Systems and methods for detecting preparatory-stages of rowhammer attacks
The disclosed computer-implemented method for detecting preparatory-stages of rowhammer attacks may include (i) receiving, at a computing device, signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines during preparatory stages of rowhammer attacks, (ii) monitoring, at the computing device, behaviors of a virtual machine that is hosted by the computing device, (iii) detecting, at the computing device while monitoring behaviors of the virtual machine, a behavior that matches one of the signatures of preparatory behaviors, and (iv) performing, in response to detecting the behavior that matches one of the signatures of preparatory behaviors, a security action to prevent the virtual machine from perpetrating a successful rowhammer attack. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting preparatory-stages of rowhammer attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, at the computing device, signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines when preparing to perform rowhammer attacks, wherein:
the computing device hosts a plurality of virtual machines; and
at least one page of virtual memory of each of the plurality of virtual machines is mapped to at least one shared page frame of physical memory of the computing device;
while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame of the physical memory:
monitoring, at the computing device, behaviors of each of the plurality of virtual machines;
detecting, at the computing device while monitoring behaviors of the plurality of virtual machines, a behavior of at least one of the plurality of virtual machines that matches one of the signatures of preparatory behaviors; and
performing, in response to detecting the behavior, a security action to prevent the at least one of the plurality of virtual machines from perpetrating a successful rowhammer attack.
2. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines during preparatory stages of flip-feng-shui attacks.
3. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of controlling a layout of page frames in the physical memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks.
4. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of mapping the page frame in the physical memory to the page of virtual memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks.
5. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of reading from the page of virtual memory in a way that is known to enable malicious virtual machines to identify portions of the physical memory that are vulnerable to bit flipping.
6. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of reading from the page of virtual memory that is mapped to the page frame of the physical memory in a way that is known to enable malicious virtual machines to identify an alignment of the page frame within the physical memory.
7. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of aligning the page frame of the physical memory to the physical memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks.
8. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of making the page frame of the physical memory more likely to be shared with other virtual machines.
9. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of writing to the page of virtual memory in a way that is known to enable a malicious virtual machine to maintain control of the page frame of the physical memory to which the page of virtual memory is mapped.
10. The computer-implemented method of claim 1 , wherein the signatures of preparatory behaviors comprise a signature of causing page frames to be allocated continuously in the physical memory.
11. The computer-implemented method of claim 1 , wherein performing the security action comprises flagging the at least one of the plurality of virtual machines as a possible perpetrator of a rowhammer attack.
12. The computer-implemented method of claim 1 , wherein performing the security action comprises flagging the at least one of the plurality of virtual machines for forensic examination.
13. The computer-implemented method of claim 1 , wherein performing the security action comprises shutting down the at least one of the plurality of virtual machines.
14. The computer-implemented method of claim 1 , wherein performing the security action comprises preventing the at least one of the plurality of virtual machines from sharing page frames with any other virtual machine.
15. The computer-implemented method of claim 1 , wherein performing the security action comprises assigning the at least one of the plurality of virtual machines to a group of untrusted virtual machines that cannot share page frames with trusted virtual machines.
16. A system for detecting preparatory-stages of rowhammer attacks, the system comprising:
a receiving module, stored in memory, that receives, at a hypervisor, signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines when preparing to perform rowhammer attacks, wherein:
the hypervisor hosts a plurality of virtual machines; and
at least one page of virtual memory of each of the plurality of virtual machines is mapped to at least one shared page frame of physical memory of the hypervisor;
a monitoring module, stored in memory, that monitors, at the hypervisor while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame, behaviors of each of the plurality of virtual machines;
a detecting module, stored in memory, that detects, at the hypervisor while monitoring behaviors of the plurality of virtual machines and while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame, a behavior of one of the plurality of virtual machines that matches one of the signatures of preparatory behaviors;
a security module, stored in memory, that performs, in response to detecting the behavior that matches one of the signatures of preparatory behaviors while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame, a security action to prevent the at least one of the plurality of virtual machines from perpetrating a successful rowhammer attack; and
at least one physical processor that executes the receiving module, the monitoring module, the detecting module, and the security module.
17. The system of claim 16 , wherein the signatures of preparatory behaviors comprise signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines during preparatory stages of flip-feng-shui attacks.
18. The system of claim 16 , wherein the signatures of preparatory behaviors comprise at least one of:
a signature of controlling a layout of page frames in the physical memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks;
a signature of mapping the page frame in the physical memory to the page of virtual memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks;
a signature of reading from the page of virtual memory in a way that is known to enable malicious virtual machines to identify portions of the physical memory that are vulnerable to bit flipping;
a signature of reading from the page of virtual memory that is mapped to the page frame of the physical memory in a way that is known to enable malicious virtual machines to identify an alignment of the page frame within the physical memory;
a signature of aligning the page frame of the physical memory to the physical memory in a way that is known to enable malicious virtual machines to perpetrate rowhammer attacks;
a signature of making the page frame of the physical memory more likely to be shared with other virtual machines;
a signature of writing to the page of virtual memory in a way that is known to enable a malicious virtual machine to maintain control of the page frame of the physical memory; and
a signature of causing page frames to be allocated continuously in the physical memory.
19. The system of claim 16 , wherein the security module performs the security action by performing at least one of:
flagging the at least one of the plurality of virtual machines as a possible perpetrator of a rowhammer attack;
flagging the at least one of the plurality of virtual machines for forensic examination;
shutting down the at least one of the plurality of virtual machines;
preventing the at least one of the plurality of virtual machines from sharing page frames with any other virtual machine; and
assigning the at least one of the plurality of virtual machines to a group of untrusted virtual machines that cannot share page frames with trusted virtual machines.
20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive, at the computing device, signatures of preparatory behaviors that are known to be exhibited by malicious virtual machines when preparing to perform rowhammer attacks, wherein:
the computing device hosts a plurality of virtual machines; and
at least one page of virtual memory of each of the plurality of virtual machines is mapped to at least one shared page frame of physical memory of the computing device;
monitor, at the computing device while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame of the physical memory, behaviors of each of the plurality of virtual machines;
detect, at the computing device while monitoring behaviors of the plurality of virtual machines and while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame of the physical memory, a behavior of one of the plurality of virtual machines that matches one of the signatures of preparatory behaviors; and
perform, in response to detecting the behavior that matches one of the signatures of preparatory behaviors while the plurality of virtual machines have simultaneous read-only access to at least one shared page frame of the physical memory, a security action to prevent the virtual machine from perpetrating a successful rowhammer attack.