100% Undetectable Malware created (vista ready)

[Movie Junkie]

A security researcher with expertise in rootkits has built a working prototype of new technology that is capable of creating malware that remains "100 percent undetectable," even on Windows Vista x64 systems.

 

Joanna Rutkowska, a stealth malware researcher at Singapore-based IT security firm COSEINC, says the new Blue Pill concept uses AMD's SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system.

 

Rutkowska plans to discuss the idea and demonstrate a working prototype for Windows Vista x64 at the SyScan Conference in Singapore on July 21 and at the Black Hat Briefings in Las Vegas on Aug. 3.

 

The Black Hat presentation will occur on the same day Microsoft is scheduled to show off some of the key security features and functionality being fitted into Vista.

 

Rutkowska said the presentation will deal with a "generic method" of inserting arbitrary code into the Vista Beta 2 kernel (x64 edition) without relying on any implementation bug. he technique effectively bypasses a crucial anti-rootkit policy change coming in Windows Vista that requires kernel-mode software to have a digital signature to load on x64-based systems.

 

The idea of a virtual machine rootkit isn't entirely new. Researchers at Microsoft Research and the University of Michigan have created a VM-based rootkit called "SubVirt" that is nearly impossible to detect because its state cannot be accessed by security software running in the target system.

 

Now, Rutkowska is pushing the envelope even more, arguing that the only way Blue Pill can be detected is if AMD's Pacifica technology is flawed.

 

"The strength of the Blue Pill is based on the SVM technology," Rutkowska explained on her Invisible Things blog. She contends that if generic detection could be written for the virtual machine technology, then Blue Pill can be detected, but it also means that Pacifica is "buggy."

 

PointerRead more here about Microsoft's moves to hardens Vista against kernel-mode malware.

 

"On the other hand?if you would not be able to come up with a general detection technique for SVM based virtual machine, then you should assume, that you would also not be able to detect Blue Pill," she added.

 

"The idea behind Blue Pill is simple: your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices," she explained.

 

Rutkowska stressed that the Blue Pill technology does not rely on any bug of the underlying operating system. "I have implemented a working prototype for Vista x64, but I see no reasons why it should not be possible to port it to other operating systems, like Linux or BSD which can be run on x64 platform," she added.

 

Blue Pill is being developed exclusively for COSEINC Research and will not be available for download. However, Rutkowska said the company is planning to organize trainings about Blue Pill and other technologies where the source code would be made available.

 

Rutkowska has previously done work on Red Pill, which can be used to detect whether code is being executed under a VMM (virtual machine monitor) or under a real environment.

[dbminter]

The bottom line is, most likely, it's undetectable now because Vista isn't out in the wild yet. It's new and full of holes. I wouldn't be too worried about stealth malware just yet.

[Pain_Man]

Like a new model of car, best give Vista at least a year before installing it. By then most of the major fuck ups should be fixed (which'll create new ones, natch).

 

By then the security companies will surely have developed ways to detect and defeat this "Blue Pill" rootkit.

 

The article isn't clear--or maybe I just don't know enough--but it seems to imply that Intel-based systems wouldn't be effected

 

Did I read it incorrectly?

 

The bottom line is, most likely, it's undetectable now because Vista isn't out in the wild yet. It's new and full of holes. I wouldn't be too worried about stealth malware just yet.

Edited August 21, 2006 by Pain_Man

[Movie Junkie]

The article isn't clear--or maybe I just don't know enough--but it seems to imply that Intel-based systems wouldn't be effected

 

Did I read it incorrectly?

If you are talking about the part that states; "AMD's SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system." I didn't take that as it not affecting Intel systems. I took it as they are using a technology developed by AMD to make this piece of malware.

[Pain_Man]

But they also comment that effectiveness of the "blue pill" may have something to do with Pacifica design flaws, right? I infered that Intel chips might not be as susceptible. Or may be they are. The article could have used better editing.

 

The article isn't clear--or maybe I just don't know enough--but it seems to imply that Intel-based systems wouldn't be effected

 

Did I read it incorrectly?

If you are talking about the part that states; "AMD's SVM/Pacifica virtualization technology to create an ultra-thin hypervisor that takes complete control of the underlying operating system." I didn't take that as it not affecting Intel systems. I took it as they are using a technology developed by AMD to make this piece of malware.

[dbminter]

I find it ironic the choice of terms. Blue Pill. Vi-ag-ra spammers would have a field day with this.