Welcome to Microsoft Mechanics.
Coming up, a look at Shielded Virtual Machines.
New with Windows Server 2016 Hyper-V
that offers protection for virtual machines against malicious Hyper-V admins and malware attacks
in both public and private cloud.
We explore how they protect against a variety of attack vectors.
How you ensure the Hyper-V fabric that is running your Shielded VMs is healthy.
And, how you build an infrastructure that runs Shielded VMs
a guarded fabric.
Microsoft Mechanics
So I'm joined today by Dean Wells, the PM lead for Shielded VMs.
Welcome.
Thank you very much, Matt.
Now, VMs have been around for a while
but what are we trying to solve with Shielded Virtual Machines?
Well, you're right.
VMs have been around for a long time.
But, we have some issues with Shielded Virtual Machines.
We see customers virtualizing just about everything they can these days
from SharePoint to SQL to Active Directory domain controllers.
But, consider this.
When these workloads run on bare metal, we would physically secure them.
We put them in cages with pad locks.
We put the padlock cage into a physical data center.
We would have security guards patrol the data center.
We might even use TPMs to encrypt their disks.
How do you do any of that with Virtual Machines?
I see your point, but couldn't I just put the Hyper-V servers in the data center?
Yes, you absolutely should.
The Hyper-V servers themselves still require those same physical securities.
But what about all of the admins that administer that, that fabric admins?
We have a variety of different admins.
We have network admins, backup admins, printer admins and disk admins.
They've all got access to those virtual machines
because, they can ultimately gain access to the VHDs on the disk.
So what if they decided to copy 10, 20, 30 of those VHDs off onto a tiny little USB stick?
You wouldn't even know they had done it, does that make you feel secure?
So, if I'm the fabric admin for my virtualization host
I've pretty much got the keys to kingdon.
This isn't specific to Hyper-V, this is all virtualization platforms, right?
Absolutely, this problem is not unique to Hyper-V.
The solution itself is absolutely unique to Hyper-V.
It's what we've been working on for the past two, three maybe four years.
So, obviously you and I have talked about this problem.
Why don't I go ahead and show you exactly what it is that happens
when a malicious host tries to attack and gain some of the secrets of tenant Virtual Machines.
Okay, the first thing I'm going to do is I've logged on to this host.
I'm a legitimate admin for whoever the public cloud provider is.
And, I've logged on using my administrative privileges.
This is running a lot of tenant Virtual Machines.
I want to gain some of their secrets, so I'll run standard Windows tools.
Here I've got the Windows Disk Manager.
I'll select the Action menu.
Attach VHD.
I'm going to browse around the file system, until I find the one I'm interested in.
AD-DC1, conveniently named.
I'll go ahead and I'll mount that.
And you can see that it's actually titled System and Secrets.
That's very handy.
I'll open it up.
And for those of you that know Active Directory, you'll recognize the folder structure on this disk.
It's got an NTDS folder, which is where Active Directory's data base goes.
And, a Sysvol folder where we store group policies and scripts and stuff.
The malicious admin would come into here.
They would copy that file off onto a USB stick.
They would then close all of this down, and you are none the wiser.
They then take that home
and they can download one of seven, I think at last count
tools from the internet
that are publicly available and have been around for almost a decade.
And they sit there and they brute force passwords against the Active Directory database
until they find a match.
Once they got a match, they go ahead and record that into a password dump file
that looks something like this.
Obviously this is not a real one, and as you can see I fabricated some of the names.
That's not my real Mary Poppins password.
But, it would take say four to five days for it to yield
some level of results around 10 to 12 or maybe even 13.
Is this scenario specific to a virtualized domain controller
This applies to any workload that a virtual machine might be running.
It could be SQL, it could be SharePoint, it could even be a file server.
I could pull off any content that it's got.
So how do your Shielded VMs solve this problem?
So what we do with Shielded VMs
is we create what we refer to as a trust worthy fabric or a guarded fabric.
