Slashdot Mirror
Undetectable Rootkits Through Virtualization?
techmuse writes "eWeek has an article about a prototype rootkit that is implemented using a virtual machine hypervisor running on top of AMD's Pacifica virtualization implementation. The idea is that the target OS, or software running on it, would not be able to detect the rootkit, because the OS would be running virtualized on top of the rootkit. The prototype is supposed to be demonstrated at the Syscan conference and the Black Hat Briefings over the next month."
I've been telling people this for a while, mainly to blank stares; you cannot detect if you have a virus/keylogger/spyware on your system. All those utilities people pay so much for are worthless! They only detect the known malware, but nobody knows about the undetected hacks. The technology discussed in this article has been around for longer than the OS's have been!
You must assume in this day and age that if your computers will become infected with undetectable malware within a relatively short time of normal internet connectivity.
Accepting this then, the only truly safe way to compute today is to keep your boot/OS/application drive from being writable. Baring this, the next best step is to re-image your drive from non-writable media daily. Throw away the expensive antivirus scanners, they do nothing.
Are you staring blankly at me? Did you know that you can reimage your drive in 5 minutes and guarantee your computer is clean? Thats far less time than it takes a scanner to scan ineffectively your system files. The main trick is to boot from a DVD and to store the image on an external harddrive. And to use a certain discipline in creating incremental images that keep them malware free. This, along with a firewall, is the only reliable defense today.