Slashdot Mirror

← Back to Stories (view on slashdot.org)

Undetectable Rootkits Through Virtualization?

Posted by ryuzaki0 on from the two-rooted-plants-die dept.

techmuse writes "eWeek has an article about a prototype rootkit that is implemented using a virtual machine hypervisor running on top of AMD's Pacifica virtualization implementation. The idea is that the target OS, or software running on it, would not be able to detect the rootkit, because the OS would be running virtualized on top of the rootkit. The prototype is supposed to be demonstrated at the Syscan conference and the Black Hat Briefings over the next month."

2 of 237 comments (clear)

  1. Let's make this a bit easier to understand. by khasim · · Score: 5, Interesting
    I'm sure someone will correct me if I'm wrong but ...

    This is not really different from running WinXP, then installing VMWare Workstation, then installing Win2K in a virtual machine.

    The "host" OS is what gets infected. That would be WinXP. Of course nothing running in the "guest OS (Win2K) would be able to detect it. But ... so what? And that would directly contradict their claim:
    Rutkowska stressed that the Blue Pill technology does not rely on any bug of the underlying operating system.
    There are only three (3) ways for the "underlying operating system" to be infected.

    #1. Worm
    #2. Virus
    #3. Trojan

    If we aren't talking "nude pictures of celebrities", then it's either a worm or a virus and both of those are bugs in the OS.

    If it's a trojan, then WTF are you doing installing unknown apps on the host OS?

    Now, the only way this would be interesting would be if the worm / virus / trojan installed the virtualization software, moved the existing OS to a virtual machine and faked the names of all the interfaces (NIC, IDE controller, etc). If you can do that, VMWare really wants to talk to you.
  2. Virtualisation used for rootkit-safe environments by grumbel · · Score: 5, Interesting

    Can't the same trick be used to make a rootkit-safe environment? Launch a watchdog application and let that watchdog application launch the real OS in a virtualized environment, as soon as a rootkit wants to fiddle the watchdog application takes notice and there would be no way for the rootkit to either detect or by pass the watchdog. Or even more drastic, launch each (or most) process in a virtualized environment, would probally be a little slow, but should provide a extremly secure OS.