Tick tock: building browser red pills from timing side channels

Abstract

Red pills allow programs to detect if their execution en-vironment is a CPU emulator or a virtual machine. They are used by digital rights management systems and by malware authors. In this paper we study the possibility of browser-based red pills, namely red pills implemented as Javascript that runs in the browser and attempts to detect if the browser is running inside a virtual machine. These browser red pills can limit the effectiveness of Web mal-ware scanners: scanners that detect drive-by downloads and other malicious content by crawling the Web using a browser in an emulated environment. We present multi-ple browser red pills that are robust across browser plat-forms and emulation technology. We also discuss poten-tial mitigations that Web scanners can use to thwart some of these red pills. 1