[ insider_reports_insider ]
Blue Pill Returning In Stealthier Mode
David Utter
Staff Writer
2006-09-22
 Insider Reports RSS Feed
Researcher Joanna Rutkowska made headlines when news of her Blue Pill virtualization rootkit became widely known; now she is working on ways to make it even harder to detect.
 | | Blue Pill Returns |  |
Advanced virtualization technologies that chipmakers AMD and Intel have worked to support with their latest processors also enable the potential threat of Blue Pill. Microsoft's beta version of the Vista OS proved vulnerable to it during Rutkowska's demonstration at the Black Hat conference in August 2005.
Now she is working on ways to make it harder to detect. This would involve thwarting efforts to notice timing changes in the execution of instructions by the CPU.
During a conference in Malaysia, Rutkowska told IDG News that she is working on beating the timing issue. "Using this virtualization technology should allow us to develop malware that is 100% undetectable," she said.
Once Blue Pill is in place on a PC, it can intercepts every action made on the system. The introduction of this malware to a corporation's or a federal agency's hardware offers plenty of scary scenarios. According to Rutkowska, there would be one way to stop Blue Pill in its tracks, though:
A more practical defense is for Microsoft to disable the paging of kernel memory in Vista, which means loading the kernel code and drivers, approximately 80MB of data, into main memory. This would prevent Blue Bill from accessing the kernel and executing code.
"Who cares about 80MB? That's why I'm so surprised that even though I showed this attack at the end of July at the SysCan conference, it still hasn't been fixed in RC1," Rutkowska said, referring to the latest preproduction version of Vista.
---
Tag: Blue Pill
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Bookmark SecurityProNews - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
