mark Posted June 30, 2006 Share Posted June 30, 2006 Story here.DL Link to comment Share on other sites More sharing options...
i'm not ophiel Posted July 1, 2006 Share Posted July 1, 2006 very interesting idea. presents a unique drawback to hardware based virtualization. Link to comment Share on other sites More sharing options...
Sn4k36 Posted July 1, 2006 Share Posted July 1, 2006 i don't beleive this one little bit... because u would think that a data recovery tool would help find this file... Link to comment Share on other sites More sharing options...
i'm not ophiel Posted July 1, 2006 Share Posted July 1, 2006 i didn't believe it at first either, but the secret lies within the hardware. Link to comment Share on other sites More sharing options...
Delprat Posted July 1, 2006 Share Posted July 1, 2006 "The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices," she explained.Seems like it's a new variant of MDMA, like extasy.++ Link to comment Share on other sites More sharing options...
Guest Nazi Moderation Posted July 2, 2006 Share Posted July 2, 2006 (edited) i actually don't think this will end up being that revolutionary.AV heuristics in the future will likely have an option to monitor virtualization, just as there are options now to restrict registry activity and scripts within documents.though it may be undetectable once it's installed, the process of installation and the installer executable itself will certainly give it away. Edited July 2, 2006 by Nazi Moderation Link to comment Share on other sites More sharing options...
hosebeast Posted July 2, 2006 Share Posted July 2, 2006 From an academic standpoint, it is true that the OS itself wouldn't be able to detect the rootkit planted from the hypervisor.However, from a practical standpoint, it will still be possible to detect the presence of an unrecognized (and therefore suspicious) hypervisor.How? Well obviously it's possible for the installation of a hypervisor to be started from within the OS. That's how the Blue Pill would get installed in the first place. Therefore, it would be possible to launch the installation of a second hypervisor from within the same OS. Now either the first hypervisor (the Blue Pill in this case) will block the installation of the second, in which case you will know something is wrong, or the second hypervisor will succeed and become capable of detecting the rootkit.With this in mind, the second hypervisor doesn't actually need to be a full-fledged permanently-installed hypervisor. It just needs to go through the same motions that a hypervisor installation would go through. Therefore, antimalware programs could include an "agent" or module which performs this task as part of every scan. This wouldn't be trivial for the major vendors to add, but still possible. Link to comment Share on other sites More sharing options...
Aegis Posted July 2, 2006 Share Posted July 2, 2006 Hmm...the virus reminds me of the movie "The Matrix" for some reason...dunno why though. Link to comment Share on other sites More sharing options...
LLXX Posted July 3, 2006 Share Posted July 3, 2006 Hmm...the virus reminds me of the movie "The Matrix" for some reason...dunno why though.Same thought here... Link to comment Share on other sites More sharing options...
Camarade_Tux Posted July 3, 2006 Share Posted July 3, 2006 She also published the "Red Pill". 1- yes, she !2- it is probably serious. imho the main reason it should not work is some rights should be needed to use virtualization. Link to comment Share on other sites More sharing options...
DigeratiPrime Posted July 3, 2006 Share Posted July 3, 2006 you would not be able to install something like this unless you had administrator privledges right? Link to comment Share on other sites More sharing options...
-I- Posted July 4, 2006 Share Posted July 4, 2006 thats not entirely true, as Kernel mode (run as system service) oculd also do the trick... a simple jepeg bug could than be Extremely Critical .... one way of prenting this COULD be lying in the UEFI (if im correct) standard. for example it could be possible to tell the BIOS chip how many Vertial Instances the cpu is allowed to handle.... even though this may require a reboot with every new-installed OS-instance it would help... Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now