Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Research Warn About VM-Based Rootkits

Posted by ryuzaki0 on from the why-would-you-prove-that-concept? dept.

Tenacious Hack writes "According to a story on eWeek, lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and maintaining control of a target OS. The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation. Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system."

5 of 336 comments (clear)

  1. I say we take off... by LiquidCoooled · · Score: 5, Funny

    ...and nuke the entire site from orbit.
    It's the only way to be sure.

    Everything I know about rootkits tells me that you cannot detect one from within the running system, you have to be objective (I consider the current fingerprint detection to be working because of bugs in the rootkit implimentation, these will be "fixed" over time).

    Keep a known secure boot CD.

    Drain the battery and reset the bios then boot from that cd.
    If theres anything sophisticated enough to bypass this level of paranoia then it can damn well have my credit card number and I'll gladly send spam for them.

    --
    liqbase :: faster than paper
    1. Re:I say we take off... by Dunbal · · Score: 5, Funny

      Oh fuck me - the next step is a VM rootkit that flashes the bios to keep a VM rootkit.

            Just remind me when was Skynet supposed to become sentient again?

      --
      Seven puppies were harmed during the making of this post.
    2. Re:I say we take off... by el+americano · · Score: 4, Funny

      "In order to enable this chat toolbar you need to move this jumper from position A to position B. Here's a photo of what it looks like. The factory incorrectly installed this, and it limits the ability of your video card to get full 3D resolution. You don't have to turn off the computer, and it will allow you to run this really cool software. All your myspace friends will love it."

      --
      Those are my principles. If you don't like them I have others. -Groucho Marx
  2. The one thing I hate about Microsoft products... by __aaclcg7560 · · Score: 5, Funny

    You never sure if this is a feature or a bug. Either way, they will probably charge a subbscription fee to get the feature or get rid of the bug.

  3. Am I the only one here who saw... by MikeRT · · Score: 4, Funny

    an image of an idiot user taking their computer to a repair shop and the repair person uncovering 500 instances of VMWare running with 1 instance of spyware in each one?