That enforces strong isolation boundaries between the host and its own virtual machines
So that literally means the host itself can't even get the virtual machines data.
So let me show you what I mean by repeating the same demo.
So if we come back now, I'll dismount that disk that we mounted last time.
So we only have one mounted.
Now I'll take on a different persona.
Let imagine that I'm the tenant.
I want to create a Shielded VM
because I know what happened last time around and I was not very happy with it.
So I'm gonna go ahead and create a Shielded VM.
I'll go into the web browser and I'll go off and browse through my public host provider.
Let's imagine that it's a public host this time around.
I'll go ahead and log on.
This is the Azure Pack user interface it's fully enlightened with an understanding of Shielded VMs.
Ultimately what's going to come up is the Azure Pack UX.
I'm going to go into that new user experience and I'm going to say create a new vm.
And that is the point where I can fork the path from a regular VM to a Shielded VM.
So here's how we do that.
I'll go over to the virtual machines node on the left hand side
And here, you see me click on New.
I'll go ahead and say STANDALONE VIRTUAL MACHINE
and I'll do it FROM GALLERY.
Nothing different yet.
This is regular VMM from the Azure Pack.
You'll note here that we've got two standard templates by virtue of these icons here.
And then here, I've got a special icon.
This took our developers absolutely minutes to come up with.
It's a shield.
They click on that and that and that means it's a Shielded template.
That's the cue that tells me it's different.
I'll click on Next, and then I've got to select the Shielding data.
This is owned by the IT department.
IT departments usually own domain controllers because their core infrastructure.
That begs the questions, what exactly is Shielding data?
If you think about it, when you create a new VM in Azure
and your using a UX that looks similar to this
one of the things you have to provide is a password.
Well, it wouldn't make sense if you're trying to create a virtual machine that is protected from an admin.
Why would you type the password into a web form?
when that web form is owned by the very admin you're trying to protect it from.
Your giving them the keys from the start.
Shielding data is a big lump of secrets that tenants upload to the fabric.
The admins can't decrypt it because it's encrypted with tenant keys.
And it carries all those secrets along and injects them into the virtual machine at deployment time.
I click on Next.
Connected it to a network and we're done.
That's it, Shielded Virtual Machine created.
So that's sitting there and creating.
So why don't I go ahead and show you exactly what this looks like
when I try and do that same attack against a Shielded VM.
I'm going to go back into the same tool.
This is again, the disk administrator tool.
Remember, I'm the malicious admin now, I'm not the nice tenant anymore.
I'm going to go Action and attach disk exactly as I did last time.
Browse, and this time I'm going to pick the disk that we just assigned to that shielded VM.
This time around, the disk is going to be encrypted because the VM is shielded.
The admin would open it.
Mount it in the same way they did.
The first indication that they get, they can't do anything.
It says its BitLocker encrypted.
Nonetheless they are persistent and they're going to try again.
Click on Open and they get, Access is denied.
That's not enough yet, so they'll go into Windows Explorer and they'll go this PC.
They'll scroll down a little.
And, you can see here that I've got a local disk which is the one I just mounted.
This is the tenant's active directory domain controller disk.
It's got a pad lock on it and I double click on it.
It now says, enter the password to unlock this drive.
Obviously, I'm a malicious admin and don't have BitLockers recovery passwords.
So, I can't get in that way.
So they give up on this path.
They try the universal security bypass prompts.
They run the command prompt.
They go to drive F and still it doesn't work.
They can't gain access to this disk because the disk is encrypted and they don't have the key in material.
This is a very determined admin.
So he decides to try and take a look at its console.
I'll see if there's anything I can learn from it's console session.
They go into Hyper-V
And, here we go I'll bring up the Hyper-V manager.
Before I do that, let me just remind you of what it looks like when you do this with a regular VM.
You can see here I've got a domain controller called Fabric AD.
That's part of this overall guided fabric that we are using to demo this.
