Slashdot Mirror

← Back to Stories (view on slashdot.org)

VM-Based Rootkits Proved Easily Detectable

Posted by kdawson on from the take-one-blue-pill-and-call-me-in-the-morning dept.

paleshadows writes "A year and a half has passed since SubVirt, the first VMM (virtual machine monitor) based rootkit, was introduced (PDF), covered in the tech press, and discussed here. Later Joanna Rutkowska made news by claiming she had a VMM-based attack on Vista that was undetectable — a claim that was roundly challenged. Now in this year's HotOS workshop, researchers from Stanford, CMU, VMware, and XenSource have published a paper titled Compatibility Is Not Transparency: VMM Detection Myths and Realities (PDF) showing that VMM-based rootkits are actually easily detectable."

1 of 128 comments (clear)

  1. I read the paper by suv4x4 · · Score: 5, Interesting

    I'm still convinced that it's possible to make a VM that appaears to software running within as real hardware.

    The paper, however, takes a practical approach, examining how some industry standard VM-s operate, such as VMWare and Virtual PC.

    Those VM-s take plenty of shortcuts to improve performance, and don't virtualize some instructions, rather remap them, or "shift rings" of execution etc. as much as possible so to take advantage of the hardware while remaining sandboxed. They don't virtualize the clock as well, so you could time the performance.

    A rootkit isn't competing with other rootkits based on performance, it does so based on how undetectable it is. It's arguably a different problem. I think we're yet to witness what a full blown VM made to be a rootkit will act like, and whether it'll be detectable.