Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How can I make sure that my Linux server is running on a non-virtualised real box?

This is the scenario I am thinking of:

  1. I install some distro on a rack-mounted server,
  2. I rent some rack space on in a data-center and leave it there,
  3. Mallory ("the attacker") goes to the data-center disconnects my server,
  4. Mallory takes an image of the disk,
  5. Mallory runs the disk image as a guest on a KVM box.

Suppose, for the sake of this question, that the attacker

  • has modified KVM, or any similar hypervisor, to simulate exactly the same hardware my server was running on,
  • knows all the known escape-the-hypervisor or detect-the-hypervisor attacks and has patched the hypervisor to counteract them (so no Red pill and similar).

So my question is: will there ever be solid ways to make sure that an OS is running on a physical box (or on one precise physical box), ways that do not rely on virtualisation flaws (like Red pill)?

Or the other way around: are there proofs that such kind of detections will always be possible?

Clarification: this is an hypothetical question, not a discussion about current technologies. Currently it is quite easy to detect whether I am in a virtualised environment, just use imvirt and its collection of known virtualisation glitches/flaws. I would like to know if things like "perfect virtualisation" has been discussed and found possible or impossible from a theoretical point of view.

share|improve this question
3  
I don't think the question is well-formed. You're asking a question where the attacker has hypothetical capabilities (modified KVM to be indistinguishable, knows all methods of detection) then asking if the attacker has the very capabilities we just supposed that he had! If we assume he has them, then he has them. Your question assumes perfect virtualization, then asks if it is possible. If we assume it, it's possible. –  David Schwartz Feb 5 '12 at 6:24
1  

6 Answers 6

up vote 3 down vote accepted

You assume that the attacker has made a virtual machine that perfectly emulates your hardware. Under this assumption, then by definition you can't detect that your code is running in the virtual machine.

If the virtual machine is in fact running on the real hardware, you should be able to detect it from the outside, because the overhead of the virtualization is likely to introduce some additional response latency. The overhead may not be noticeable above other network overhead. If the virtual machine is running on faster hardware, it may provide a perfect emulation, in theory.

In practice, it would be extremely difficult to provide perfect hardware emulation. (This is something operating systems and driver developers would like, and unfortunately for them emulators aren't perfect.) Sure, it's possible in theory, but there would be cheaper attack methods for the attacker. You're postulating physical access; the attacker could plant a hidden rootkit, or put a spy on the PCI or RAM bus: that would cost less than developing perfect emulators for all the hardware that's around. Or, even more likely, Mallory would exploit a software hole, phish a password, or as a last resort use wrench cryptanalysis, if she was really bothered.

Copying the data and planting the rootkit is by far the easiest attack method. You can protect against this to some extent by using a TPM in your server. TPMs are designed to be hard to replicate, and if used correctly (note: this is difficult! There are currently no off-the-shelf operating systems that verify the entire OS's integrity from a TPM root of trust.) the TPM can protect the integrity and confidentiality of your operating system and its data.

share|improve this answer

In short no. There is no guarantee. However, as I understand it, currently, there isn't any virtualization solution that can take an running kernel and use it in a virtualization environment. The Mallory character would need to install a guest virtualization kernel in order to run it in a vm. So the easiest way to check would be to check what kernel is running.

My answer is no because, as a security question, I think it's a matter of how determine Mallory is at preventing you from figuring out what kernel is running AND becuase I imagine there may be a solution some day to the issue of a different kernel used for virtualization.

share|improve this answer
1  
Most full-machine virtualization solutions (as opposed to e.g. Linux-on-Linux) do run an ordinary kernel. Checking what kernel is running is useless. There will be differences, but in terms of hardware information, timings, available resources… –  Gilles Feb 4 '12 at 22:53
    
@Gilles I'm probably using incorrect terminology then. I'm referring to the difference between, for example, the kernel.rpm vs the kernel-devel.rpm. I understand this is a very specific example, which is why I tried to make the initial response very non-specific. –  frogstarr78 Feb 5 '12 at 3:22

Use dmidecode. DMI data contains things about the physical hardware youre running on. This includes things like the model, serial number, etc. I know of no hypervisor that is capable of forging this information.

Sample portion of dmidecode output:

System Information
Manufacturer: HP
Product Name: ProLiant DL360 G5
Version: Not Specified
Serial Number: MXQ643K6F8      
UUID: 93403131-8718-4D72-2834-917461184750
Wake-up Type: Power Switch
SKU Number: 470064-513      
Family: ProLiant

While it would be technically possible to forge it by modifying the hypervisor code in cases like KVM, doing so would be unreasonable. The person doing so would lose the ability to update the hypervisor whenever new versions are released. They would have to make all their changes again.

Another possibility would be the mac address. If they moved your OS onto a virtual machine, its mac address would have to change or they would no longer be able to use the physical hardware you were on on the same network anymore or it'll cause mac address conflicts.

share|improve this answer
    
Blue pill virtualisation cannot be detected using DMI/SMBIOS data (such request are passed straight to the underlying hardware). –  gioele Feb 4 '12 at 19:16
    
@gioele interesting, I was not aware of that hypervisor. So I guess I am incorrect. But does that article you linked not also answer your question? In summary it states that while the ability to detect the hypervisor is in dispute, there is currently no proven way. So you would not be able to. –  Patrick Feb 4 '12 at 19:33
    
it would also be easy for a nefarious sysadmin do "redirect" this, and other similar tools, reporting technically inaccurate information. –  frogstarr78 Feb 5 '12 at 3:21

In theory, I think it would be possible if someone would make a virtual machine which mimics all physical parts of a computer. And by 'mimic' I understand that it would have processor which reports that it's a specific physical processor, a chipset which reports that it is a specific chipset, a BIOS, disk, etc.

I think, from a purely technical point of view, that it is doable. On the other hand, from a practical point of view it will probably never be done. Why would someone invest an enormous amount of money and man power to provide a virtual computer perfectly mimicking something so ephemeral that a specific hardware version? By the time they would finish building that virtual solution the hardware would be out of use.

share|improve this answer
    
And even if they could mimic perfectly a single set of hardware, it could be detected with high accuracy by looking for that exact combination of hardware specifications. –  Alexander Feb 5 '12 at 0:34

Joanna Rutkowska did say something about that on early Black Hat Conferences. While a "Blue Pill" will take your machine into a VM layer, a Red Pill will help you detect if you are inside a VM. Those Terms are based on the Matrix-films. ;-)

share|improve this answer

If the virtualized hardware would look exactly like the hardware of the real computer, then there would be no way of knowing.

So, the answer is "no", but it is a theoretical answer for a theoretical question.

On the other hand, if the virtualization was not perfect, but slower than the actual hardware, the performance could be tested and the numbers could be compared with the real numbers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.