Scientists Unveil Lightweight Rootkit Protection

DangerFace writes "Scientists are set to unveil a lightweight system they say makes an operating system significantly more resistant to rootkits without degrading its performance. The hypervisor-based system is dubbed HookSafe, and it works by relocating kernel hooks in a guest OS to a dedicated page-aligned memory space that's tightly locked down. The team installed HookSafe on a machine running Ubuntu 8.04, and found the system successfully prevented nine real-world rootkits targeting that platform from installing or hiding themselves. The program was able to achieve that protection with only a 6 percent reduction in performance benchmarks."

Comments

I'll take one

[2names]

I would gladly give up 6% of the performance of my machine if I could be safe from rootkits. Now queue the "those who would give up system performance for system security deserve neither" posts.

Re:I'll take one

[Anonymous Coward]

Those who would give up essential system performance for temporary system security... probably need to learn how to overclock their systems.

Re:I'll take one

[NotBornYesterday]

Nice try, young man, but you can't fool me. It's hypervisors all the way down.

Sounds like a root kit.

[Hatta]

So this thing acts as a hypervisor and loads its own hooks into the kernel. Sounds like something a root kit would do.

It reminds me of one approach to avoid a terrorist attack when flying. Carry your own bomb onto the plane. After all, what are the chances that there would be two bombs on the plane?

Re:So ...

[vistapwns]

No, it's a lie. It's not possible to build a rootkit for linux, it's magical.