EVirt_SEB

Testing Environment#

Note: this information will be changed as new VM settings applies.

Fundamental Concepts & Definitions#

• Virtual Machine (VM): A virtual machine emulates a physical computer, running its own operating system and apps with virtualized resources. It’s isolated from the host system, allowing users to perform secure tasks like testing apps or using different operating systems while optimizing physical hardware.
• Windows Registry: A central hierarchical database used in Windows 98, Windows CE, Windows NT, and Windows 2000 used to store information that is necessary to configure the system for one or more users, applications, and hardware devices.
• Windows Management Instrumentation (WMI): Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. Although you can write WMI scripts or applications to automate administrative tasks on remote computers, WMI also supplies management data to other parts of the operating system and products.

• SEB: Safe Exam Browser

Techniques & Strategies#

SEB VM detection techniques are based on Windows Registry, WMI, CPUID, Hardware Enumeration, Driver Enumeration. As spoofing these components are possible, it is possible to decrease the VM detection confidence by spoofing the system components above, resulting possible VM detection bypass.

Validation Method#

A test exam with high security mode (Safe Exam Browser) will be provided through the Exam.net from an exam supervisor and the research outcome (exploit) will be tested on the exam to simulate an online exam security bypass scenario.

Validation Standards#

1. SEB fails to detect VM and remote session and shows missing configuration screen.
2. SEB fails to detect VM and remote session and allows the researcher to take a test exam.
3. The supervisor cannot notice any visual difference during the inspection.

Validation Assumption#

1. The latest version of Safe Exam Browser is SEB v3.10.2.
2. The simulated threat actor (a bad student) can customize VM configurations.

Requirements#

The following software were installed during the tests:

• virtio-win-0.1.285

Note: ISO file was used for the research.

Reproduce Instructions#

1. Install VirtIO drivers.
2. Use VirtIo video model type in KVM/QEMU.
3. Reboot.
4. Install SafeExamBrowser.
5. Apply EVirtPatch.
6. Manually apply seb_x64.dll DLL proxy.

Note: If the SEB displays internal/external display-related warnings, please modify the VM configuration to use VirtIO drivers for the video model.

Patch & Reverse Engineering: seb_x64.dll#

The DLL seb_x64.dll is responssible for:

1. Verifying the code and runtime integrity.
2. Detecting virtual machines (1 out of 7 detection layers).
3. Detecting remote sessions (1 out of 2 detection layers).

When SafeExamBrowser is launched, the module SafeExamBrowser.Integrity imports the seb_x64.dll and defines the following functions:

• bool IsRemoteSession();
• bool IsVirtualMachine(out IntPtr manufacturer, out int probability);
• bool VerifyCodeSignature();
• bool VerifyRuntimeIntegrity(out IntPtr data, out int count);
• …

The functions VerifyCodeSignature and VerifyRuntimeIntegrity are responssible for verifying the integrity of SafeExamBrowser. However, there are no additional protection layers to confirm its integrity, meaning this can be bypassed if they are manipulated.

DLL proxy execution technique exploits the DLL search order, resulting the SafeExamBrowser to load the crafted malicious DLL which manipulates the integrity verification results.

The following source codes weaponize the DLL proxy execution technique to manipulate the integrity verification, virtual machine detection, and remote session detection results of the SafeExamBrowser:

• seb_x64.c
• seb_x64.def
• seb_x64.sh

To ensure that this project cannot be directly abused to bypass the SafeExamBrowser, the EVirtPatch program does not support automatic DLL proxy execution setup, therefore, bypassing the integrity verification must be done manually. This “may” allow exam supervisors to detect compromised SafeExamBrowser and take actions against them. However, setting up the DLL proxy execution is not complicated and related information are available on online.

Patch & Reverse Engineering: SafeExamBrowser.Monitoring.dll#

The DLL SafeExamBrowser.Monitoring.dll is responsible for:

1. Monitoring the clipboard.
2. Detecting virtual machines (6 out of 7 detection layers).
3. Detecting remote sessions (1 out of 2 detection layers).

The function IsVirtualMachine detects virtual machines through the following 7 layers of detection layers:

1. System hardware detection (WMI).
2. PnP (Plug aNd Play) device detection.
3. MAC address detection.
4. KVM virtual CPU detection.
5. Device cache detection (Registry).
6. BIOS virtual system detection.
7. seb_x64!IsVirtualMachine

The function IsRemoteSession detects remote sessions through the following 2 layers of detection layers:

1. Terminal server session detection.
2. seb_x64!IsRemoteSession

Instead of attempting to bypass these individual detection layers, patching the DLL to return manipulated detection results leads to a detection bypass. However, patching the program will cause an integrity verification failure, meaning without the previous DLL proxy execution patch, the SafeExamBrowser detects that it self is compromised.

Conclusion#

Using the SafeExamBrowser.Monitoring.dll patch, the virtual machine and remote session detection of the SafeExamBrowser was successfully bypassed. However, this patch triggers both the code and runtime integrity verification failure. Furthermore, the 7th layer of the virtual machine detection layers and the 2nd layer of the remote session detection layers can log both the virtual machine detection results and the remote session detection results.

Using the seb_x64.dll patch, the integrity verification results were manipulated, leading to a successful integrity verification bypass. The patch also manipulates the external virtual machine and remote session detections (7th layer of virtual machine detection layers & 2nd layer of remote session detection layers), leading to a complete detection bypass.