If I double click on that, you can see that it brings up a VM console connection.
I can mimic its keyboard and I own it's mouse.
I can see obviously everything that's going on with it's video memory.
If you think about it, that gives me access to steal secret.
Sure I would have to be a fairly advanced attacker
but, this is another path to attack it.
Now, lets try that same thing with our Shielded VM here.
If I double click that guy
you'll notice it says you can't connect to it.
You'll also notice down on the bottom here, that what actually shows you there's no thumbnail.
We're not even allowed to inspect its video memory, let alone attach a console connection to it.
We can't steal its keyboard and we can't mimic it's mouse.
That's all disabled by virtue of it's a Shielded VM.
It switches off other technologists too, such as PowerShell direct.
Hang on a sec though.
If you've disabled the console, I as a Hyper-V admin
am forever forgetting to enable RDP, so can I connect to this VM?
You can connect to the VM in a regular manor.
via RDP, that's what you would expect to do.
but we also created a mode
because we heard feedback from a large number of customers that
they still want the ability
in certain scenarios such as an enterprise fabric
where they do trust the fabric admins
that they want to encrypt the VM for compliance purposes.
We have another mode called encryption supported.
And the encryption supported mode means I trust the fabric admin
but I want the VMs data to reinstate encrypted both at rest
and while it's being live migrated, perhaps on the wire.
And, the fabric admin gets to turn on which protections they do and do not want.
Does this only apply to VMs that we're deploying fresh?
Or, can this be applied to existing virtual machine.
We would like to say that you can only do this with new VMs.
Because if you deploy a VM as Shielded from birth
then it is secure from the outset and it's very difficult to attack it.
However, if you convert a VM.
You could argue that the malware was put on before the conversion occurred.
Well, customers still want to do it
because they will bless the machines themselves and say
I believe that to be safe.
So we support something internally, we call it Grandfathering.
Effectively it means you can convert an existing generation to VM
to shield it at any point you so choose
as long as it's running on Windows server 2016 and it's a guarded host.
So we've seen it in action.
Give us an indication, insights of what's going on behind the scenes.
Let's take a look here, we've got what we refer to as a guarded fabric.
And you can see we've broken down the component parts.
So let's take a look at the first one, Code Integrity.
We need code integrity in the guarded fabric
because if a virtual machine needs to be protected from malicious admins and malware and attacks like that
then we have to be able to trust that the host is doing what we developed it to do.
If somebody actually attacks that code
then the code is now doing what they developed it to do, which may not be protecting the VM.
We use Code Integrity and a process called attestation
where we measure code integrity policies on the machine
and all of the things that loaded when it booted
to make sure that they're doing what we expect it to be doing.
i.e. the machine is healthy.
The next thing that we need in this, is something called Virtual Secure Mode.
Many people may have heard of this in a different way, it's sometimes called isolated user mode
or, VBS which is Virtualization Base Security.
This is common to Windows 10 and Windows Server 2016 .
This is like a little safe in the corner of every machine.
It corners off or fences off memory so that malware or even an admin can't gain access to that memory
And, tiny little components run in their called trustlets.
Very cutesy term.
They're super secure, super sensitive pieces of code
that handle all the encrypting operations and we store all the keying material in their.
So we use that to keep the keys out of the grass with the malware and malicious admins.
The next piece is we have both physical and synthetic TPMs
The reason that the VMs disk is encrypted is because it thinks it has a TPM.
It's a virtual TPM.
It's not bound to the TPM on the host.
The host has a TPM for its own purposes.
But, the two aren't coupled together.
There's no relationship between the physical TPM and the Hyper-V host
and the virtual TPM inside the guest.
The Hyper-V host uses its physical TPM to secure it own disk
so they can be BitLockered and its keys can be sealed to its own TPM.
And so, we could use secure measure boot to measure it's boot code.
Next part.
The Host Guardian Service.
This is where the attestation piece that I mentioned earlier on for Code Integrity comes into play.
