Security researchers make prototype VM rootkit

[mechBgon]

Article: http://www.eweek.com/article2/0,1759,1936666,00.asp?kc=EWRSS03129TX1K0000614

The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

So the installed OS is, without its own knowledge, running inside of a hostile VM, if I got this right. They go on to talk about it not being very difficult to do, and what they used it for in their tests (phish Web-serving, keystroke logging, searching the file system, and an antidetection countermeasure).

Just in case it interests someone

 

[RebateMonger]

On a scary related note, on the same site:

Rootkits Invading XP SP2 Installs

More than 20 percent of all malware removed from Windows XP SP2 (Service Pack 2) systems are stealth rootkits, according to senior official in Microsoft Corp.'s security unit.

 

[mechBgon]

Originally posted by: RebateMonger
On a scary related note, on the same site:

Rootkits Invading XP SP2 Installs

More than 20 percent of all malware removed from Windows XP SP2 (Service Pack 2) systems are stealth rootkits, according to senior official in Microsoft Corp.'s security unit.

This bit from that article is interesting:

For the most part, the rootkits are being detected and removed from Windows XP (gold) versions but infection rates on XP SP1 and XP SP2 machines are also high.

WinXP gold isn't even being supported (you know what I mean), so I figure those systems either just now got Automatic Updates enabled, or they're being run through Windows Update for the first time. Either way, that's encouraging. I bet the botmasters are slightly annoyed

 

[spyordie007]

And yet there are still so many people complainging about how TPM is inheritly evil... :roll:

 

[n0cmonkey]

If a BIOS based rootkit and a VM rootkit are both installed on the system, who gets control?

 

[kamper]

Originally posted by: n0cmonkey
If a BIOS based rootkit and a VM rootkit are both installed on the system, who gets control?

I don't know, but I can see advertising companies going to court over that question.

 

[Cdeck]

whichever loads first can be the host, in this case the bios.

 

[xtknight]

Originally posted by: spyordie007
And yet there are still so many people complainging about how TPM is inheritly evil... :roll:

Trusted Platform Module? What does that have to do with rootkits? (Curious, not provoking)

 

[Nothinman]

Trusted Platform Module? What does that have to do with rootkits? (Curious, not provoking)

At the very least you could have a system setup to only run binaries that are signed by a trusted entity. You might even be able to tell the system to only boot an OS that's signed by a trusted entity.

 

[Bluestealth]

I don't think many people think TPM is inherently evil, just the ability to twist it to being so that concerns people

 

[drag]

Originally posted by: Nothinman

Trusted Platform Module? What does that have to do with rootkits? (Curious, not provoking)

At the very least you could have a system setup to only run binaries that are signed by a trusted entity. You might even be able to tell the system to only boot an OS that's signed by a trusted entity.

Exactly.

Rootkits hide their identity by modifing the running code of things like the system kernel and proccess management/file management utilities. They work by using your own operating system against you. Say you run a virus scanner to scan files... How is the virus scanner going to find modified system binaries when the operating system is modified to provide false information about those files? Even checksums will come out correct.

If you ever get a server rooted.. either a Windows or Linux. The ONLY way (I repeat the ONLY way) to be sure that it can be trusted to be 'clean' is to do a reformat and reinstall.

So to protect yourself from those sorts of attacksb (if your real security measures fail) you have to go lower then the operating system and into the hardware. That's what trusted computing can do for you.

Unfortunately that is not what it is designed for. I am sure that for the server room situations administrators will be allowed to update the operating system or install patched/modified binaries and then be able to sign binaries themselves to make use of 'trusted computing modules' effective... But that isn't what it is designed for.

What it is designed for is to remove control of the computer, both hardware and software, from end users.

You see that is the trick behind the name.

They (software makers, content makers) can't 'Trust' you not to pirate or hack their stuff.. but they can 'Trust' your computer if it is not under your control. Hence 'trusted computing'.

It's usefull if your allowed control over it (like through a special boot-up setup program or bios-level application or whatnot), but if your not then it's fairly evil stuff.

 

[Smilin]

Originally posted by: Cdeck
whichever loads first can be the host, in this case the bios.

No, cuz bios would be running inside the VM.

 

[Smilin]

Trick here is that you have to first hack the Host machine right? If you could do that the game is over anyway since you now esentially have (virtual) Physical access to the (virtual) Machine.