Abstract

Until this year's BlackHat presentation from Apple the highest bug bounties were offered by Microsoft for Hyper-V vulnerabilities. But even now when the bug bounties are not the highest in the industry any longer they are still highly motivating. Therefore it is interesting that only a few vulnerabilities are reported and out of these only very few are reported from non-Microsoft researchers. This might be because the entry level to Hyper-V research is quite high and there is not enough public information nor tools available about it. While Microsoft has released more information about it over the last years there is still lack of tools and knowledge about Hyper-V outside Microsoft itself.

This talk tries to change this a bit by describing the attack surface, inner workings, necessary engineering methods and tools for testing it from an outside researcher's perspective. Speaker will make his toolset public, that will hopefully help in testing, fuzzing and analyzing Hyper-V for newcomers to this topic.