Basically, this guy has two roles.
He's a key protection service and an attestation service.
It's a brand new role in Windows Server 2016.
we would typically expect customers to stand this up as a three node cluster.
Everytime a Hyper-V host comes up
it has talk to this guy about the testing and key protection services
in order to be able to use Shielded VMs.
I can show you exactly what that looks like, here.
If you take a look at this guarded host
we can see it's got a Shielded VM which is colored red
because it's not yet powered on.
There's obviously a host operating system running here.
Here's our lovely little safe in the corner.
Virtual secure mode that has that fenced off memory and little truslets running inside their
for all the sensitive and secret operations.
What were going to do is try and power that Shielded VM on.
An admin goes, power on.
The first thing that the guarded host does is send over a key request.
I need you to decrypt something so I can power this Shielded VM on.
But, the host guardian services says
I don't trust you, you haven't attested.
So basically, it's saying attest.
Tell me that you're healthy.
The guarded hosts says
Oh, my bad. Let me send it to my TCG log.
The TCG log is effectively a log of all of the things that comprise the boot events
and then what the operating system did when it loaded up.
That is then recorded and each of them is measured into a TPM.
We send that TCG log over to the attestation service
who then replays the TCG log
and reaches back into the TPM of the guarded host
to see that the measurement in the TCG Log and the results and the TPM are the same.
We also send over our code integrity policy
to make sure it's only allowed to run the trustworthy code that we deemed healthy.
At this point because the host guardian says yep, thumbs up, that's all good.
It sends back this nice certificate of health.
And over it goes.
At which point, the guarded host is right, I attested.
I've got a certificate of health, let me try again.
Please give me the keys to power on Shielded VM.
So it sends over its certificate of health.
The hosts guardians attestation service examines that and goes
Yes, that looks good to me.
And it's still valid, it hasn't expired yet.
At which point, it decrypts a certain state of that Shielded VM.
Re-encrypts it to the virtual secure mode of the guarded host
and sends it back over to the guarded host who then puts it inside his VSM
gives it the VTPM trustlet.
All of it gets decrypted.
Injects the TPM into the Shielded VM.
The shielded VM boots up and does whatever the Shielded VM is going to do.
In our case it might be Windows Service 2016 running as a domain controller with an encrypted disk.
When it comes to virtualization fabrics
Admins use templates to accelerate deployments.
So, couldn't I just infect the virtualization templates?
This is actually one of my favorite parts of the whole system.
The template points to a disk
What we do is before that disk is deployed for a Shielded VM
we have a trustworthy individual sign it.
Then at deployment time we recompute that signature.
That signature was packaged into shielding data
which was encrypted, you remember me saying earlier on.
It get's unpackaged in VSM.
We compare the re- computed signature against the precomputed signature
that was built by the trustworthy admin.
If they match all is good.
If they don't, somebody tampered with the disks and we abort.
This is incredibly clever stuff
and we've talked about how you build a guarded fabric
what it looks like and how it works.
But, we haven't talked about some of the operation systems that are supporting this.
Right out of the gate it has to be generation two.
I mentioned that earlier on that we require generation two VMs.
Currently we support things that support gen 2
which is server 2012 and server 2012 r2.
Windows 8, Windows 8.1, Windows 10, Server 2016 as guest OS'
What about Azure?
Azure itself doesn't yet support Shielded VMs.
But, we're working hard to actually get Azure with a full Shielded VM offering.
I can't give you a time of when that's going to be
because we've got a large number of steps to go through before we get there.
But, Azure already has an encrypted disk offering and its actually cleverly cool
Azure encrypted disk.
And that provides you encryption for compliance purposes and you can use that today.
Thanks Dean.
That's all we've got time for.
If you want to try the Shielded VMs today
you can download the preview now.
And keep checking back on Microsoft Mechanics for more updates.
Thanks for watching.
www.microsoft.com/mechanics