Star VM Rootkits: The Next Big Threat?
Linked by Thom Holwerda on Sat 11th Mar 2006 21:24 UTC
Privacy, Security, Encryption Lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and that can maintain control of a target operating system. The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation. Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system.
E-mail Print r 0   38 Comment(s) http://osne.ws/are
Thread beginning with comment 103681
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: no much of a threat
by Ronald Vos on Sun 12th Mar 2006 18:28 UTC in reply to "no much of a threat"
Ronald Vos
Member since:
2005-07-06

Remember that the Sony rootkit didn't have drivers for every piece of hardware it could conceivably run on. That would be insane for anyone but a dominant OS vendor. Instead, the Sony RK merely embedded itself into the Windows kernel in a way, so that it wouldn't be easily detectable. A RK doesn't need to take over all the hooks into the OS, it merely needs to be able to intercept certain communications to the kernel, and be hidden.

Reply Parent Bookmark Score: 1