Wake up Neo: detecting virtualization through speculative execution

No ratings

Presented at CODEBLUE2018@TOKYO 2018 by

Innokentii Sennovskii

There has been several Speculative Execution vulnerabilities allowing to read privileged data from kernel mode, other processes and even hypervisors. However, there are several more ways in which speculative execution can be leveraged by adversaries. I have discovered one such technique, which allows the attacker on the system to get information allowing them to evade detection by modern sandboxes and AV software. This technique led to the discovery of Spectre Variant 3a virtualization detection vulnerability in Intel CPUs but can also be used in a few more ways. In this talk I'll explain the principles behind speculative execution vulnerabilities and talk about the detector technique.