Virtualization Detection : New Strategies and Their Effectiveness

Previous methods for detecting execution within a virtual machine monitor have typically focused on specific anomalies of the implementation [4][14], have required running in kernel mode [5], or have been mitigated by newer versions of processor virtualization extensions [16]. We analyze a a basic non-privileged loop benchmarking test against MAVMM, a VMM designed for transparency [11]. We also implement and analyze the “counter-based timing” method discussed in [6][16], and a low-level cache interaction test using the sensitive unprivileged instruction CPUID. All of our implementations focus on detection from within the VMM, and without privileged instructions. Our results show that even virtual machine monitors specially designed to maximize their transparency and to prevent detection are susceptible to simple timing benchmarks. Additionally, we find that counter-based timing methods and low-level cache effects methods can distinguish execution in a virtual machine monitor from native execution. We also discuss how cache-flushing based methods are more complicated than previous work has suggested.