4 ms·

Intel Kernel Guard Technology

36 points by andrewaylett 11y ago

cuongpm 11y ago
This is interesting. I'm wondering by utilizing VT-x to implement the xmon module, whether this framework can be used to protect a hardware virtualized hypervisor (e.g., KVM) or not.
- Sanddancer 11y ago
  Yep. This is all stuff that VT-x can already do, only it's giving a nice little wrapper to do it to the "base" operating system. More than a bit of me sees this as something to encourage operating system developers to actually use the security features that virtualization allows, instead of doing the bare minimum and obvious with it.
  - cuongpm 11y ago
    The protected OS is de-privileged though. In order to protect a hardware virtualized hypervisor (i.e., one that also requires VT-x), they need to implement some sort of nested virtual machine.
    - wtallis 11y ago
      Haswell and later processors have extra hardware support to make nested virtual machines faster. It's not a problem.
      - dman 11y ago
        Any details about this?
        wtallis 11y ago
        The feature is called VMCS shadowing. Wikipedia's description cites an Intel whitepaper (https://www-ssl.intel.com/content/dam/www/public/us/en/documents/white-papers/intel-vmcs-shadowing-paper.pdf https://www-ssl.intel.com/content/dam/www/public/us/en/docum...) which describes how it's intended to help with the case of using McAfee's Deep Safe hypervisor (which does basically the same thing as this Kernel Guard, but for Windows) nested inside of Xen.
benjarrell 11y ago
Seriously‽ https://01.org/intel-kgt/documentation/download-and-install-ikgt-curl-scripts https://01.org/intel-kgt/documentation/download-and-install-... To download and install iKGT for Debian systems, use the following curl command: $ curl https://01.org/sites/default/files/downloads/intel-kernel-guard-technolo... | bash To download and install iKGT for RPM systems, use the following curl command: $ curl https://01.org/sites/default/files/downloads/intel-kernel-guard-technolo... | bash
- cuongpm 11y ago
  The instruction in their github looks more legit: https://github.com/01org/ikgt-manifest https://github.com/01org/ikgt-manifest
- pmh 11y ago
  Amusingly enough, they grab the source tarball over http: servername=01.org/sites/default/files/downloads/intel-kernel-guard-technology ... wget http://${servername}/ikgt1.0-0amd64deb.tar.gz
namplaa 11y ago
I can hardly wait to see the presentation on how the circumvent it.

36 points by andrewaylett 11y ago

This is interesting. I'm wondering by utilizing VT-x to implement the xmon module, whether this framework can be used to protect a hardware virtualized hypervisor (e.g., KVM) or not.

Sanddancer 11y ago
Yep. This is all stuff that VT-x can already do, only it's giving a nice little wrapper to do it to the "base" operating system. More than a bit of me sees this as something to encourage operating system developers to actually use the security features that virtualization allows, instead of doing the bare minimum and obvious with it.
- cuongpm 11y ago
  The protected OS is de-privileged though. In order to protect a hardware virtualized hypervisor (i.e., one that also requires VT-x), they need to implement some sort of nested virtual machine.
  - wtallis 11y ago
    Haswell and later processors have extra hardware support to make nested virtual machines faster. It's not a problem.
    - dman 11y ago
      Any details about this?
      - wtallis 11y ago
        The feature is called VMCS shadowing. Wikipedia's description cites an Intel whitepaper (https://www-ssl.intel.com/content/dam/www/public/us/en/documents/white-papers/intel-vmcs-shadowing-paper.pdf https://www-ssl.intel.com/content/dam/www/public/us/en/docum...) which describes how it's intended to help with the case of using McAfee's Deep Safe hypervisor (which does basically the same thing as this Kernel Guard, but for Windows) nested inside of Xen.

benjarrell 11y ago

Seriously‽ https://01.org/intel-kgt/documentation/download-and-install-ikgt-curl-scripts https://01.org/intel-kgt/documentation/download-and-install-... To download and install iKGT for Debian systems, use the following curl command: $ curl https://01.org/sites/default/files/downloads/intel-kernel-guard-technolo... | bash To download and install iKGT for RPM systems, use the following curl command: $ curl https://01.org/sites/default/files/downloads/intel-kernel-guard-technolo... | bash

cuongpm 11y ago
The instruction in their github looks more legit: https://github.com/01org/ikgt-manifest https://github.com/01org/ikgt-manifest
pmh 11y ago
Amusingly enough, they grab the source tarball over http: servername=01.org/sites/default/files/downloads/intel-kernel-guard-technology ... wget http://${servername}/ikgt1.0-0amd64deb.tar.gz

namplaa 11y ago

I can hardly wait to see the presentation on how the circumvent it.