Hypervisors: Now a Tool to Protect against Security Blind Spots

Plenty of ink has been used to discuss WannaCry, and rightfully, since ransomware itself is a significant security challenge. What has been largely missed is that WannaCry is just one attack that took advantage of EternalBlue, and that EternalBlue itself is an example of how attackers take advantage of security blind spots.

What Is EternalBlue?
On April 14, an anonymous group known as "Shadow Brokers" released 10 exploit kits. One of these kits was called EternalBlue. The group alleged that EternalBlue was originally created by the US National Security Agency (NSA).

EternalBlue gained prominence in May 2017 through a worldwide ransomware attack targeting computers running the Microsoft Windows operating system, encrypting data and demanding ransom payments in bitcoin. Like all ransomware, WannaCry is the end result of a successful attack — malware that has executed on the targeted machine. The creators of WannaCry used the EternalBlue exploit to give WannaCry the ability to propagate itself without user interaction.

Why Is EternalBlue Important?
It is not publicly known when EternalBlue was developed. Likewise, it's difficult to know how long groups, like Shadow Brokers, had EternalBlue before publicly releasing it. If you think the NSA developed EternalBlue, then you know they didn't do it to shore up their budget by distributing cryptocurrency miners. EternalBlue could have easily been used to deliver and embed quieter malware packages — say, stealthy software designed to surreptitiously find and allow exfiltration of sensitive information.

While attacks by loud malware — malware that makes its presence known — such as WannaCry gain notoriety, the goal of the most sophisticated attackers is to achieve remote access with the greatest possible stealth. In other words, WannaCry rained on the EternalBlue stealth parade. The bad news is that it is not the first, nor will it be the last private party.

But the Vulnerability Had a Patch, Right?
History has a way of repeating itself. Conficker abused MS-08-067 in 2008. SQL Slammer arrived in 2003, abusing MS02-039. The next EternalBlue will probably exploit a vulnerability that isn't yet publicly known, or for which organizations have not had time to deploy a patch.

Hopefully, all endpoint security vendors can now detect the likes of Conficker, SQL Slammer, and WannaCry. That is a good thing, but it's not enough. Detecting the results of an attack or building detection of the signs of a specific attack after the attack is necessary but does not get to the root of the problem.

If EternalBlue Is the Root of WannaCry, What Is the Root of EternalBlue?
EternalBlue exploits the SMBv1 vulnerability by using a buffer overflow. At the root, a request is sent to the SMBv1 service; the request is crafted to take advantage of the mishandling of memory to produce an unintended result (executing code included in the crafted request on the targeted system).

The code that is executed provides the attacker control by way of administrator-level privilege ("system" on Windows machines). After a successful exploit, the remote commands are run in memory — nothing needs to be written to disk. An attacker may then upload malware to the compromised system, and exfiltrate data as he wishes.

Is There a Way out of Repeating the Past?
Attacks use the same set of tools — buffer overflows, code injection, heap spray, and so on — repeatedly, and successfully, against the stack that runs operating systems, and their workloads. However, virtualization has changed the stack.

In the olden days, an operating system ran directly against hardware. Virtualization introduced the hypervisor, which acts as an interface between the operating systems and hardware. This created the opportunity to inspect — indeed, introspect — memory at a layer below the most privileged layer within guest operating systems.

The Xen Project, building on efforts from individuals and security organizations, collaborated to create Machine Introspection, an API that has been commercialized as Citrix XenServer Direct Inspect APIs. The API facilitates live introspection of virtual machine memory at the hypervisor, eliminating the need to deploy software within virtual machines. This allows for live introspection of VM memory from outside the VM, and will help eliminate some of the stealthy attack techniques like the buffer overflow EternalBlue leverages. The API is open to all security vendors to build and expand on. More information can be found here.

What Is the Bottom Line?
Malicious code doesn't arrive on a target system by mysterious means. User interaction, such as clicking on a link or accepting the installation of nefarious software, is a straightforward method of delivering an attack. On the other hand, discovering and exploiting unknown vulnerabilities long before they are recognized and patched is far more complicated and time consuming. The first succeeds by leveraging high-volume attacks, hoping that at least one user will fall for it. The second leverages intense investment in research but, like EternalBlue, does not require user interaction.

There are myriad ways of defending against widely known, high-volume attacks (user education, email and URL sanitization, etc.). Sometimes, as with WannaCry, attacks will quickly incorporate recently revealed vulnerability exploits, such as EternalBlue.

The second type of attack — identifying and exploiting unknown vulnerabilities — cannot be absolutely defeated, but by inspecting virtual machine memory at the hypervisor, plenty of attack techniques can be taken out of the attacker playbook. This raises the cost of investment in creating successful attacks, stopping things like EternalBlue from succeeding before there was such a thing as EternalBlue. 

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.