How can I make sure that my Linux server is running on a non-virtualised real box?
This is the scenario I am thinking of:
- I install some distro on a rack-mounted server,
- I rent some rack space on in a data-center and leave it there,
- Mallory ("the attacker") goes to the data-center disconnects my server,
- Mallory takes an image of the disk,
- Mallory runs the disk image as a guest on a KVM box.
Suppose, for the sake of this question, that the attacker
- has modified KVM, or any similar hypervisor, to simulate exactly the same hardware my server was running on,
- knows all the known escape-the-hypervisor or detect-the-hypervisor attacks and has patched the hypervisor to counteract them (so no Red pill and similar).
So my question is: will there ever be solid ways to make sure that an OS is running on a physical box (or on one precise physical box), ways that do not rely on virtualisation flaws (like Red pill)?
Or the other way around: are there proofs that such kind of detections will always be possible?
Clarification: this is an hypothetical question, not a discussion about current technologies. Currently it is quite easy to detect whether I am in a virtualised environment, just use imvirt
and its collection of known virtualisation glitches/flaws. I would like to know if things like "perfect virtualisation" has been discussed and found possible or impossible from a theoretical point of view.