Week 6

Question 1

What are virtual machines and what are the technical support for it?

Answer 1

Running different operating systems on the same machine is virtualisation.
There is:
Software Layer - Hypervisor for virtualising and managing resources
Hardware Layer - Hardware extensions like Intel VT-x for improving performance

Question 1

What is confinement and what are the levels of it?

Answer 1

Restricting the impact of a compromised component on other components. It can be on the OS level or Process level

Question 2

What are the benefits of Virtualisation?

Answer 2

Can perform malware analysis on it
The malware cannot cause damages outside the VM
The behaviour can be observed from the host OS

Question 3

What are the limitations of Virtualisation?

Answer 3

1. The hypervisor increases the surface area, making it a potential target for attackers
2. The hypervisor operates with a higher priority than the OS kernel so if the attacker compromises it, they can gain full control of the system
3. Multiple VMs share the same hardware resources so the performance can be affected

TLDR: Large code base, More privilege, Share hardware resource

Question 4

Challenges of malware analysis with virtualisation?

Answer 4

1. It may not run with trusted Execution Environment (TEE)
2. There may be semantic gaps between high level activities in the VM and observed low level behaviours
3. A smart malware could figure out they are running in a VM, not the actual environment