Security
Virtual rootkits not a problem, say researchers
Rootkits that use virtualization techniques should not present detection problems, according to researchers from Carnegie Mellon and Stanford universities.
Working with virtualization technology vendors VMware and XenSource, the researchers produced a study recently called “Compatibility is Not Transparency: VMM Detection Myths and Realities.” (PDF) In the study, the researchers said that rootkits could not use hypervisor technology to remain undetected on a system.
No matter how minimal the hostile VMM (virtual machine monitor) is, it must consume physical resources, perturb timings and take measures to protect itself from the guest, leaving it no less susceptible to detection than other VMMs.
A year and a half ago, the first VMM (virtual machine monitor) based rootkit, was introduced (PDF), covered in the tech press. Later Joanna Rutkowska made news by claiming she had a VMM-based attack on Vista that was undetectable — a claim that was roundly challenged.
