Requirements for Injectable Virtual Machines

Wes Brown | March 14th, 2008 | Filed Under: Development

Much of the last two or three years of my research time has been devoted to the concept of injectable virtual machines and using them in a penetration testing context.  I’ve found that once created, they tend to be handy tools that solve other problems too outside of the original intended design goals, such as secure code deployment using lightweight portable virtual machines.

Requirements design can be an iterative process, and after working on several implementations of the injectable virtual machine, the following requirements were codified:

  • Compact.  This is the biggest requirement: that the implementation be compact.  How compact you need it to be depends entirely on what you want to do with it.  But in general, the smaller the footprint, the more you can do with it.  In the past, I’ve targeted 64K-128K of payload size, and considered that pretty good.  But the smaller the implementor makes it, the more likely it is to be useful in more contexts such as first stage injection.  This also extends to the libraries and bytecode that is generated for the virtual machine, as the virtual machine by itself is useless without logic to drive it.  This is why I’m targeting a much smaller payload size in my next implementation, of a few kilobytes.
  • Portability.  This is another huge design goal that I think many people who operate in this space miss out on.  The implementation of the virtual machine should be portable between platforms.  Behaviors should be as similar as possible and abstracted out so as not to distract the programmer-user from the task at hand.  A task such as opening a socket on a Windows machine should work on a Unix machine as well.  When we have multiple implementations of a virtual machine, we run into the risk of different behaviors, defeating the entire purpose of a portable bytecode virtual machine.
  • Dynamic.  The virtual machine should be dynamic.  We should be able to modify the behavior of the program and language while executing.  By being self-modifying, the language and core functionality can start out very small, but be extended upon.  Features that are not needed early in the process such as garbage collection can be added.  Squeeze a payload in, and watch it expand, much like a ship in the bottle.
  • Secure.  Using the virtual machine for injection purposes should never introduce a state of insecurity to the target machine or network!  While it is all but impossible to make a virtual machine immune to examination by a local user who controls the machine, the virtual machine should not be easily attackable from the outside or use a cleartext control channel.
  • Elegance.  This cannot be understated.  While it is easy to write a functional and spartan language for the purpose, it is not going to be pleasant for the programmer.  Programmers are happiest when they have a language that does not get in their way.  If the language and virtual machine environment does not have this characteristic, then people are not going to use this tool.  Elegant design also lends itself well to other desired traits such as dynamism and compactness.

    • I will be taking a critical eye at the implementations that I have worked on in the past and contrasting it with these requirements, where they succeeded and where they failed.  If you, my dear reader, feel that additional requirements should be applied, let me know!

    Tags: , ,

    6 Comments so far