How can I make sure that my Linux server is running on a non-virtualised real box?This is the scenario I am thinking of:I install some distro on a rack-mounted server,I rent some rack space on in a data-center and leave it there,Mallory (the attacker) goes to the data-center disconnects my server,Mallory takes an image of the disk,Mallory runs the disk image as a guest on a KVM box.Suppose, for the sake of this question, that the attackerhas modified KVM, or any similar hypervisor, to simulate exactly the same hardware my server was running on,knows all the known escape-the-hypervisor or detect-the-hypervisor attacks and has patched the hypervisor to counteract them (so no Red pill and similar).So my question is: will there ever be solid ways to make sure that an OS is running on a physical box (or on one precise physical box), ways that do not rely on virtualisation flaws (like Red pill)?Or the other way around: are there proofs that such kind of detections will always be possible?Clarification: this is an hypothetical question, not a discussion about current technologies. Currently it is quite easy to detect whether I am in a virtualised environment, just use imvirt and its collection of known virtualisation glitches/flaws. I would like to know if things like perfect virtualisation has been discussed and found possible or impossible from a theoretical point of view.
How can I be sure that my server is not virtualised?
virtualization
You assume that the attacker has made a virtual machine that perfectly emulates your hardware. Under this assumption, then by definition you can't detect that your code is running in the virtual machine.If the virtual machine is in fact running on the real hardware, you should be able to detect it from the outside, because the overhead of the virtualization is likely to introduce some additional response latency. The overhead may not be noticeable above other network overhead. If the virtual machine is running on faster hardware, it may provide a perfect emulation, in theory.In practice, it would be extremely difficult to provide perfect hardware emulation. (This is something operating systems and driver developers would like, and unfortunately for them emulators aren't perfect.) Sure, it's possible in theory, but there would be cheaper attack methods for the attacker. You're postulating physical access; the attacker could plant a hidden rootkit, or put a spy on the PCI or RAM bus: that would cost less than developing perfect emulators for all the hardware that's around. Or, even more likely, Mallory would exploit a software hole, phish a password, or as a last resort use wrench cryptanalysis, if she was really bothered.Copying the data and planting the rootkit is by far the easiest attack method. You can protect against this to some extent by using a TPM in your server. TPMs are designed to be hard to replicate, and if used correctly (note: this is difficult! There are currently no off-the-shelf operating systems that verify the entire OS's integrity from a TPM root of trust.) the TPM can protect the integrity and confidentiality of your operating system and its data.