How can I be sure that my server is not virtualised?

Question

How can I make sure that my Linux server is running on a non-virtualised real box?

This is the scenario I am thinking of:

1. I install some distro on a rack-mounted server,
2. I rent some rack space on in a data-center and leave it there,
3. Mallory ("the attacker") goes to the data-center disconnects my server,
4. Mallory takes an image of the disk,
5. Mallory runs the disk image as a guest on a KVM box.

Suppose, for the sake of this question, that the attacker

• has modified KVM, or any similar hypervisor, to simulate exactly the same hardware my server was running on,
• knows all the known escape-the-hypervisor or detect-the-hypervisor attacks and has patched the hypervisor to counteract them (so no Red pill and similar).

So my question is: will there ever be solid ways to make sure that an OS is running on a physical box (or on one precise physical box), ways that do not rely on virtualisation flaws (like Red pill)?

Or the other way around: are there proofs that such kind of detections will always be possible?

Clarification: this is an hypothetical question, not a discussion about current technologies. Currently it is quite easy to detect whether I am in a virtualised environment, just use imvirt and its collection of known virtualisation glitches/flaws. I would like to know if things like "perfect virtualisation" has been discussed and found possible or impossible from a theoretical point of view.

Answer 1

You assume that the attacker has made a virtual machine that perfectly emulates your hardware. Under this assumption, then by definition you can't detect that your code is running in the virtual machine.

If the virtual machine is in fact running on the real hardware, you should be able to detect it from the outside, because the overhead of the virtualization is likely to introduce some additional response latency. The overhead may not be noticeable above other network overhead. If the virtual machine is running on faster hardware, it may provide a perfect emulation, in theory.

In practice, it would be extremely difficult to provide perfect hardware emulation. (This is something operating systems and driver developers would like, and unfortunately for them emulators aren't perfect.) Sure, it's possible in theory, but there would be cheaper attack methods for the attacker. You're postulating physical access; the attacker could plant a hidden rootkit, or put a spy on the PCI or RAM bus: that would cost less than developing perfect emulators for all the hardware that's around. Or, even more likely, Mallory would exploit a software hole, phish a password, or as a last resort use wrench cryptanalysis, if she was really bothered.

Copying the data and planting the rootkit is by far the easiest attack method. You can protect against this to some extent by using a TPM in your server. TPMs are designed to be hard to replicate, and if used correctly (note: this is difficult! There are currently no off-the-shelf operating systems that verify the entire OS's integrity from a TPM root of trust.) the TPM can protect the integrity and confidentiality of your operating system and its data.

Answer 2

In theory, I think it would be possible if someone would make a virtual machine which mimics all physical parts of a computer. And by 'mimic' I understand that it would have processor which reports that it's a specific physical processor, a chipset which reports that it is a specific chipset, a BIOS, disk, etc.

I think, from a purely technical point of view, that it is doable. On the other hand, from a practical point of view it will probably never be done. Why would someone invest an enormous amount of money and man power to provide a virtual computer perfectly mimicking something so ephemeral that a specific hardware version? By the time they would finish building that virtual solution the hardware would be out of use.

Answer 3

In short no. There is no guarantee. However, as I understand it, currently, there isn't any virtualization solution that can take an running kernel and use it in a virtualization environment. The Mallory character would need to install a guest virtualization kernel in order to run it in a vm. So the easiest way to check would be to check what kernel is running.

My answer is no because, as a security question, I think it's a matter of how determine Mallory is at preventing you from figuring out what kernel is running AND becuase I imagine there may be a solution some day to the issue of a different kernel used for virtualization.

Answer 4

Use dmidecode. DMI data contains things about the physical hardware youre running on. This includes things like the model, serial number, etc. I know of no hypervisor that is capable of forging this information.

Sample portion of dmidecode output:

System Information
Manufacturer: HP
Product Name: ProLiant DL360 G5
Version: Not Specified
Serial Number: MXQ643K6F8      
UUID: 93403131-8718-4D72-2834-917461184750
Wake-up Type: Power Switch
SKU Number: 470064-513      
Family: ProLiant

While it would be technically possible to forge it by modifying the hypervisor code in cases like KVM, doing so would be unreasonable. The person doing so would lose the ability to update the hypervisor whenever new versions are released. They would have to make all their changes again.

Another possibility would be the mac address. If they moved your OS onto a virtual machine, its mac address would have to change or they would no longer be able to use the physical hardware you were on on the same network anymore or it'll cause mac address conflicts.

Answer 5

Joanna Rutkowska did say something about that on early Black Hat Conferences. While a "Blue Pill" will take your machine into a VM layer, a Red Pill will help you detect if you are inside a VM. Those Terms are based on the Matrix-films. ;-)

Answer 6

If the virtualized hardware would look exactly like the hardware of the real computer, then there would be no way of knowing.

So, the answer is "no", but it is a theoretical answer for a theoretical question.

On the other hand, if the virtualization was not perfect, but slower than the actual hardware, the performance could be tested and the numbers could be compared with the real numbers.