This talk presents eKimono, a new malware scanner for Virtual Machine (VM). By putting eKimono outside of the protected VM, we can fix, or raise the bar in other cases, the most significant flaws in the legacy anti-malware solutions. Advantages offered by our scanner include, but not limited to, the followings: firstly, eKimono is tamper-resistant against malware inside VM, even if the malware compromises the VM’s kernel. Secondly, it is harder to be fooled, because eKimono does not rely on the services provided by VM. Last, but not least, our scanner is invisible from VM, so that malware inside never know that they are being monitored.

The architecture and implementation of eKimono will be discussed in length. We will show how our scanner easily supports hypervisors like Xen, KVM and QEMU out-of-the-box. The talk will also demonstrate that it is trivial to support other types of VM, such as VMWare, thanks to its extremely flexible design.

Technically, eKimono is a top component of a multiple framework architecture. The talk analyses all the layers and explains how we solve challenges in designing and implementing eKimono. The extended application of the below layers is also examined to prove that our frameworks are not just useful for eKimono, but can also be the base to create many new tools, such as such as live memory forensic and VM administration, for VM.

To conclude, this presentation entertains the audience with some live demo on detecting several popular kernel and user-space root-kits in Windows VM.

About Nguyen Anh Quynh

Nguyen Anh Quynh is a researcher at The National Institute of Advanced Industrial Science and Technology (AIST), Japan. He interests includes computer security, networking, operating system, virtualization, trusted computing, digital forensic, and intrusion detection. He published a lot of academic papers in those fields, and frequently gets around the world to present his research results in various hacking conferences. Quynh obtained his PhD degree in computer science from Keio University, Japan. He is also a member of VnSecurity, a pioneer security research group in Vietnam.