Environment......Page 137
Setting Up the Network......Page 138
Keeping the Bad Stuff in......Page 144
Detecting the Attack......Page 145
How to Set Up a Realistic Environment......Page 146
Note......Page 147
Malware Analysis......Page 148
Setting the Stage......Page 149
Don’t Propagate It Yourself......Page 150
You Should Have a Variety of Content to Offer......Page 151
Making the Local Network More Real......Page 152
Testing on VMware Workstation......Page 154
Microsoft Virtual PC......Page 156
What Is the Malware’s Purpose?......Page 157
Does the Malware Phone Home for Updates?......Page 158
Does the Malware Send the Spoils Anywhere?......Page 159
How Does the Malware Hide and How Can It Be Detected?......Page 160
How Do You Recover from It?......Page 161
The  Section......Page 162
Analysis of 82f78a89bde09a71ef99b3cedb991bcc.exe......Page 163
Analysis of arman.exe......Page 165
Interpreting an Analysis Report......Page 170
How Does the Bot Install?......Page 171
Finding Out How New Hosts Are Infected......Page 172
How Does the Bot Protect the Local Host and Itself?......Page 174
Determing How/Which \nC&C Servers Are Contacted......Page 177
How Does the Bot Get Binary Updates?......Page 178
What Malicious Operations Are Performed?......Page 179
Bot-Related Findings of Our Live Sandbox......Page 184
Antivirtualization Techniques......Page 186
VMware I/O Port......Page 187
MAC Addresses......Page 188
PCI Identifiers......Page 189
Detecting You Are in a Hypervisor Environment......Page 190
Antivirtualization Techniques......Page 191
Frequently Asked Questions......Page 192
Malware Analysis\r......Page 193
Getting Up to Speed Quickly......Page 194
Copying a Machine in VMware Server......Page 195
Registering a Machine in Microsoft Virtual Server......Page 197
Known Good Starting Point......Page 198
VMware’s Appliance Program......Page 199
Microsoft’s Test Drive Program......Page 200
Kernel Level Debugging......Page 201
The Advantage of Open Source Virtualization......Page 209
Debugging......Page 210
Frequently Asked Questions......Page 211
Fuzzing......Page 212
What Is Fuzzing?......Page 213
Using a Clean Slate......Page 215
Setting Up the Debugging Tools......Page 216
Preparing to Take Input......Page 218
Taking the Snapshot......Page 219
Scripting Snapshot Startup......Page 220
Interacting with the Application......Page 221
Selecting Test Data......Page 222
Checking for Exceptions......Page 223
Running Concurrent Tests......Page 224
Choosing an Effective Starting Point......Page 226
Executing the Test......Page 227
Frequently Asked Questions......Page 228
Forensic Analysis......Page 229
Introduction......Page 230
Preparing Your Forensic Environment......Page 231
Capturing the Machine......Page 232
Preparing the Captured Machine to Boot on New Hardware......Page 238
What Can Be Gained by Booting the Captured Machine?......Page 239
The System May Have Proprietary/Old Files That Require Special Software......Page 242
Easier to Get in the Mind-Set of the Suspect......Page 243
Collecting Intelligence about a Case......Page 244
Performing Forensics of a Virtual Machine......Page 245
Caution: VM-Aware Malware Ahead......Page 247
Preparing Your Forensic Environment......Page 249
Preparing the Captured Machine to Boot on New Hardware......Page 250
What Can Be Gained by Booting the Captured Machine?......Page 251
Frequently Asked Questions......Page 253
Disaster Recovery......Page 255
Disaster Recovery in a Virtual Environment......Page 256
File Level Backup and Restore......Page 257
System-Level Backup and Restore......Page 258
Shared Storage Backup and Restore......Page 259
Allowing Greater Variation in Hardware Restoration......Page 261
Using Virtualization for \nRecovery of Physical Systems......Page 262
Using Virtualization for \nRecovery of Virtual Systems......Page 263
Redistributing the Data Center......Page 265
Summary......Page 267
Allowing Greater Variation in Hardware restoration......Page 268
Redistributing the Data Center......Page 269
Frequently Asked Questions......Page 270
High Availability: Reset to Good......Page 271
Understanding High Availability......Page 272
Providing High Availability for Planned Downtime......Page 273
Providing High Availability for Unplanned Downtime......Page 274
Utilizing Vendor Tools to Reset to Good......Page 275
Degrading over Time......Page 277
Configuring the Network......Page 278
Setting Up a Pool or Cluster of Servers......Page 279
Monitoring for Overcommitment of Resources......Page 280
Security Implications......Page 281
Performing Maintenance on a High Availability System......Page 282
Summary......Page 284
Maintaining High Availability......Page 285
Frequently Asked Questions......Page 287
Best of Both Worlds: Dual Booting......Page 288
How to Set Up Linux to Run Both Natively and Virtually......Page 289
Creating a Partition for Linux on an Existing Drive......Page 290
Setting Up Dual Hardware Profiles......Page 294
Booting a Suspended Partition......Page 295
Changing Hardware Configurations Can Affect Your Software......Page 296
Issues with Running Windows Both Natively and Virtualized......Page 298
Frequently Asked Questions......Page 299
Protection in Untrusted Environments......Page 300
Meaningful Uses of \rVirtualization in Untrusted Environments......Page 301
Levels of Malware Analysis Paranoia......Page 307
Using Virtual Machines to Segregate Data......Page 315
Using Virtual Machines \rto Run Software You Don’t Trust......Page 317
Using Virtual Machines for Users You Don’t Trust......Page 320
Restricting Software Access......Page 321
Scripting the Restore......Page 322
Using Virtual Machines to Run Software You Don’t Trust......Page 324
Using Virtual Machines for Users You Don’t Trust......Page 325
Frequently Asked Questions......Page 326
Notes......Page 327
Training......Page 328
Setting Up Scanning Servers......Page 329
Customization......Page 330
Default Platforms As Well to Use a Variety of Tools......Page 331
Scanning Servers in a Virtual Environment......Page 332
Setting Up Target Servers......Page 333
Suggested Vulnerabilities for Windows......Page 334
Suggested Vulnerabilities for Application Vulnerability Testing......Page 335
Harder Targets......Page 338
Snapshots Saved Us......Page 339
Multiple Servers Requiring Chained Attacks......Page 340
Loose Points for Damaging the Environment......Page 341
Cleaning up Afterward......Page 342
Saving Your Back......Page 343
Creating the Capture-the-Flag Scenario......Page 344
Saving Your Back......Page 345
Frequently Asked Questions......Page 346
D\r......Page 347
F\r......Page 348
H\r......Page 349
M\r......Page 350
S\r......Page 351
T\r......Page 352
V\r......Page 353
X\r......Page 355