Sat, 11 Mar 2006

Microsoft Research Warn About VM-Based Rootkits

I wondered when one of these would show up. And I wonder how the new EFI boot mechanism will work with these - is there a chance that this same technique could be "exploited" to dual boot the new Intel Mac's and Windows?

I don't know the answer to that, but I do know that we're certain to find out.

According to a story on eWeek, lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and maintaining control of a target OS. The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation. Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system.

(link) [Slashdot]

/Technology | 2 writebacks | permanent link

On 3/13/2006 12:35:40
Arwin wrote

What's next

On 3/13/2006 14:23:46
Dave H wrote

Don't Misunuderstand this one ..

comment...

 
Notes: If you put a <mailto:> link in the URL field your address will not be mangled: this could be a bad idea as your email address could be easily harvested by bots designed for SPAM. The comments field should now format correctly for line feeds and carriage returns: when you hit the 'Enter' or 'Return' keys in your comment it should break to a new line. The text should wrap cleanly. Please let me know if it doesn't. No HTML tags will pass through - entering links seems to be the main cause of comment SPAM. Also, please be sure that Javascript is enabled in your browser before attempting to post a writeback. Sorry for any inconvenience, but this really helps cut down on the amount of comment SPAM I have to deal with.
 
 Name:
 URL:(optional)
 Title: (optional)
 Comments:  
Save my Name and URL/Email for next time