VMWare Rootkits, The Next Big Threat?

Lab rats at Microsoft Research and the University of Michigan have teamed up to create prototypes for virtual machine-based rootkits that significantly push the envelope for hiding malware and that can maintain control of a target operating system.

The proof-of-concept rootkit, called SubVirt, exploits known security flaws and drops a VMM (virtual machine monitor) underneath a Windows or Linux installation.

Subvirt certainly sounds like an interesting project.

I have heard about such a thing before in the blackhat community, but for Linux only, I didn’t know anyone had actually worked on a Windows variant.

Quite an amazing piece of technology, the thing is, it might already be out there..Blackhats tend to do it first, and do it dirty, but not talk about it to the media ;)

Using current methods, these root kits CANNOT be detected by the host machine.

Once the target operating system is hoisted into a virtual machine, the rootkit becomes impossible to detect because its state cannot be accessed by security software running in the target system, according to documentation seen by eWEEK.

The prototype, which will be presented at the IEEE Symposium on Security and Privacy later in 2006, is the brainchild of Microsoft’s Cybersecurity and Systems Management Research Group, the Redmond, Wash., unit responsible for the Strider GhostBuster anti-rootkit scanner and the Strider HoneyMonkey exploit detection patrol.

The problem being the malware is a lower layer than the malware detection utilities available, so it runs under the level that it can be detected. The SubVirt project has implemented VM-based rootkits on two platforms “Linux/VMWare and Windows/VirtualPC” and was able to write malicious services without detection.

It is a very stealthy attack, and perhaps it could be used to also fight against malicious code and malware.

“We believe the VM-based rootkits are a viable and likely threat,” the research team said. “Virtual-machine monitors are available from both the open-source community and commercial vendors … On today’s x86 systems, [VM-based rootkits] are capable of running a target OS with few visual differences or performance effects that would alert the user to the presence of a rootkit.”

Hardware detection is one thing that could overcome this kind of subversion by virtual machines. Intel and AMD have discussed hardware based malware scanning (AMD Execution Protection to prevent buffer overflows).

Source: eWeek