Slashdot Mirror
Microsoft Research Warn About VM-Based Rootkits
Tenacious Hack writes "According to a story on eWeek, lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and maintaining control of a target OS. The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation. Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system."
...and nuke the entire site from orbit.
It's the only way to be sure.
Everything I know about rootkits tells me that you cannot detect one from within the running system, you have to be objective (I consider the current fingerprint detection to be working because of bugs in the rootkit implimentation, these will be "fixed" over time).
Keep a known secure boot CD.
Drain the battery and reset the bios then boot from that cd.
If theres anything sophisticated enough to bypass this level of paranoia then it can damn well have my credit card number and I'll gladly send spam for them.
liqbase
You never sure if this is a feature or a bug. Either way, they will probably charge a subbscription fee to get the feature or get rid of the bug.
i've been working on a compromised system to poke for holes in the concept and i hit upon a novel idea. in fact, it's really simple
all you have to do is-END CARRIER-
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
an image of an idiot user taking their computer to a repair shop and the repair person uncovering 500 instances of VMWare running with 1 instance of spyware in each one?
Microsoft Techie #1: How are we going to get this to work?? Hmm, maybe we can stick this virtual machine monitor here, and then we can trick the highly technical, security-conscious guys who would use the system into giving us root access so we could put it before kernel secure mode is initiated?
Microsoft Techie #2: Nah, too complicated. Let's just wait until the next default security hole...
Creative misinterpretation is your friend.
Microsoft start to SUPPORT linux? And start off with a rootkit prototype?
Man, that is how a friend should be.
The obvious solution is... Windows VISTA!
Heck the OS is so large any VMBR trying to "hoist" it is going to probably:
A.) Run out of space (memory or HDD).
B.) Take so long to hoist the OS, the user will probably reboot thinking their machine's locked up again.
C.) Cause CowboyNeal to acquire a hernia.
They (MS) are probably just looking for more selling points for their new BIG baby.
Really pisses them off when they go to the theater and then find out they don't own it after paying money, or not being able to take the elephants home from the circus!
kurzweil_freak
5th Kyu Genbukan Ninpo/KJJR student
Be the darkness that allows the light to shine.
You would soon know if you were running multiple Windows Virtual Machines because within minutes of the infection you would receive an email from Microsoft demanding you pay for the additional licences.
AT&ROFLMAO
The one time Microsoft ports some of their software to Linux, and it's a rootkit. ;)
--
Given enough personal experience, all stereotypes are shallow.