[ news_security_news ]
IBM Staffer Crushes Blue Pill
David Utter
Staff Writer
2006-08-11
 Insider Reports RSS Feed
The potential for an undetectable piece of malware to invisibly take over a PC raised a lot of eyebrows on the Internet and at the Black Hat conference in Las Vegas; the threat of the Blue Pill virtualization method may be less than it seems.
Researcher Joanna Rutkowska got a lot of attention in June, when her blog post in late June noted her construction of Blue Pill, an undetectable hypervisor built on AMD's SVM technology, formerly known as Pacifica.
Once in place on a system, the Blue Pill would operate without any loss in hardware performance. Everything would function and execute inside the virtual machine. Imagine if that concept were adapted to include a keylogger or some other data-stealing program.
Unimaginable, according to Anthony Ligouri, who works for IBM's Linux Technology Center and also develops for the Xen hypervisor project. His interview on Virtualization.info, Debunking the Blue Pill Myth, Ligouri considered it "impossible" that the system takeover scenario developed by Rutkowska could take place.
Ligouri called the Blue Pill prototype "very detectable," no matter how it might be created:
All it does is turn on SVM, and set up a small piece of memory that is called periodically. It makes no attempt, currently, to hide that memory from the operating system so one could simply search all of physical memory.
However, even if she builds a full VMM with proper memory protection (which is no small task), there would still be a way to detect it.
That detection could happen because with emulation, instructions take longer to execute on a system. Ligouri said this would be the way to detect the presence of something like Blue Pill, or any other VMM in general.
So maybe we are safe for now.
---
Tag: Blue Pill
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
