|
08.08.06
Vista Beta Vulnerable To Blue Pill
 By
David A. Utter
The virtualization technique used by researcher Joanna Rutkowska can invisibly reside on an operating system, and at the Black Hat conference she demonstrated its potency.
Ever since news of her hypervisor technology rootkit became widely known in late June, many in the security field had been eagerly awaiting her appearance at the Black Hat conference.
Rutkowska did not disappoint her audience last week. An overflow crowd watched as she showed how the "Blue Pill" malware she created could blow by the security in a beta build of Microsoft's Vista operating system, TechNewsWorld reported.
"The fact that this mechanism was bypassed does not mean that Vista is completely insecure. It's just not as secure as advertised," Rutkowska said to the audience. "It's very difficult to implement a 100 percent-efficient kernel protection."
On her personal blog, Invisible Things, Rutkowska discussed the Blue Pill, which she developed as part of her work with Singapore-based COSEINC:
Over the past few months I have been working on a technology code-named Blue Pill, which is just about that - creating 100% undetectable malware, which is not based on an obscure concept.
The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices, like graphics card, are fully accessible to the operating system, which is now executing inside virtual machine.
For the attack to work on that early build of Vista, the target system had to be running in administrator mode. If future users of Vista run as users with lesser privileges, and are careful enough not to accept every security popup without reviewing it, they would be able to avoid the Blue Pill.
CTOs will want to ensure their staffs know about the potential threat from virtualization technology. Now that Rutkowska has figured out how to accomplish it, other researchers will follow. Not all of them will be as principled as her, either.
About
the Author:
David Utter is a staff writer for WebProNews covering technology and business. |
