{"guid":"9RncwfCW37x4dhs15BQqBQ","title":"Virtual Machine Introspection","subtitle":"From the Outside Looking In","slug":"31c3_-_6297_-_en_-_saal_6_-_201412301600_-_virtual_machine_introspection_-_tamas_k_lengyel_-_thomas_kittel","link":"http://events.ccc.de/congress/2014/Fahrplan/events/6297.html","description":"New methods and approaches for securing cloud environments are becoming increasingly more critical as traditional host security strategies are not well integrated into virtual environments. For example, antivirus scans are a critical component of layered defense-in-depth, but in the cloud they rapidly exhaust available CPU and memory. The cloud environment nevertheless offers a unique opportunity: the ability to peer into a running operating system from an outside perspective, known as virtual machine introspection (VMI). More interestingly, it is also possible to alter the behavior of the virtualized components to help protect virtual systems in real-time. In this talk we will explore the open-source LibVMI library which over the last year, as part of the DARPA Cyber Fast Track program, has been significantly extended to ease the process of developing cloud security solutions.","original_language":"eng","persons":["Tamas K Lengyel","Thomas Kittel"],"view_count":2049,"promoted":false,"date":"2014-12-30T16:00:00.000+01:00","release_date":"2015-01-01T01:00:00.000+01:00","updated_at":"2026-01-06T19:00:27.665+01:00","tags":["Security \u0026 Hacking"],"length":3522,"duration":3522,"thumb_url":"https://static.media.ccc.de/media/congress/2014/6297-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2014/6297-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2014/9RncwfCW37x4dhs15BQqBQ-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2014/9RncwfCW37x4dhs15BQqBQ-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/31c3_-_6297_-_en_-_saal_6_-_201412301600_-_virtual_machine_introspection_-_tamas_k_lengyel_-_thomas_kittel","url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_title":"31C3: a new dawn","conference_url":"https://api.media.ccc.de/public/conferences/31c3","related":[{"event_id":147,"event_guid":"import-8fc3552b8dc23b5f8d","weight":1},{"event_id":272,"event_guid":"import-35d0bb6676ee022892","weight":1},{"event_id":948,"event_guid":"import-28674b64c7c10289a3","weight":1},{"event_id":1043,"event_guid":"import-21d05b6ae105e4a388","weight":1},{"event_id":1047,"event_guid":"import-9a29d7fecce7ac000e","weight":1},{"event_id":1149,"event_guid":"import-54ac75812fba306f63","weight":1},{"event_id":1634,"event_guid":"import-fc1f688f0d31a70bc7","weight":1},{"event_id":1636,"event_guid":"import-abe84190a8a3851cdb","weight":1},{"event_id":1642,"event_guid":"import-fa7c344d969e1f7c8d","weight":1},{"event_id":1648,"event_guid":"import-cc4c7fb71df2c4b328","weight":1},{"event_id":1675,"event_guid":"import-30e78222488f0be76e","weight":1},{"event_id":1722,"event_guid":"RiskSjr33wsyUrC5oX80uw","weight":1},{"event_id":1724,"event_guid":"-zXtqISaAof8oPTr8SYyTQ","weight":1},{"event_id":1733,"event_guid":"QszoY6oJD6rpkbsTRQinRA","weight":1},{"event_id":1740,"event_guid":"0IuyfNlW5fXVnrMIgEXesw","weight":1},{"event_id":1746,"event_guid":"il4lmTSfWPAY3ks_KW7SHg","weight":1},{"event_id":1751,"event_guid":"rP-d3RdgW3DkgejXmeWAeQ","weight":1},{"event_id":1755,"event_guid":"O-7g6jlu6DmenVdxO6t2Mg","weight":1},{"event_id":1763,"event_guid":"WbqegbTKG5YheKse8X4ZUw","weight":1},{"event_id":1765,"event_guid":"sh_vDLYCDlmW5sFWsI4KSg","weight":1},{"event_id":1770,"event_guid":"piiLuOpnx-bTwU28WOUQWA","weight":1},{"event_id":1771,"event_guid":"UW-GGUBQz587MFHw9yXl6A","weight":1},{"event_id":1787,"event_guid":"Veo2ucE-l2cA-V-EaA_ckA","weight":1},{"event_id":1798,"event_guid":"0wIAXwCTvHhMFKucqslNxg","weight":1},{"event_id":1800,"event_guid":"gL8lRFVpn8NFFfATsOn7Bw","weight":1},{"event_id":1801,"event_guid":"I1Wkt7x8Yy2ZnP2kOGAuXA","weight":1},{"event_id":1803,"event_guid":"c3Q-MbMX7FDXWv6rYj2bFw","weight":1},{"event_id":1805,"event_guid":"z2_SbAXdwSQnezj6oPTuIg","weight":1},{"event_id":1814,"event_guid":"3HEv_YYlkY2P_y1pKfU7fA","weight":1},{"event_id":1829,"event_guid":"n4vgYDc2e8tbtF6g9mZIlA","weight":1},{"event_id":1832,"event_guid":"toykIIIHEXC1x8F7xoiYRw","weight":1},{"event_id":1839,"event_guid":"tnCge6rYmFPy9O0KjvtBAQ","weight":1},{"event_id":1853,"event_guid":"_PZbf5bEsVNq9q3vTxAazQ","weight":1},{"event_id":1854,"event_guid":"D27zQV1jKk88oKyXxGBGPQ","weight":1},{"event_id":1985,"event_guid":"bMqZPzTNrt01vh8LIJPt_g","weight":1},{"event_id":2161,"event_guid":"oI8n77eKy3Uz2Fklmk4hVQ","weight":1},{"event_id":2167,"event_guid":"1116a02b-0312-4949-9921-d605148bfccb","weight":1},{"event_id":2169,"event_guid":"Fj7J1P7FKCiWEl7lIaDaXg","weight":1},{"event_id":2173,"event_guid":"13hAy7IIWod2RIuLMvnELw","weight":1},{"event_id":2176,"event_guid":"psS7-V3-VqYDuiKCr5PmWg","weight":1},{"event_id":2183,"event_guid":"yMuYr5eW4o9FpJMw-NwXrg","weight":1},{"event_id":2187,"event_guid":"JhCUm-jQqCMx_jDfrzH24Q","weight":1},{"event_id":2191,"event_guid":"8283fa4f-a6eb-4296-a6a8-20c3f9d80a4c","weight":1},{"event_id":2199,"event_guid":"MBpSOQzfPD4ky0hqL6B-hg","weight":1},{"event_id":2204,"event_guid":"78e2d419-0adc-43ff-989e-95a78ac9ddd4","weight":1},{"event_id":2208,"event_guid":"T7Ta13fUuQaAbv1JlO4-Qg","weight":1},{"event_id":2217,"event_guid":"Mw1wjnNzwxzSkM3Ip5Lg0g","weight":1},{"event_id":2226,"event_guid":"hl9yD87mkTYvOY5J2BIQwQ","weight":2},{"event_id":2227,"event_guid":"H1GEe9l64eUbo1oZXtLkEg","weight":2},{"event_id":2244,"event_guid":"a7cde3ca-46a8-4f0b-be61-f60e77f3418e","weight":1},{"event_id":2246,"event_guid":"5hkhmuwi5J8ZHMfd5k7veg","weight":1},{"event_id":2266,"event_guid":"4_Q4s48yg8FV08kvf9lbpQ","weight":1},{"event_id":2269,"event_guid":"C4w30id6HpMnzKM2xcrT4g","weight":2},{"event_id":2271,"event_guid":"f69efb76-d030-4371-83e1-d7b2b8d408b9","weight":1},{"event_id":2290,"event_guid":"e604e540-90d0-4910-920a-1c23ea83e341","weight":1},{"event_id":2451,"event_guid":"746c83c2-b29b-41e7-be5b-fafdfe923a5a","weight":1},{"event_id":2785,"event_guid":"d2328a1a-84a4-11e5-9649-fc20a462b876","weight":1},{"event_id":2816,"event_guid":"78ea005f-4ddb-44d1-82e5-a2825ddea4e1","weight":1},{"event_id":2842,"event_guid":"08843e46-b813-49a4-93ad-ab6e7b3e4a17","weight":1},{"event_id":2844,"event_guid":"b753dbd8-32bb-437c-9f15-db0d7ac1811a","weight":1},{"event_id":2855,"event_guid":"52706f90-a2f9-48be-a4c3-786257fce233","weight":1},{"event_id":2861,"event_guid":"01da121b-bd49-4805-aaaf-a6ec1f4f941f","weight":1},{"event_id":2872,"event_guid":"df2f6e8a-f1fb-4736-8b4e-7e197ead73c2","weight":1},{"event_id":2875,"event_guid":"0bdbef2d-1594-4582-b315-7ee5da5505bf","weight":1},{"event_id":2879,"event_guid":"3f61827f-8b17-47b4-a43c-e0dce6532cbe","weight":1},{"event_id":2882,"event_guid":"df35c860-60fc-4df8-801c-b2f4f91b33b8","weight":1},{"event_id":2884,"event_guid":"fb537cde-7f1d-484b-971b-1d30a543ecfb","weight":1},{"event_id":2887,"event_guid":"cc9ede64-bad5-4ed0-92a3-4fbaf54eadec","weight":1},{"event_id":2891,"event_guid":"3a1241e9-1e0b-4539-a44c-7d04257ae16d","weight":1},{"event_id":2943,"event_guid":"969bee9e-d0bf-4d24-a649-15f93747d608","weight":1},{"event_id":2955,"event_guid":"c3731bcd-04a8-49ba-a472-d1180944c106","weight":2},{"event_id":3193,"event_guid":"mawQqs7d0K2Zg-etAUYlkg","weight":1},{"event_id":3205,"event_guid":"dQtt5z0gTMrzSPkkkv5y1g","weight":1},{"event_id":3382,"event_guid":"7b5e1f40-3260-48f3-b5b0-b5b192a88737","weight":1},{"event_id":3734,"event_guid":"34ea8f1f-9fad-41aa-8424-e833f10e5e8b","weight":1},{"event_id":3852,"event_guid":"6c673b80-3f20-11e7-81b0-83993a7ef3dd","weight":1},{"event_id":3863,"event_guid":"9d73617c-83e1-4457-ab0f-13a99ea57d0d","weight":1},{"event_id":4248,"event_guid":"07a55a43-7096-49a9-9f89-38fa00e3cd47","weight":1},{"event_id":4383,"event_guid":"aa3b2924-157d-41fc-a48b-d5230919b1ed","weight":1},{"event_id":4450,"event_guid":"cb892f65-89b4-4c50-8ff6-e38725c67438","weight":1},{"event_id":4650,"event_guid":"ce9a7617-e017-4aa5-a712-794536501848","weight":1},{"event_id":4795,"event_guid":"722ce759-9cde-4e3b-8db5-5a97aa9673d9","weight":1},{"event_id":4830,"event_guid":"5cf8c222-47d3-4741-9324-be182b4d0fb8","weight":1},{"event_id":5835,"event_guid":"ef93ad8e-5953-5844-9a7f-e4573b2ebf34","weight":1},{"event_id":6462,"event_guid":"23e85d7a-9645-4ae2-9954-63b71abc08d4","weight":1}],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"DRAFT_31c3-6297-en-de-Virtual_Machine_Introspection.en_DRAFT.srt","state":"todo","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2022-01-15T18:53:05.337+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/DRAFT_31c3-6297-en-de-Virtual_Machine_Introspection.en_DRAFT.srt","url":"https://api.media.ccc.de/public/recordings/50902","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":211,"length":3522,"mime_type":"video/mp4","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_sd.mp4","state":"downloaded","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:08:01.539+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-sd/31c3-6297-en-de-Virtual_Machine_Introspection_sd.mp4","url":"https://api.media.ccc.de/public/recordings/5865","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":39,"length":3513,"mime_type":"audio/opus","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_opus.opus","state":"downloaded","folder":"opus","high_quality":true,"width":null,"height":null,"updated_at":"2015-01-01T16:45:50.750+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/opus/31c3-6297-en-de-Virtual_Machine_Introspection_opus.opus","url":"https://api.media.ccc.de/public/recordings/5875","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":80,"length":3513,"mime_type":"audio/mpeg","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_mp3.mp3","state":"downloaded","folder":"mp3","high_quality":true,"width":null,"height":null,"updated_at":"2015-01-01T16:50:41.508+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/mp3/31c3-6297-en-de-Virtual_Machine_Introspection_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/5880","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":157,"length":3522,"mime_type":"video/webm","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_webm-sd.webm","state":"downloaded","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-02-03T14:08:02.410+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/webm-sd/31c3-6297-en-de-Virtual_Machine_Introspection_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/5883","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":487,"length":3522,"mime_type":"video/mp4","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_hd.mp4","state":"downloaded","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T14:07:57.468+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-hd/31c3-6297-en-de-Virtual_Machine_Introspection_hd.mp4","url":"https://api.media.ccc.de/public/recordings/5836","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":413,"length":3522,"mime_type":"video/webm","language":"eng","filename":"31c3-6297-en-de-Virtual_Machine_Introspection_webm-hd.webm","state":"downloaded","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-02-03T21:01:43.335+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/webm-hd/31c3-6297-en-de-Virtual_Machine_Introspection_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/5899","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"},{"size":null,"length":3522,"mime_type":"video/mp4","language":"eng","filename":"31c3-6297-en-Virtual_Machine_Introspection_hd.mp4","state":"downloaded","folder":"h264-hd-web","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-01-26T08:07:57.877+01:00","recording_url":"https://cdn.media.ccc.de/congress/2014/h264-hd-web/31c3-6297-en-Virtual_Machine_Introspection_hd.mp4","url":"https://api.media.ccc.de/public/recordings/6051","event_url":"https://api.media.ccc.de/public/events/9RncwfCW37x4dhs15BQqBQ","conference_url":"https://api.media.ccc.de/public/conferences/31c3"}]}